net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include <net/inet_connection_sock.h>
  23 #include "core.h"
  24 #include "nl80211.h"
  25 #include "reg.h"
  26 #include "rdev-ops.h"
  27
  28 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  29                                    struct genl_info *info,
  30                                    struct cfg80211_crypto_settings *settings,
  31                                    int cipher_limit);
  32
  33 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
  34                             struct genl_info *info);
  35 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
  36                               struct genl_info *info);
  37
  38 /* the netlink family */
  39 static struct genl_family nl80211_fam = {
  40         .id = GENL_ID_GENERATE,         /* don't bother with a hardcoded ID */
  41         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
  42         .hdrsize = 0,                   /* no private header */
  43         .version = 1,                   /* no particular meaning now */
  44         .maxattr = NL80211_ATTR_MAX,
  45         .netnsok = true,
  46         .pre_doit = nl80211_pre_doit,
  47         .post_doit = nl80211_post_doit,
  48 };
  49
  50 /* multicast groups */
  51 enum nl80211_multicast_groups {
  52         NL80211_MCGRP_CONFIG,
  53         NL80211_MCGRP_SCAN,
  54         NL80211_MCGRP_REGULATORY,
  55         NL80211_MCGRP_MLME,
  56         NL80211_MCGRP_VENDOR,
  57         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  58 };
  59
  60 static const struct genl_multicast_group nl80211_mcgrps[] = {
  61         [NL80211_MCGRP_CONFIG] = { .name = "config", },
  62         [NL80211_MCGRP_SCAN] = { .name = "scan", },
  63         [NL80211_MCGRP_REGULATORY] = { .name = "regulatory", },
  64         [NL80211_MCGRP_MLME] = { .name = "mlme", },
  65         [NL80211_MCGRP_VENDOR] = { .name = "vendor", },
  66 #ifdef CONFIG_NL80211_TESTMODE
  67         [NL80211_MCGRP_TESTMODE] = { .name = "testmode", }
  68 #endif
  69 };
  70
  71 /* returns ERR_PTR values */
  72 static struct wireless_dev *
  73 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  74 {
  75         struct cfg80211_registered_device *rdev;
  76         struct wireless_dev *result = NULL;
  77         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  78         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  79         u64 wdev_id;
  80         int wiphy_idx = -1;
  81         int ifidx = -1;
  82
  83         ASSERT_RTNL();
  84
  85         if (!have_ifidx && !have_wdev_id)
  86                 return ERR_PTR(-EINVAL);
  87
  88         if (have_ifidx)
  89                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  90         if (have_wdev_id) {
  91                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  92                 wiphy_idx = wdev_id >> 32;
  93         }
  94
  95         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  96                 struct wireless_dev *wdev;
  97
  98                 if (wiphy_net(&rdev->wiphy) != netns)
  99                         continue;
 100
 101                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
 102                         continue;
 103
 104                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
 105                         if (have_ifidx && wdev->netdev &&
 106                             wdev->netdev->ifindex == ifidx) {
 107                                 result = wdev;
 108                                 break;
 109                         }
 110                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 111                                 result = wdev;
 112                                 break;
 113                         }
 114                 }
 115
 116                 if (result)
 117                         break;
 118         }
 119
 120         if (result)
 121                 return result;
 122         return ERR_PTR(-ENODEV);
 123 }
 124
 125 static struct cfg80211_registered_device *
 126 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 127 {
 128         struct cfg80211_registered_device *rdev = NULL, *tmp;
 129         struct net_device *netdev;
 130
 131         ASSERT_RTNL();
 132
 133         if (!attrs[NL80211_ATTR_WIPHY] &&
 134             !attrs[NL80211_ATTR_IFINDEX] &&
 135             !attrs[NL80211_ATTR_WDEV])
 136                 return ERR_PTR(-EINVAL);
 137
 138         if (attrs[NL80211_ATTR_WIPHY])
 139                 rdev = cfg80211_rdev_by_wiphy_idx(
 140                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 141
 142         if (attrs[NL80211_ATTR_WDEV]) {
 143                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 144                 struct wireless_dev *wdev;
 145                 bool found = false;
 146
 147                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 148                 if (tmp) {
 149                         /* make sure wdev exists */
 150                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 151                                 if (wdev->identifier != (u32)wdev_id)
 152                                         continue;
 153                                 found = true;
 154                                 break;
 155                         }
 156
 157                         if (!found)
 158                                 tmp = NULL;
 159
 160                         if (rdev && tmp != rdev)
 161                                 return ERR_PTR(-EINVAL);
 162                         rdev = tmp;
 163                 }
 164         }
 165
 166         if (attrs[NL80211_ATTR_IFINDEX]) {
 167                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 168                 netdev = __dev_get_by_index(netns, ifindex);
 169                 if (netdev) {
 170                         if (netdev->ieee80211_ptr)
 171                                 tmp = wiphy_to_rdev(
 172                                         netdev->ieee80211_ptr->wiphy);
 173                         else
 174                                 tmp = NULL;
 175
 176                         /* not wireless device -- return error */
 177                         if (!tmp)
 178                                 return ERR_PTR(-EINVAL);
 179
 180                         /* mismatch -- return error */
 181                         if (rdev && tmp != rdev)
 182                                 return ERR_PTR(-EINVAL);
 183
 184                         rdev = tmp;
 185                 }
 186         }
 187
 188         if (!rdev)
 189                 return ERR_PTR(-ENODEV);
 190
 191         if (netns != wiphy_net(&rdev->wiphy))
 192                 return ERR_PTR(-ENODEV);
 193
 194         return rdev;
 195 }
 196
 197 /*
 198  * This function returns a pointer to the driver
 199  * that the genl_info item that is passed refers to.
 200  *
 201  * The result of this can be a PTR_ERR and hence must
 202  * be checked with IS_ERR() for errors.
 203  */
 204 static struct cfg80211_registered_device *
 205 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 206 {
 207         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 208 }
 209
 210 /* policy for the attributes */
 211 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
 212         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 213         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 214                                       .len = 20-1 },
 215         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 216
 217         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 218         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 219         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 220         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 221         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 222
 223         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 224         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 225         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 226         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 227         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 228
 229         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 230         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 231         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 232
 233         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 234         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 235
 236         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 237         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 238                                     .len = WLAN_MAX_KEY_LEN },
 239         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 240         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 241         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 242         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 243         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 244
 245         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 246         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 247         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 248                                        .len = IEEE80211_MAX_DATA_LEN },
 249         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 250                                        .len = IEEE80211_MAX_DATA_LEN },
 251         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 252         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 253         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 254         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 255                                                .len = NL80211_MAX_SUPP_RATES },
 256         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 257         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 258         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 259         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 260                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 261         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 262
 263         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 264         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 265
 266         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 267         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 268         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 269         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 270                                            .len = NL80211_MAX_SUPP_RATES },
 271         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 272
 273         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 274         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 275
 276         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 277
 278         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 279         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 280                               .len = IEEE80211_MAX_DATA_LEN },
 281         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 282         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 283
 284         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 285                                 .len = IEEE80211_MAX_SSID_LEN },
 286         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 287         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 288         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 289         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 290         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 291         [NL80211_ATTR_STA_FLAGS2] = {
 292                 .len = sizeof(struct nl80211_sta_flag_update),
 293         },
 294         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 295         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 296         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 297         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 298         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 299         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 300         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 301         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 302         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 303                                  .len = WLAN_PMKID_LEN },
 304         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 305         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 306         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 307         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 308                                  .len = IEEE80211_MAX_DATA_LEN },
 309         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 310         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 311         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 312         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 313         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 314         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 315         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 316         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 317         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 318         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 319         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 320         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 321         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 322         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 323         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 324         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 325         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 326         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 327         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 328         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 329                                          .len = IEEE80211_MAX_DATA_LEN },
 330         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 331                                          .len = IEEE80211_MAX_DATA_LEN },
 332         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 333         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 334         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 335         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 336         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 337         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 338         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 339         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 340         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 341         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 342                                       .len = IEEE80211_MAX_DATA_LEN },
 343         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 344         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 345         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 346                 .len = NL80211_HT_CAPABILITY_LEN
 347         },
 348         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 349         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 350         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 351         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 352         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 353         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 354         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 355         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 356         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 357         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 358         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 359         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 360         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 361         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 362         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 363         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 364         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 365                 .len = NL80211_VHT_CAPABILITY_LEN,
 366         },
 367         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 368         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 369                                   .len = IEEE80211_MAX_DATA_LEN },
 370         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 371         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 372         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 373         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 374         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_U16 },
 375         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_U16 },
 376         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 377         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 378         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 379         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 380         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 381         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 382         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 383         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 384                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 385         [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
 386         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 387         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 388         [NL80211_ATTR_IFACE_SOCKET_OWNER] = { .type = NLA_FLAG },
 389 };
 390
 391 /* policy for the key attributes */
 392 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 393         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 394         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 395         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 396         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 397         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 398         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 399         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 400         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 401 };
 402
 403 /* policy for the key default flags */
 404 static const struct nla_policy
 405 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 406         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 407         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 408 };
 409
 410 /* policy for WoWLAN attributes */
 411 static const struct nla_policy
 412 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 413         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 414         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 415         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 416         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 417         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 418         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 419         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 420         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 421         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 422 };
 423
 424 static const struct nla_policy
 425 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 426         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 427         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 428         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 429         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 430         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 431         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 432         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 433                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 434         },
 435         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 436                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 437         },
 438         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 439         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 440         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 441 };
 442
 443 /* policy for coalesce rule attributes */
 444 static const struct nla_policy
 445 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 446         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 447         [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
 448         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 449 };
 450
 451 /* policy for GTK rekey offload attributes */
 452 static const struct nla_policy
 453 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 454         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 455         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 456         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 457 };
 458
 459 static const struct nla_policy
 460 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 461         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 462                                                  .len = IEEE80211_MAX_SSID_LEN },
 463         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 464 };
 465
 466 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 467                                      struct netlink_callback *cb,
 468                                      struct cfg80211_registered_device **rdev,
 469                                      struct wireless_dev **wdev)
 470 {
 471         int err;
 472
 473         rtnl_lock();
 474
 475         if (!cb->args[0]) {
 476                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 477                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
 478                                   nl80211_policy);
 479                 if (err)
 480                         goto out_unlock;
 481
 482                 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
 483                                                    nl80211_fam.attrbuf);
 484                 if (IS_ERR(*wdev)) {
 485                         err = PTR_ERR(*wdev);
 486                         goto out_unlock;
 487                 }
 488                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 489                 /* 0 is the first index - add 1 to parse only once */
 490                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 491                 cb->args[1] = (*wdev)->identifier;
 492         } else {
 493                 /* subtract the 1 again here */
 494                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 495                 struct wireless_dev *tmp;
 496
 497                 if (!wiphy) {
 498                         err = -ENODEV;
 499                         goto out_unlock;
 500                 }
 501                 *rdev = wiphy_to_rdev(wiphy);
 502                 *wdev = NULL;
 503
 504                 list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
 505                         if (tmp->identifier == cb->args[1]) {
 506                                 *wdev = tmp;
 507                                 break;
 508                         }
 509                 }
 510
 511                 if (!*wdev) {
 512                         err = -ENODEV;
 513                         goto out_unlock;
 514                 }
 515         }
 516
 517         return 0;
 518  out_unlock:
 519         rtnl_unlock();
 520         return err;
 521 }
 522
 523 static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
 524 {
 525         rtnl_unlock();
 526 }
 527
 528 /* IE validation */
 529 static bool is_valid_ie_attr(const struct nlattr *attr)
 530 {
 531         const u8 *pos;
 532         int len;
 533
 534         if (!attr)
 535                 return true;
 536
 537         pos = nla_data(attr);
 538         len = nla_len(attr);
 539
 540         while (len) {
 541                 u8 elemlen;
 542
 543                 if (len < 2)
 544                         return false;
 545                 len -= 2;
 546
 547                 elemlen = pos[1];
 548                 if (elemlen > len)
 549                         return false;
 550
 551                 len -= elemlen;
 552                 pos += 2 + elemlen;
 553         }
 554
 555         return true;
 556 }
 557
 558 /* message building helper */
 559 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 560                                    int flags, u8 cmd)
 561 {
 562         /* since there is no private header just add the generic one */
 563         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 564 }
 565
 566 static int nl80211_msg_put_channel(struct sk_buff *msg,
 567                                    struct ieee80211_channel *chan,
 568                                    bool large)
 569 {
 570         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 571                         chan->center_freq))
 572                 goto nla_put_failure;
 573
 574         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 575             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 576                 goto nla_put_failure;
 577         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 578                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 579                         goto nla_put_failure;
 580                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 581                         goto nla_put_failure;
 582         }
 583         if (chan->flags & IEEE80211_CHAN_RADAR) {
 584                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 585                         goto nla_put_failure;
 586                 if (large) {
 587                         u32 time;
 588
 589                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 590
 591                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 592                                         chan->dfs_state))
 593                                 goto nla_put_failure;
 594                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 595                                         time))
 596                                 goto nla_put_failure;
 597                         if (nla_put_u32(msg,
 598                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 599                                         chan->dfs_cac_ms))
 600                                 goto nla_put_failure;
 601                 }
 602         }
 603
 604         if (large) {
 605                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 606                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 607                         goto nla_put_failure;
 608                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 609                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 610                         goto nla_put_failure;
 611                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 612                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 613                         goto nla_put_failure;
 614                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 615                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 616                         goto nla_put_failure;
 617                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 618                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 619                         goto nla_put_failure;
 620                 if ((chan->flags & IEEE80211_CHAN_GO_CONCURRENT) &&
 621                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_GO_CONCURRENT))
 622                         goto nla_put_failure;
 623         }
 624
 625         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 626                         DBM_TO_MBM(chan->max_power)))
 627                 goto nla_put_failure;
 628
 629         return 0;
 630
 631  nla_put_failure:
 632         return -ENOBUFS;
 633 }
 634
 635 /* netlink command implementations */
 636
 637 struct key_parse {
 638         struct key_params p;
 639         int idx;
 640         int type;
 641         bool def, defmgmt;
 642         bool def_uni, def_multi;
 643 };
 644
 645 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 646 {
 647         struct nlattr *tb[NL80211_KEY_MAX + 1];
 648         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 649                                    nl80211_key_policy);
 650         if (err)
 651                 return err;
 652
 653         k->def = !!tb[NL80211_KEY_DEFAULT];
 654         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 655
 656         if (k->def) {
 657                 k->def_uni = true;
 658                 k->def_multi = true;
 659         }
 660         if (k->defmgmt)
 661                 k->def_multi = true;
 662
 663         if (tb[NL80211_KEY_IDX])
 664                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 665
 666         if (tb[NL80211_KEY_DATA]) {
 667                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 668                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 669         }
 670
 671         if (tb[NL80211_KEY_SEQ]) {
 672                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 673                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 674         }
 675
 676         if (tb[NL80211_KEY_CIPHER])
 677                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 678
 679         if (tb[NL80211_KEY_TYPE]) {
 680                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 681                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 682                         return -EINVAL;
 683         }
 684
 685         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 686                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 687                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 688                                        tb[NL80211_KEY_DEFAULT_TYPES],
 689                                        nl80211_key_default_policy);
 690                 if (err)
 691                         return err;
 692
 693                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 694                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 695         }
 696
 697         return 0;
 698 }
 699
 700 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 701 {
 702         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 703                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 704                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 705         }
 706
 707         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 708                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 709                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 710         }
 711
 712         if (info->attrs[NL80211_ATTR_KEY_IDX])
 713                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 714
 715         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 716                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 717
 718         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 719         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 720
 721         if (k->def) {
 722                 k->def_uni = true;
 723                 k->def_multi = true;
 724         }
 725         if (k->defmgmt)
 726                 k->def_multi = true;
 727
 728         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 729                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 730                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 731                         return -EINVAL;
 732         }
 733
 734         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 735                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 736                 int err = nla_parse_nested(
 737                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 738                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 739                                 nl80211_key_default_policy);
 740                 if (err)
 741                         return err;
 742
 743                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 744                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 745         }
 746
 747         return 0;
 748 }
 749
 750 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 751 {
 752         int err;
 753
 754         memset(k, 0, sizeof(*k));
 755         k->idx = -1;
 756         k->type = -1;
 757
 758         if (info->attrs[NL80211_ATTR_KEY])
 759                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 760         else
 761                 err = nl80211_parse_key_old(info, k);
 762
 763         if (err)
 764                 return err;
 765
 766         if (k->def && k->defmgmt)
 767                 return -EINVAL;
 768
 769         if (k->defmgmt) {
 770                 if (k->def_uni || !k->def_multi)
 771                         return -EINVAL;
 772         }
 773
 774         if (k->idx != -1) {
 775                 if (k->defmgmt) {
 776                         if (k->idx < 4 || k->idx > 5)
 777                                 return -EINVAL;
 778                 } else if (k->def) {
 779                         if (k->idx < 0 || k->idx > 3)
 780                                 return -EINVAL;
 781                 } else {
 782                         if (k->idx < 0 || k->idx > 5)
 783                                 return -EINVAL;
 784                 }
 785         }
 786
 787         return 0;
 788 }
 789
 790 static struct cfg80211_cached_keys *
 791 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 792                        struct nlattr *keys, bool *no_ht)
 793 {
 794         struct key_parse parse;
 795         struct nlattr *key;
 796         struct cfg80211_cached_keys *result;
 797         int rem, err, def = 0;
 798
 799         result = kzalloc(sizeof(*result), GFP_KERNEL);
 800         if (!result)
 801                 return ERR_PTR(-ENOMEM);
 802
 803         result->def = -1;
 804         result->defmgmt = -1;
 805
 806         nla_for_each_nested(key, keys, rem) {
 807                 memset(&parse, 0, sizeof(parse));
 808                 parse.idx = -1;
 809
 810                 err = nl80211_parse_key_new(key, &parse);
 811                 if (err)
 812                         goto error;
 813                 err = -EINVAL;
 814                 if (!parse.p.key)
 815                         goto error;
 816                 if (parse.idx < 0 || parse.idx > 4)
 817                         goto error;
 818                 if (parse.def) {
 819                         if (def)
 820                                 goto error;
 821                         def = 1;
 822                         result->def = parse.idx;
 823                         if (!parse.def_uni || !parse.def_multi)
 824                                 goto error;
 825                 } else if (parse.defmgmt)
 826                         goto error;
 827                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 828                                                      parse.idx, false, NULL);
 829                 if (err)
 830                         goto error;
 831                 result->params[parse.idx].cipher = parse.p.cipher;
 832                 result->params[parse.idx].key_len = parse.p.key_len;
 833                 result->params[parse.idx].key = result->data[parse.idx];
 834                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 835
 836                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 837                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 838                         if (no_ht)
 839                                 *no_ht = true;
 840                 }
 841         }
 842
 843         return result;
 844  error:
 845         kfree(result);
 846         return ERR_PTR(err);
 847 }
 848
 849 static int nl80211_key_allowed(struct wireless_dev *wdev)
 850 {
 851         ASSERT_WDEV_LOCK(wdev);
 852
 853         switch (wdev->iftype) {
 854         case NL80211_IFTYPE_AP:
 855         case NL80211_IFTYPE_AP_VLAN:
 856         case NL80211_IFTYPE_P2P_GO:
 857         case NL80211_IFTYPE_MESH_POINT:
 858                 break;
 859         case NL80211_IFTYPE_ADHOC:
 860         case NL80211_IFTYPE_STATION:
 861         case NL80211_IFTYPE_P2P_CLIENT:
 862                 if (!wdev->current_bss)
 863                         return -ENOLINK;
 864                 break;
 865         default:
 866                 return -EINVAL;
 867         }
 868
 869         return 0;
 870 }
 871
 872 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
 873                                                         struct nlattr *tb)
 874 {
 875         struct ieee80211_channel *chan;
 876
 877         if (tb == NULL)
 878                 return NULL;
 879         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
 880         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 881                 return NULL;
 882         return chan;
 883 }
 884
 885 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 886 {
 887         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 888         int i;
 889
 890         if (!nl_modes)
 891                 goto nla_put_failure;
 892
 893         i = 0;
 894         while (ifmodes) {
 895                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 896                         goto nla_put_failure;
 897                 ifmodes >>= 1;
 898                 i++;
 899         }
 900
 901         nla_nest_end(msg, nl_modes);
 902         return 0;
 903
 904 nla_put_failure:
 905         return -ENOBUFS;
 906 }
 907
 908 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 909                                           struct sk_buff *msg,
 910                                           bool large)
 911 {
 912         struct nlattr *nl_combis;
 913         int i, j;
 914
 915         nl_combis = nla_nest_start(msg,
 916                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 917         if (!nl_combis)
 918                 goto nla_put_failure;
 919
 920         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 921                 const struct ieee80211_iface_combination *c;
 922                 struct nlattr *nl_combi, *nl_limits;
 923
 924                 c = &wiphy->iface_combinations[i];
 925
 926                 nl_combi = nla_nest_start(msg, i + 1);
 927                 if (!nl_combi)
 928                         goto nla_put_failure;
 929
 930                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 931                 if (!nl_limits)
 932                         goto nla_put_failure;
 933
 934                 for (j = 0; j < c->n_limits; j++) {
 935                         struct nlattr *nl_limit;
 936
 937                         nl_limit = nla_nest_start(msg, j + 1);
 938                         if (!nl_limit)
 939                                 goto nla_put_failure;
 940                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 941                                         c->limits[j].max))
 942                                 goto nla_put_failure;
 943                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 944                                                 c->limits[j].types))
 945                                 goto nla_put_failure;
 946                         nla_nest_end(msg, nl_limit);
 947                 }
 948
 949                 nla_nest_end(msg, nl_limits);
 950
 951                 if (c->beacon_int_infra_match &&
 952                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 953                         goto nla_put_failure;
 954                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 955                                 c->num_different_channels) ||
 956                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 957                                 c->max_interfaces))
 958                         goto nla_put_failure;
 959                 if (large &&
 960                     nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
 961                                 c->radar_detect_widths))
 962                         goto nla_put_failure;
 963
 964                 nla_nest_end(msg, nl_combi);
 965         }
 966
 967         nla_nest_end(msg, nl_combis);
 968
 969         return 0;
 970 nla_put_failure:
 971         return -ENOBUFS;
 972 }
 973
 974 #ifdef CONFIG_PM
 975 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
 976                                         struct sk_buff *msg)
 977 {
 978         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
 979         struct nlattr *nl_tcp;
 980
 981         if (!tcp)
 982                 return 0;
 983
 984         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
 985         if (!nl_tcp)
 986                 return -ENOBUFS;
 987
 988         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 989                         tcp->data_payload_max))
 990                 return -ENOBUFS;
 991
 992         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 993                         tcp->data_payload_max))
 994                 return -ENOBUFS;
 995
 996         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
 997                 return -ENOBUFS;
 998
 999         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1000                                 sizeof(*tcp->tok), tcp->tok))
1001                 return -ENOBUFS;
1002
1003         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1004                         tcp->data_interval_max))
1005                 return -ENOBUFS;
1006
1007         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1008                         tcp->wake_payload_max))
1009                 return -ENOBUFS;
1010
1011         nla_nest_end(msg, nl_tcp);
1012         return 0;
1013 }
1014
1015 static int nl80211_send_wowlan(struct sk_buff *msg,
1016                                struct cfg80211_registered_device *rdev,
1017                                bool large)
1018 {
1019         struct nlattr *nl_wowlan;
1020
1021         if (!rdev->wiphy.wowlan)
1022                 return 0;
1023
1024         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1025         if (!nl_wowlan)
1026                 return -ENOBUFS;
1027
1028         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1029              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1030             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1031              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1032             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1033              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1034             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1035              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1036             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1037              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1038             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1039              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1040             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1041              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1042             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1043              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1044                 return -ENOBUFS;
1045
1046         if (rdev->wiphy.wowlan->n_patterns) {
1047                 struct nl80211_pattern_support pat = {
1048                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1049                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1050                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1051                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1052                 };
1053
1054                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1055                             sizeof(pat), &pat))
1056                         return -ENOBUFS;
1057         }
1058
1059         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1060                 return -ENOBUFS;
1061
1062         nla_nest_end(msg, nl_wowlan);
1063
1064         return 0;
1065 }
1066 #endif
1067
1068 static int nl80211_send_coalesce(struct sk_buff *msg,
1069                                  struct cfg80211_registered_device *rdev)
1070 {
1071         struct nl80211_coalesce_rule_support rule;
1072
1073         if (!rdev->wiphy.coalesce)
1074                 return 0;
1075
1076         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1077         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1078         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1079         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1080         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1081         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1082
1083         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1084                 return -ENOBUFS;
1085
1086         return 0;
1087 }
1088
1089 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1090                                       struct ieee80211_supported_band *sband)
1091 {
1092         struct nlattr *nl_rates, *nl_rate;
1093         struct ieee80211_rate *rate;
1094         int i;
1095
1096         /* add HT info */
1097         if (sband->ht_cap.ht_supported &&
1098             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1099                      sizeof(sband->ht_cap.mcs),
1100                      &sband->ht_cap.mcs) ||
1101              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1102                          sband->ht_cap.cap) ||
1103              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1104                         sband->ht_cap.ampdu_factor) ||
1105              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1106                         sband->ht_cap.ampdu_density)))
1107                 return -ENOBUFS;
1108
1109         /* add VHT info */
1110         if (sband->vht_cap.vht_supported &&
1111             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1112                      sizeof(sband->vht_cap.vht_mcs),
1113                      &sband->vht_cap.vht_mcs) ||
1114              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1115                          sband->vht_cap.cap)))
1116                 return -ENOBUFS;
1117
1118         /* add bitrates */
1119         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1120         if (!nl_rates)
1121                 return -ENOBUFS;
1122
1123         for (i = 0; i < sband->n_bitrates; i++) {
1124                 nl_rate = nla_nest_start(msg, i);
1125                 if (!nl_rate)
1126                         return -ENOBUFS;
1127
1128                 rate = &sband->bitrates[i];
1129                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1130                                 rate->bitrate))
1131                         return -ENOBUFS;
1132                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1133                     nla_put_flag(msg,
1134                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1135                         return -ENOBUFS;
1136
1137                 nla_nest_end(msg, nl_rate);
1138         }
1139
1140         nla_nest_end(msg, nl_rates);
1141
1142         return 0;
1143 }
1144
1145 static int
1146 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1147                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1148 {
1149         u16 stypes;
1150         struct nlattr *nl_ftypes, *nl_ifs;
1151         enum nl80211_iftype ift;
1152         int i;
1153
1154         if (!mgmt_stypes)
1155                 return 0;
1156
1157         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1158         if (!nl_ifs)
1159                 return -ENOBUFS;
1160
1161         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1162                 nl_ftypes = nla_nest_start(msg, ift);
1163                 if (!nl_ftypes)
1164                         return -ENOBUFS;
1165                 i = 0;
1166                 stypes = mgmt_stypes[ift].tx;
1167                 while (stypes) {
1168                         if ((stypes & 1) &&
1169                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1170                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1171                                 return -ENOBUFS;
1172                         stypes >>= 1;
1173                         i++;
1174                 }
1175                 nla_nest_end(msg, nl_ftypes);
1176         }
1177
1178         nla_nest_end(msg, nl_ifs);
1179
1180         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1181         if (!nl_ifs)
1182                 return -ENOBUFS;
1183
1184         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1185                 nl_ftypes = nla_nest_start(msg, ift);
1186                 if (!nl_ftypes)
1187                         return -ENOBUFS;
1188                 i = 0;
1189                 stypes = mgmt_stypes[ift].rx;
1190                 while (stypes) {
1191                         if ((stypes & 1) &&
1192                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1193                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1194                                 return -ENOBUFS;
1195                         stypes >>= 1;
1196                         i++;
1197                 }
1198                 nla_nest_end(msg, nl_ftypes);
1199         }
1200         nla_nest_end(msg, nl_ifs);
1201
1202         return 0;
1203 }
1204
1205 struct nl80211_dump_wiphy_state {
1206         s64 filter_wiphy;
1207         long start;
1208         long split_start, band_start, chan_start;
1209         bool split;
1210 };
1211
1212 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1213                               struct sk_buff *msg, u32 portid, u32 seq,
1214                               int flags, struct nl80211_dump_wiphy_state *state)
1215 {
1216         void *hdr;
1217         struct nlattr *nl_bands, *nl_band;
1218         struct nlattr *nl_freqs, *nl_freq;
1219         struct nlattr *nl_cmds;
1220         enum ieee80211_band band;
1221         struct ieee80211_channel *chan;
1222         int i;
1223         const struct ieee80211_txrx_stypes *mgmt_stypes =
1224                                 rdev->wiphy.mgmt_stypes;
1225         u32 features;
1226
1227         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
1228         if (!hdr)
1229                 return -ENOBUFS;
1230
1231         if (WARN_ON(!state))
1232                 return -EINVAL;
1233
1234         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1235             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1236                            wiphy_name(&rdev->wiphy)) ||
1237             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1238                         cfg80211_rdev_list_generation))
1239                 goto nla_put_failure;
1240
1241         switch (state->split_start) {
1242         case 0:
1243                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1244                                rdev->wiphy.retry_short) ||
1245                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1246                                rdev->wiphy.retry_long) ||
1247                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1248                                 rdev->wiphy.frag_threshold) ||
1249                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1250                                 rdev->wiphy.rts_threshold) ||
1251                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1252                                rdev->wiphy.coverage_class) ||
1253                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1254                                rdev->wiphy.max_scan_ssids) ||
1255                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1256                                rdev->wiphy.max_sched_scan_ssids) ||
1257                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1258                                 rdev->wiphy.max_scan_ie_len) ||
1259                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1260                                 rdev->wiphy.max_sched_scan_ie_len) ||
1261                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1262                                rdev->wiphy.max_match_sets))
1263                         goto nla_put_failure;
1264
1265                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1266                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1267                         goto nla_put_failure;
1268                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1269                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1270                         goto nla_put_failure;
1271                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1272                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1273                         goto nla_put_failure;
1274                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1275                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1276                         goto nla_put_failure;
1277                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1278                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1279                         goto nla_put_failure;
1280                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1281                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1282                         goto nla_put_failure;
1283                 state->split_start++;
1284                 if (state->split)
1285                         break;
1286         case 1:
1287                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1288                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1289                             rdev->wiphy.cipher_suites))
1290                         goto nla_put_failure;
1291
1292                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1293                                rdev->wiphy.max_num_pmkids))
1294                         goto nla_put_failure;
1295
1296                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1297                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1298                         goto nla_put_failure;
1299
1300                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1301                                 rdev->wiphy.available_antennas_tx) ||
1302                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1303                                 rdev->wiphy.available_antennas_rx))
1304                         goto nla_put_failure;
1305
1306                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1307                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1308                                 rdev->wiphy.probe_resp_offload))
1309                         goto nla_put_failure;
1310
1311                 if ((rdev->wiphy.available_antennas_tx ||
1312                      rdev->wiphy.available_antennas_rx) &&
1313                     rdev->ops->get_antenna) {
1314                         u32 tx_ant = 0, rx_ant = 0;
1315                         int res;
1316                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1317                         if (!res) {
1318                                 if (nla_put_u32(msg,
1319                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1320                                                 tx_ant) ||
1321                                     nla_put_u32(msg,
1322                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1323                                                 rx_ant))
1324                                         goto nla_put_failure;
1325                         }
1326                 }
1327
1328                 state->split_start++;
1329                 if (state->split)
1330                         break;
1331         case 2:
1332                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1333                                         rdev->wiphy.interface_modes))
1334                                 goto nla_put_failure;
1335                 state->split_start++;
1336                 if (state->split)
1337                         break;
1338         case 3:
1339                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1340                 if (!nl_bands)
1341                         goto nla_put_failure;
1342
1343                 for (band = state->band_start;
1344                      band < IEEE80211_NUM_BANDS; band++) {
1345                         struct ieee80211_supported_band *sband;
1346
1347                         sband = rdev->wiphy.bands[band];
1348
1349                         if (!sband)
1350                                 continue;
1351
1352                         nl_band = nla_nest_start(msg, band);
1353                         if (!nl_band)
1354                                 goto nla_put_failure;
1355
1356                         switch (state->chan_start) {
1357                         case 0:
1358                                 if (nl80211_send_band_rateinfo(msg, sband))
1359                                         goto nla_put_failure;
1360                                 state->chan_start++;
1361                                 if (state->split)
1362                                         break;
1363                         default:
1364                                 /* add frequencies */
1365                                 nl_freqs = nla_nest_start(
1366                                         msg, NL80211_BAND_ATTR_FREQS);
1367                                 if (!nl_freqs)
1368                                         goto nla_put_failure;
1369
1370                                 for (i = state->chan_start - 1;
1371                                      i < sband->n_channels;
1372                                      i++) {
1373                                         nl_freq = nla_nest_start(msg, i);
1374                                         if (!nl_freq)
1375                                                 goto nla_put_failure;
1376
1377                                         chan = &sband->channels[i];
1378
1379                                         if (nl80211_msg_put_channel(
1380                                                         msg, chan,
1381                                                         state->split))
1382                                                 goto nla_put_failure;
1383
1384                                         nla_nest_end(msg, nl_freq);
1385                                         if (state->split)
1386                                                 break;
1387                                 }
1388                                 if (i < sband->n_channels)
1389                                         state->chan_start = i + 2;
1390                                 else
1391                                         state->chan_start = 0;
1392                                 nla_nest_end(msg, nl_freqs);
1393                         }
1394
1395                         nla_nest_end(msg, nl_band);
1396
1397                         if (state->split) {
1398                                 /* start again here */
1399                                 if (state->chan_start)
1400                                         band--;
1401                                 break;
1402                         }
1403                 }
1404                 nla_nest_end(msg, nl_bands);
1405
1406                 if (band < IEEE80211_NUM_BANDS)
1407                         state->band_start = band + 1;
1408                 else
1409                         state->band_start = 0;
1410
1411                 /* if bands & channels are done, continue outside */
1412                 if (state->band_start == 0 && state->chan_start == 0)
1413                         state->split_start++;
1414                 if (state->split)
1415                         break;
1416         case 4:
1417                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1418                 if (!nl_cmds)
1419                         goto nla_put_failure;
1420
1421                 i = 0;
1422 #define CMD(op, n)                                                      \
1423                  do {                                                   \
1424                         if (rdev->ops->op) {                            \
1425                                 i++;                                    \
1426                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1427                                         goto nla_put_failure;           \
1428                         }                                               \
1429                 } while (0)
1430
1431                 CMD(add_virtual_intf, NEW_INTERFACE);
1432                 CMD(change_virtual_intf, SET_INTERFACE);
1433                 CMD(add_key, NEW_KEY);
1434                 CMD(start_ap, START_AP);
1435                 CMD(add_station, NEW_STATION);
1436                 CMD(add_mpath, NEW_MPATH);
1437                 CMD(update_mesh_config, SET_MESH_CONFIG);
1438                 CMD(change_bss, SET_BSS);
1439                 CMD(auth, AUTHENTICATE);
1440                 CMD(assoc, ASSOCIATE);
1441                 CMD(deauth, DEAUTHENTICATE);
1442                 CMD(disassoc, DISASSOCIATE);
1443                 CMD(join_ibss, JOIN_IBSS);
1444                 CMD(join_mesh, JOIN_MESH);
1445                 CMD(set_pmksa, SET_PMKSA);
1446                 CMD(del_pmksa, DEL_PMKSA);
1447                 CMD(flush_pmksa, FLUSH_PMKSA);
1448                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1449                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1450                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1451                 CMD(mgmt_tx, FRAME);
1452                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1453                 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1454                         i++;
1455                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1456                                 goto nla_put_failure;
1457                 }
1458                 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1459                     rdev->ops->join_mesh) {
1460                         i++;
1461                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1462                                 goto nla_put_failure;
1463                 }
1464                 CMD(set_wds_peer, SET_WDS_PEER);
1465                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1466                         CMD(tdls_mgmt, TDLS_MGMT);
1467                         CMD(tdls_oper, TDLS_OPER);
1468                 }
1469                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1470                         CMD(sched_scan_start, START_SCHED_SCAN);
1471                 CMD(probe_client, PROBE_CLIENT);
1472                 CMD(set_noack_map, SET_NOACK_MAP);
1473                 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1474                         i++;
1475                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1476                                 goto nla_put_failure;
1477                 }
1478                 CMD(start_p2p_device, START_P2P_DEVICE);
1479                 CMD(set_mcast_rate, SET_MCAST_RATE);
1480                 if (state->split) {
1481                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1482                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1483                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1484                                 CMD(channel_switch, CHANNEL_SWITCH);
1485                 }
1486                 CMD(set_qos_map, SET_QOS_MAP);
1487
1488 #ifdef CONFIG_NL80211_TESTMODE
1489                 CMD(testmode_cmd, TESTMODE);
1490 #endif
1491
1492 #undef CMD
1493
1494                 if (rdev->ops->connect || rdev->ops->auth) {
1495                         i++;
1496                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1497                                 goto nla_put_failure;
1498                 }
1499
1500                 if (rdev->ops->disconnect || rdev->ops->deauth) {
1501                         i++;
1502                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1503                                 goto nla_put_failure;
1504                 }
1505
1506                 nla_nest_end(msg, nl_cmds);
1507                 state->split_start++;
1508                 if (state->split)
1509                         break;
1510         case 5:
1511                 if (rdev->ops->remain_on_channel &&
1512                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1513                     nla_put_u32(msg,
1514                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1515                                 rdev->wiphy.max_remain_on_channel_duration))
1516                         goto nla_put_failure;
1517
1518                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1519                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1520                         goto nla_put_failure;
1521
1522                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1523                         goto nla_put_failure;
1524                 state->split_start++;
1525                 if (state->split)
1526                         break;
1527         case 6:
1528 #ifdef CONFIG_PM
1529                 if (nl80211_send_wowlan(msg, rdev, state->split))
1530                         goto nla_put_failure;
1531                 state->split_start++;
1532                 if (state->split)
1533                         break;
1534 #else
1535                 state->split_start++;
1536 #endif
1537         case 7:
1538                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1539                                         rdev->wiphy.software_iftypes))
1540                         goto nla_put_failure;
1541
1542                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1543                                                    state->split))
1544                         goto nla_put_failure;
1545
1546                 state->split_start++;
1547                 if (state->split)
1548                         break;
1549         case 8:
1550                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1551                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1552                                 rdev->wiphy.ap_sme_capa))
1553                         goto nla_put_failure;
1554
1555                 features = rdev->wiphy.features;
1556                 /*
1557                  * We can only add the per-channel limit information if the
1558                  * dump is split, otherwise it makes it too big. Therefore
1559                  * only advertise it in that case.
1560                  */
1561                 if (state->split)
1562                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1563                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1564                         goto nla_put_failure;
1565
1566                 if (rdev->wiphy.ht_capa_mod_mask &&
1567                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1568                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
1569                             rdev->wiphy.ht_capa_mod_mask))
1570                         goto nla_put_failure;
1571
1572                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1573                     rdev->wiphy.max_acl_mac_addrs &&
1574                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1575                                 rdev->wiphy.max_acl_mac_addrs))
1576                         goto nla_put_failure;
1577
1578                 /*
1579                  * Any information below this point is only available to
1580                  * applications that can deal with it being split. This
1581                  * helps ensure that newly added capabilities don't break
1582                  * older tools by overrunning their buffers.
1583                  *
1584                  * We still increment split_start so that in the split
1585                  * case we'll continue with more data in the next round,
1586                  * but break unconditionally so unsplit data stops here.
1587                  */
1588                 state->split_start++;
1589                 break;
1590         case 9:
1591                 if (rdev->wiphy.extended_capabilities &&
1592                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1593                              rdev->wiphy.extended_capabilities_len,
1594                              rdev->wiphy.extended_capabilities) ||
1595                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1596                              rdev->wiphy.extended_capabilities_len,
1597                              rdev->wiphy.extended_capabilities_mask)))
1598                         goto nla_put_failure;
1599
1600                 if (rdev->wiphy.vht_capa_mod_mask &&
1601                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1602                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
1603                             rdev->wiphy.vht_capa_mod_mask))
1604                         goto nla_put_failure;
1605
1606                 state->split_start++;
1607                 break;
1608         case 10:
1609                 if (nl80211_send_coalesce(msg, rdev))
1610                         goto nla_put_failure;
1611
1612                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1613                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1614                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1615                         goto nla_put_failure;
1616
1617                 if (rdev->wiphy.max_ap_assoc_sta &&
1618                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1619                                 rdev->wiphy.max_ap_assoc_sta))
1620                         goto nla_put_failure;
1621
1622                 state->split_start++;
1623                 break;
1624         case 11:
1625                 if (rdev->wiphy.n_vendor_commands) {
1626                         const struct nl80211_vendor_cmd_info *info;
1627                         struct nlattr *nested;
1628
1629                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1630                         if (!nested)
1631                                 goto nla_put_failure;
1632
1633                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1634                                 info = &rdev->wiphy.vendor_commands[i].info;
1635                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1636                                         goto nla_put_failure;
1637                         }
1638                         nla_nest_end(msg, nested);
1639                 }
1640
1641                 if (rdev->wiphy.n_vendor_events) {
1642                         const struct nl80211_vendor_cmd_info *info;
1643                         struct nlattr *nested;
1644
1645                         nested = nla_nest_start(msg,
1646                                                 NL80211_ATTR_VENDOR_EVENTS);
1647                         if (!nested)
1648                                 goto nla_put_failure;
1649
1650                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
1651                                 info = &rdev->wiphy.vendor_events[i];
1652                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1653                                         goto nla_put_failure;
1654                         }
1655                         nla_nest_end(msg, nested);
1656                 }
1657
1658                 /* done */
1659                 state->split_start = 0;
1660                 break;
1661         }
1662         return genlmsg_end(msg, hdr);
1663
1664  nla_put_failure:
1665         genlmsg_cancel(msg, hdr);
1666         return -EMSGSIZE;
1667 }
1668
1669 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1670                                     struct netlink_callback *cb,
1671                                     struct nl80211_dump_wiphy_state *state)
1672 {
1673         struct nlattr **tb = nl80211_fam.attrbuf;
1674         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1675                               tb, nl80211_fam.maxattr, nl80211_policy);
1676         /* ignore parse errors for backward compatibility */
1677         if (ret)
1678                 return 0;
1679
1680         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1681         if (tb[NL80211_ATTR_WIPHY])
1682                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1683         if (tb[NL80211_ATTR_WDEV])
1684                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1685         if (tb[NL80211_ATTR_IFINDEX]) {
1686                 struct net_device *netdev;
1687                 struct cfg80211_registered_device *rdev;
1688                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1689
1690                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1691                 if (!netdev)
1692                         return -ENODEV;
1693                 if (netdev->ieee80211_ptr) {
1694                         rdev = wiphy_to_rdev(
1695                                 netdev->ieee80211_ptr->wiphy);
1696                         state->filter_wiphy = rdev->wiphy_idx;
1697                 }
1698         }
1699
1700         return 0;
1701 }
1702
1703 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1704 {
1705         int idx = 0, ret;
1706         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1707         struct cfg80211_registered_device *rdev;
1708
1709         rtnl_lock();
1710         if (!state) {
1711                 state = kzalloc(sizeof(*state), GFP_KERNEL);
1712                 if (!state) {
1713                         rtnl_unlock();
1714                         return -ENOMEM;
1715                 }
1716                 state->filter_wiphy = -1;
1717                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1718                 if (ret) {
1719                         kfree(state);
1720                         rtnl_unlock();
1721                         return ret;
1722                 }
1723                 cb->args[0] = (long)state;
1724         }
1725
1726         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1727                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1728                         continue;
1729                 if (++idx <= state->start)
1730                         continue;
1731                 if (state->filter_wiphy != -1 &&
1732                     state->filter_wiphy != rdev->wiphy_idx)
1733                         continue;
1734                 /* attempt to fit multiple wiphy data chunks into the skb */
1735                 do {
1736                         ret = nl80211_send_wiphy(rdev, skb,
1737                                                  NETLINK_CB(cb->skb).portid,
1738                                                  cb->nlh->nlmsg_seq,
1739                                                  NLM_F_MULTI, state);
1740                         if (ret < 0) {
1741                                 /*
1742                                  * If sending the wiphy data didn't fit (ENOBUFS
1743                                  * or EMSGSIZE returned), this SKB is still
1744                                  * empty (so it's not too big because another
1745                                  * wiphy dataset is already in the skb) and
1746                                  * we've not tried to adjust the dump allocation
1747                                  * yet ... then adjust the alloc size to be
1748                                  * bigger, and return 1 but with the empty skb.
1749                                  * This results in an empty message being RX'ed
1750                                  * in userspace, but that is ignored.
1751                                  *
1752                                  * We can then retry with the larger buffer.
1753                                  */
1754                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1755                                     !skb->len && !state->split &&
1756                                     cb->min_dump_alloc < 4096) {
1757                                         cb->min_dump_alloc = 4096;
1758                                         state->split_start = 0;
1759                                         rtnl_unlock();
1760                                         return 1;
1761                                 }
1762                                 idx--;
1763                                 break;
1764                         }
1765                 } while (state->split_start > 0);
1766                 break;
1767         }
1768         rtnl_unlock();
1769
1770         state->start = idx;
1771
1772         return skb->len;
1773 }
1774
1775 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
1776 {
1777         kfree((void *)cb->args[0]);
1778         return 0;
1779 }
1780
1781 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1782 {
1783         struct sk_buff *msg;
1784         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1785         struct nl80211_dump_wiphy_state state = {};
1786
1787         msg = nlmsg_new(4096, GFP_KERNEL);
1788         if (!msg)
1789                 return -ENOMEM;
1790
1791         if (nl80211_send_wiphy(rdev, msg, info->snd_portid, info->snd_seq, 0,
1792                                &state) < 0) {
1793                 nlmsg_free(msg);
1794                 return -ENOBUFS;
1795         }
1796
1797         return genlmsg_reply(msg, info);
1798 }
1799
1800 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1801         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1802         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1803         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1804         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1805         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1806 };
1807
1808 static int parse_txq_params(struct nlattr *tb[],
1809                             struct ieee80211_txq_params *txq_params)
1810 {
1811         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1812             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1813             !tb[NL80211_TXQ_ATTR_AIFS])
1814                 return -EINVAL;
1815
1816         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1817         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1818         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1819         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1820         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1821
1822         if (txq_params->ac >= NL80211_NUM_ACS)
1823                 return -EINVAL;
1824
1825         return 0;
1826 }
1827
1828 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1829 {
1830         /*
1831          * You can only set the channel explicitly for WDS interfaces,
1832          * all others have their channel managed via their respective
1833          * "establish a connection" command (connect, join, ...)
1834          *
1835          * For AP/GO and mesh mode, the channel can be set with the
1836          * channel userspace API, but is only stored and passed to the
1837          * low-level driver when the AP starts or the mesh is joined.
1838          * This is for backward compatibility, userspace can also give
1839          * the channel in the start-ap or join-mesh commands instead.
1840          *
1841          * Monitors are special as they are normally slaved to
1842          * whatever else is going on, so they have their own special
1843          * operation to set the monitor channel if possible.
1844          */
1845         return !wdev ||
1846                 wdev->iftype == NL80211_IFTYPE_AP ||
1847                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1848                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1849                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1850 }
1851
1852 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1853                                  struct genl_info *info,
1854                                  struct cfg80211_chan_def *chandef)
1855 {
1856         u32 control_freq;
1857
1858         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1859                 return -EINVAL;
1860
1861         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1862
1863         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1864         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1865         chandef->center_freq1 = control_freq;
1866         chandef->center_freq2 = 0;
1867
1868         /* Primary channel not allowed */
1869         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1870                 return -EINVAL;
1871
1872         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1873                 enum nl80211_channel_type chantype;
1874
1875                 chantype = nla_get_u32(
1876                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1877
1878                 switch (chantype) {
1879                 case NL80211_CHAN_NO_HT:
1880                 case NL80211_CHAN_HT20:
1881                 case NL80211_CHAN_HT40PLUS:
1882                 case NL80211_CHAN_HT40MINUS:
1883                         cfg80211_chandef_create(chandef, chandef->chan,
1884                                                 chantype);
1885                         break;
1886                 default:
1887                         return -EINVAL;
1888                 }
1889         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1890                 chandef->width =
1891                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1892                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1893                         chandef->center_freq1 =
1894                                 nla_get_u32(
1895                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1896                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1897                         chandef->center_freq2 =
1898                                 nla_get_u32(
1899                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1900         }
1901
1902         if (!cfg80211_chandef_valid(chandef))
1903                 return -EINVAL;
1904
1905         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1906                                      IEEE80211_CHAN_DISABLED))
1907                 return -EINVAL;
1908
1909         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
1910              chandef->width == NL80211_CHAN_WIDTH_10) &&
1911             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
1912                 return -EINVAL;
1913
1914         return 0;
1915 }
1916
1917 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1918                                  struct wireless_dev *wdev,
1919                                  struct genl_info *info)
1920 {
1921         struct cfg80211_chan_def chandef;
1922         int result;
1923         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1924
1925         if (wdev)
1926                 iftype = wdev->iftype;
1927
1928         if (!nl80211_can_set_dev_channel(wdev))
1929                 return -EOPNOTSUPP;
1930
1931         result = nl80211_parse_chandef(rdev, info, &chandef);
1932         if (result)
1933                 return result;
1934
1935         switch (iftype) {
1936         case NL80211_IFTYPE_AP:
1937         case NL80211_IFTYPE_P2P_GO:
1938                 if (wdev->beacon_interval) {
1939                         result = -EBUSY;
1940                         break;
1941                 }
1942                 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef, iftype)) {
1943                         result = -EINVAL;
1944                         break;
1945                 }
1946                 wdev->preset_chandef = chandef;
1947                 result = 0;
1948                 break;
1949         case NL80211_IFTYPE_MESH_POINT:
1950                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
1951                 break;
1952         case NL80211_IFTYPE_MONITOR:
1953                 result = cfg80211_set_monitor_channel(rdev, &chandef);
1954                 break;
1955         default:
1956                 result = -EINVAL;
1957         }
1958
1959         return result;
1960 }
1961
1962 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1963 {
1964         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1965         struct net_device *netdev = info->user_ptr[1];
1966
1967         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1968 }
1969
1970 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1971 {
1972         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1973         struct net_device *dev = info->user_ptr[1];
1974         struct wireless_dev *wdev = dev->ieee80211_ptr;
1975         const u8 *bssid;
1976
1977         if (!info->attrs[NL80211_ATTR_MAC])
1978                 return -EINVAL;
1979
1980         if (netif_running(dev))
1981                 return -EBUSY;
1982
1983         if (!rdev->ops->set_wds_peer)
1984                 return -EOPNOTSUPP;
1985
1986         if (wdev->iftype != NL80211_IFTYPE_WDS)
1987                 return -EOPNOTSUPP;
1988
1989         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1990         return rdev_set_wds_peer(rdev, dev, bssid);
1991 }
1992
1993
1994 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1995 {
1996         struct cfg80211_registered_device *rdev;
1997         struct net_device *netdev = NULL;
1998         struct wireless_dev *wdev;
1999         int result = 0, rem_txq_params = 0;
2000         struct nlattr *nl_txq_params;
2001         u32 changed;
2002         u8 retry_short = 0, retry_long = 0;
2003         u32 frag_threshold = 0, rts_threshold = 0;
2004         u8 coverage_class = 0;
2005
2006         ASSERT_RTNL();
2007
2008         /*
2009          * Try to find the wiphy and netdev. Normally this
2010          * function shouldn't need the netdev, but this is
2011          * done for backward compatibility -- previously
2012          * setting the channel was done per wiphy, but now
2013          * it is per netdev. Previous userland like hostapd
2014          * also passed a netdev to set_wiphy, so that it is
2015          * possible to let that go to the right netdev!
2016          */
2017
2018         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2019                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2020
2021                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2022                 if (netdev && netdev->ieee80211_ptr)
2023                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2024                 else
2025                         netdev = NULL;
2026         }
2027
2028         if (!netdev) {
2029                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2030                                                   info->attrs);
2031                 if (IS_ERR(rdev))
2032                         return PTR_ERR(rdev);
2033                 wdev = NULL;
2034                 netdev = NULL;
2035                 result = 0;
2036         } else
2037                 wdev = netdev->ieee80211_ptr;
2038
2039         /*
2040          * end workaround code, by now the rdev is available
2041          * and locked, and wdev may or may not be NULL.
2042          */
2043
2044         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2045                 result = cfg80211_dev_rename(
2046                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2047
2048         if (result)
2049                 return result;
2050
2051         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2052                 struct ieee80211_txq_params txq_params;
2053                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2054
2055                 if (!rdev->ops->set_txq_params)
2056                         return -EOPNOTSUPP;
2057
2058                 if (!netdev)
2059                         return -EINVAL;
2060
2061                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2062                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2063                         return -EINVAL;
2064
2065                 if (!netif_running(netdev))
2066                         return -ENETDOWN;
2067
2068                 nla_for_each_nested(nl_txq_params,
2069                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2070                                     rem_txq_params) {
2071                         result = nla_parse(tb, NL80211_TXQ_ATTR_MAX,
2072                                            nla_data(nl_txq_params),
2073                                            nla_len(nl_txq_params),
2074                                            txq_params_policy);
2075                         if (result)
2076                                 return result;
2077                         result = parse_txq_params(tb, &txq_params);
2078                         if (result)
2079                                 return result;
2080
2081                         result = rdev_set_txq_params(rdev, netdev,
2082                                                      &txq_params);
2083                         if (result)
2084                                 return result;
2085                 }
2086         }
2087
2088         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2089                 result = __nl80211_set_channel(rdev,
2090                                 nl80211_can_set_dev_channel(wdev) ? wdev : NULL,
2091                                 info);
2092                 if (result)
2093                         return result;
2094         }
2095
2096         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2097                 struct wireless_dev *txp_wdev = wdev;
2098                 enum nl80211_tx_power_setting type;
2099                 int idx, mbm = 0;
2100
2101                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2102                         txp_wdev = NULL;
2103
2104                 if (!rdev->ops->set_tx_power)
2105                         return -EOPNOTSUPP;
2106
2107                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2108                 type = nla_get_u32(info->attrs[idx]);
2109
2110                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2111                     (type != NL80211_TX_POWER_AUTOMATIC))
2112                         return -EINVAL;
2113
2114                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2115                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2116                         mbm = nla_get_u32(info->attrs[idx]);
2117                 }
2118
2119                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2120                 if (result)
2121                         return result;
2122         }
2123
2124         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2125             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2126                 u32 tx_ant, rx_ant;
2127                 if ((!rdev->wiphy.available_antennas_tx &&
2128                      !rdev->wiphy.available_antennas_rx) ||
2129                     !rdev->ops->set_antenna)
2130                         return -EOPNOTSUPP;
2131
2132                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2133                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2134
2135                 /* reject antenna configurations which don't match the
2136                  * available antenna masks, except for the "all" mask */
2137                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2138                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2139                         return -EINVAL;
2140
2141                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2142                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2143
2144                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2145                 if (result)
2146                         return result;
2147         }
2148
2149         changed = 0;
2150
2151         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2152                 retry_short = nla_get_u8(
2153                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2154                 if (retry_short == 0)
2155                         return -EINVAL;
2156
2157                 changed |= WIPHY_PARAM_RETRY_SHORT;
2158         }
2159
2160         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2161                 retry_long = nla_get_u8(
2162                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2163                 if (retry_long == 0)
2164                         return -EINVAL;
2165
2166                 changed |= WIPHY_PARAM_RETRY_LONG;
2167         }
2168
2169         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2170                 frag_threshold = nla_get_u32(
2171                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2172                 if (frag_threshold < 256)
2173                         return -EINVAL;
2174
2175                 if (frag_threshold != (u32) -1) {
2176                         /*
2177                          * Fragments (apart from the last one) are required to
2178                          * have even length. Make the fragmentation code
2179                          * simpler by stripping LSB should someone try to use
2180                          * odd threshold value.
2181                          */
2182                         frag_threshold &= ~0x1;
2183                 }
2184                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2185         }
2186
2187         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2188                 rts_threshold = nla_get_u32(
2189                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2190                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2191         }
2192
2193         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2194                 coverage_class = nla_get_u8(
2195                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2196                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2197         }
2198
2199         if (changed) {
2200                 u8 old_retry_short, old_retry_long;
2201                 u32 old_frag_threshold, old_rts_threshold;
2202                 u8 old_coverage_class;
2203
2204                 if (!rdev->ops->set_wiphy_params)
2205                         return -EOPNOTSUPP;
2206
2207                 old_retry_short = rdev->wiphy.retry_short;
2208                 old_retry_long = rdev->wiphy.retry_long;
2209                 old_frag_threshold = rdev->wiphy.frag_threshold;
2210                 old_rts_threshold = rdev->wiphy.rts_threshold;
2211                 old_coverage_class = rdev->wiphy.coverage_class;
2212
2213                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2214                         rdev->wiphy.retry_short = retry_short;
2215                 if (changed & WIPHY_PARAM_RETRY_LONG)
2216                         rdev->wiphy.retry_long = retry_long;
2217                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2218                         rdev->wiphy.frag_threshold = frag_threshold;
2219                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2220                         rdev->wiphy.rts_threshold = rts_threshold;
2221                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2222                         rdev->wiphy.coverage_class = coverage_class;
2223
2224                 result = rdev_set_wiphy_params(rdev, changed);
2225                 if (result) {
2226                         rdev->wiphy.retry_short = old_retry_short;
2227                         rdev->wiphy.retry_long = old_retry_long;
2228                         rdev->wiphy.frag_threshold = old_frag_threshold;
2229                         rdev->wiphy.rts_threshold = old_rts_threshold;
2230                         rdev->wiphy.coverage_class = old_coverage_class;
2231                 }
2232         }
2233         return 0;
2234 }
2235
2236 static inline u64 wdev_id(struct wireless_dev *wdev)
2237 {
2238         return (u64)wdev->identifier |
2239                ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2240 }
2241
2242 static int nl80211_send_chandef(struct sk_buff *msg,
2243                                 const struct cfg80211_chan_def *chandef)
2244 {
2245         WARN_ON(!cfg80211_chandef_valid(chandef));
2246
2247         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2248                         chandef->chan->center_freq))
2249                 return -ENOBUFS;
2250         switch (chandef->width) {
2251         case NL80211_CHAN_WIDTH_20_NOHT:
2252         case NL80211_CHAN_WIDTH_20:
2253         case NL80211_CHAN_WIDTH_40:
2254                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2255                                 cfg80211_get_chandef_type(chandef)))
2256                         return -ENOBUFS;
2257                 break;
2258         default:
2259                 break;
2260         }
2261         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2262                 return -ENOBUFS;
2263         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2264                 return -ENOBUFS;
2265         if (chandef->center_freq2 &&
2266             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2267                 return -ENOBUFS;
2268         return 0;
2269 }
2270
2271 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2272                               struct cfg80211_registered_device *rdev,
2273                               struct wireless_dev *wdev)
2274 {
2275         struct net_device *dev = wdev->netdev;
2276         void *hdr;
2277
2278         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
2279         if (!hdr)
2280                 return -1;
2281
2282         if (dev &&
2283             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2284              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2285                 goto nla_put_failure;
2286
2287         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2288             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2289             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2290             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2291             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2292                         rdev->devlist_generation ^
2293                         (cfg80211_rdev_list_generation << 2)))
2294                 goto nla_put_failure;
2295
2296         if (rdev->ops->get_channel) {
2297                 int ret;
2298                 struct cfg80211_chan_def chandef;
2299
2300                 ret = rdev_get_channel(rdev, wdev, &chandef);
2301                 if (ret == 0) {
2302                         if (nl80211_send_chandef(msg, &chandef))
2303                                 goto nla_put_failure;
2304                 }
2305         }
2306
2307         if (wdev->ssid_len) {
2308                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2309                         goto nla_put_failure;
2310         }
2311
2312         return genlmsg_end(msg, hdr);
2313
2314  nla_put_failure:
2315         genlmsg_cancel(msg, hdr);
2316         return -EMSGSIZE;
2317 }
2318
2319 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2320 {
2321         int wp_idx = 0;
2322         int if_idx = 0;
2323         int wp_start = cb->args[0];
2324         int if_start = cb->args[1];
2325         struct cfg80211_registered_device *rdev;
2326         struct wireless_dev *wdev;
2327
2328         rtnl_lock();
2329         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2330                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2331                         continue;
2332                 if (wp_idx < wp_start) {
2333                         wp_idx++;
2334                         continue;
2335                 }
2336                 if_idx = 0;
2337
2338                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
2339                         if (if_idx < if_start) {
2340                                 if_idx++;
2341                                 continue;
2342                         }
2343                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2344                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2345                                                rdev, wdev) < 0) {
2346                                 goto out;
2347                         }
2348                         if_idx++;
2349                 }
2350
2351                 wp_idx++;
2352         }
2353  out:
2354         rtnl_unlock();
2355
2356         cb->args[0] = wp_idx;
2357         cb->args[1] = if_idx;
2358
2359         return skb->len;
2360 }
2361
2362 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2363 {
2364         struct sk_buff *msg;
2365         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2366         struct wireless_dev *wdev = info->user_ptr[1];
2367
2368         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2369         if (!msg)
2370                 return -ENOMEM;
2371
2372         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2373                                rdev, wdev) < 0) {
2374                 nlmsg_free(msg);
2375                 return -ENOBUFS;
2376         }
2377
2378         return genlmsg_reply(msg, info);
2379 }
2380
2381 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2382         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2383         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2384         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2385         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2386         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2387         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2388 };
2389
2390 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2391 {
2392         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2393         int flag;
2394
2395         *mntrflags = 0;
2396
2397         if (!nla)
2398                 return -EINVAL;
2399
2400         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2401                              nla, mntr_flags_policy))
2402                 return -EINVAL;
2403
2404         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2405                 if (flags[flag])
2406                         *mntrflags |= (1<<flag);
2407
2408         return 0;
2409 }
2410
2411 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2412                                struct net_device *netdev, u8 use_4addr,
2413                                enum nl80211_iftype iftype)
2414 {
2415         if (!use_4addr) {
2416                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2417                         return -EBUSY;
2418                 return 0;
2419         }
2420
2421         switch (iftype) {
2422         case NL80211_IFTYPE_AP_VLAN:
2423                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2424                         return 0;
2425                 break;
2426         case NL80211_IFTYPE_STATION:
2427                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2428                         return 0;
2429                 break;
2430         default:
2431                 break;
2432         }
2433
2434         return -EOPNOTSUPP;
2435 }
2436
2437 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2438 {
2439         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2440         struct vif_params params;
2441         int err;
2442         enum nl80211_iftype otype, ntype;
2443         struct net_device *dev = info->user_ptr[1];
2444         u32 _flags, *flags = NULL;
2445         bool change = false;
2446
2447         memset(&params, 0, sizeof(params));
2448
2449         otype = ntype = dev->ieee80211_ptr->iftype;
2450
2451         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2452                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2453                 if (otype != ntype)
2454                         change = true;
2455                 if (ntype > NL80211_IFTYPE_MAX)
2456                         return -EINVAL;
2457         }
2458
2459         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2460                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2461
2462                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2463                         return -EINVAL;
2464                 if (netif_running(dev))
2465                         return -EBUSY;
2466
2467                 wdev_lock(wdev);
2468                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2469                              IEEE80211_MAX_MESH_ID_LEN);
2470                 wdev->mesh_id_up_len =
2471                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2472                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2473                        wdev->mesh_id_up_len);
2474                 wdev_unlock(wdev);
2475         }
2476
2477         if (info->attrs[NL80211_ATTR_4ADDR]) {
2478                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2479                 change = true;
2480                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2481                 if (err)
2482                         return err;
2483         } else {
2484                 params.use_4addr = -1;
2485         }
2486
2487         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2488                 if (ntype != NL80211_IFTYPE_MONITOR)
2489                         return -EINVAL;
2490                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2491                                           &_flags);
2492                 if (err)
2493                         return err;
2494
2495                 flags = &_flags;
2496                 change = true;
2497         }
2498
2499         if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
2500             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2501                 return -EOPNOTSUPP;
2502
2503         if (change)
2504                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2505         else
2506                 err = 0;
2507
2508         if (!err && params.use_4addr != -1)
2509                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2510
2511         return err;
2512 }
2513
2514 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2515 {
2516         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2517         struct vif_params params;
2518         struct wireless_dev *wdev;
2519         struct sk_buff *msg;
2520         int err;
2521         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2522         u32 flags;
2523
2524         /* to avoid failing a new interface creation due to pending removal */
2525         cfg80211_destroy_ifaces(rdev);
2526
2527         memset(&params, 0, sizeof(params));
2528
2529         if (!info->attrs[NL80211_ATTR_IFNAME])
2530                 return -EINVAL;
2531
2532         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2533                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2534                 if (type > NL80211_IFTYPE_MAX)
2535                         return -EINVAL;
2536         }
2537
2538         if (!rdev->ops->add_virtual_intf ||
2539             !(rdev->wiphy.interface_modes & (1 << type)))
2540                 return -EOPNOTSUPP;
2541
2542         if (type == NL80211_IFTYPE_P2P_DEVICE && info->attrs[NL80211_ATTR_MAC]) {
2543                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2544                            ETH_ALEN);
2545                 if (!is_valid_ether_addr(params.macaddr))
2546                         return -EADDRNOTAVAIL;
2547         }
2548
2549         if (info->attrs[NL80211_ATTR_4ADDR]) {
2550                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2551                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2552                 if (err)
2553                         return err;
2554         }
2555
2556         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2557         if (!msg)
2558                 return -ENOMEM;
2559
2560         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2561                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2562                                   &flags);
2563
2564         if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
2565             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2566                 return -EOPNOTSUPP;
2567
2568         wdev = rdev_add_virtual_intf(rdev,
2569                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2570                                 type, err ? NULL : &flags, &params);
2571         if (IS_ERR(wdev)) {
2572                 nlmsg_free(msg);
2573                 return PTR_ERR(wdev);
2574         }
2575
2576         if (info->attrs[NL80211_ATTR_IFACE_SOCKET_OWNER])
2577                 wdev->owner_nlportid = info->snd_portid;
2578
2579         switch (type) {
2580         case NL80211_IFTYPE_MESH_POINT:
2581                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2582                         break;
2583                 wdev_lock(wdev);
2584                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2585                              IEEE80211_MAX_MESH_ID_LEN);
2586                 wdev->mesh_id_up_len =
2587                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2588                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2589                        wdev->mesh_id_up_len);
2590                 wdev_unlock(wdev);
2591                 break;
2592         case NL80211_IFTYPE_P2P_DEVICE:
2593                 /*
2594                  * P2P Device doesn't have a netdev, so doesn't go
2595                  * through the netdev notifier and must be added here
2596                  */
2597                 mutex_init(&wdev->mtx);
2598                 INIT_LIST_HEAD(&wdev->event_list);
2599                 spin_lock_init(&wdev->event_lock);
2600                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2601                 spin_lock_init(&wdev->mgmt_registrations_lock);
2602
2603                 wdev->identifier = ++rdev->wdev_id;
2604                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2605                 rdev->devlist_generation++;
2606                 break;
2607         default:
2608                 break;
2609         }
2610
2611         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2612                                rdev, wdev) < 0) {
2613                 nlmsg_free(msg);
2614                 return -ENOBUFS;
2615         }
2616
2617         return genlmsg_reply(msg, info);
2618 }
2619
2620 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2621 {
2622         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2623         struct wireless_dev *wdev = info->user_ptr[1];
2624
2625         if (!rdev->ops->del_virtual_intf)
2626                 return -EOPNOTSUPP;
2627
2628         /*
2629          * If we remove a wireless device without a netdev then clear
2630          * user_ptr[1] so that nl80211_post_doit won't dereference it
2631          * to check if it needs to do dev_put(). Otherwise it crashes
2632          * since the wdev has been freed, unlike with a netdev where
2633          * we need the dev_put() for the netdev to really be freed.
2634          */
2635         if (!wdev->netdev)
2636                 info->user_ptr[1] = NULL;
2637
2638         return rdev_del_virtual_intf(rdev, wdev);
2639 }
2640
2641 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2642 {
2643         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2644         struct net_device *dev = info->user_ptr[1];
2645         u16 noack_map;
2646
2647         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2648                 return -EINVAL;
2649
2650         if (!rdev->ops->set_noack_map)
2651                 return -EOPNOTSUPP;
2652
2653         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2654
2655         return rdev_set_noack_map(rdev, dev, noack_map);
2656 }
2657
2658 struct get_key_cookie {
2659         struct sk_buff *msg;
2660         int error;
2661         int idx;
2662 };
2663
2664 static void get_key_callback(void *c, struct key_params *params)
2665 {
2666         struct nlattr *key;
2667         struct get_key_cookie *cookie = c;
2668
2669         if ((params->key &&
2670              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2671                      params->key_len, params->key)) ||
2672             (params->seq &&
2673              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2674                      params->seq_len, params->seq)) ||
2675             (params->cipher &&
2676              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2677                          params->cipher)))
2678                 goto nla_put_failure;
2679
2680         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2681         if (!key)
2682                 goto nla_put_failure;
2683
2684         if ((params->key &&
2685              nla_put(cookie->msg, NL80211_KEY_DATA,
2686                      params->key_len, params->key)) ||
2687             (params->seq &&
2688              nla_put(cookie->msg, NL80211_KEY_SEQ,
2689                      params->seq_len, params->seq)) ||
2690             (params->cipher &&
2691              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2692                          params->cipher)))
2693                 goto nla_put_failure;
2694
2695         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2696                 goto nla_put_failure;
2697
2698         nla_nest_end(cookie->msg, key);
2699
2700         return;
2701  nla_put_failure:
2702         cookie->error = 1;
2703 }
2704
2705 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2706 {
2707         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2708         int err;
2709         struct net_device *dev = info->user_ptr[1];
2710         u8 key_idx = 0;
2711         const u8 *mac_addr = NULL;
2712         bool pairwise;
2713         struct get_key_cookie cookie = {
2714                 .error = 0,
2715         };
2716         void *hdr;
2717         struct sk_buff *msg;
2718
2719         if (info->attrs[NL80211_ATTR_KEY_IDX])
2720                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2721
2722         if (key_idx > 5)
2723                 return -EINVAL;
2724
2725         if (info->attrs[NL80211_ATTR_MAC])
2726                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2727
2728         pairwise = !!mac_addr;
2729         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2730                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2731                 if (kt >= NUM_NL80211_KEYTYPES)
2732                         return -EINVAL;
2733                 if (kt != NL80211_KEYTYPE_GROUP &&
2734                     kt != NL80211_KEYTYPE_PAIRWISE)
2735                         return -EINVAL;
2736                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2737         }
2738
2739         if (!rdev->ops->get_key)
2740                 return -EOPNOTSUPP;
2741
2742         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2743         if (!msg)
2744                 return -ENOMEM;
2745
2746         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2747                              NL80211_CMD_NEW_KEY);
2748         if (!hdr)
2749                 goto nla_put_failure;
2750
2751         cookie.msg = msg;
2752         cookie.idx = key_idx;
2753
2754         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2755             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2756                 goto nla_put_failure;
2757         if (mac_addr &&
2758             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2759                 goto nla_put_failure;
2760
2761         if (pairwise && mac_addr &&
2762             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2763                 return -ENOENT;
2764
2765         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2766                            get_key_callback);
2767
2768         if (err)
2769                 goto free_msg;
2770
2771         if (cookie.error)
2772                 goto nla_put_failure;
2773
2774         genlmsg_end(msg, hdr);
2775         return genlmsg_reply(msg, info);
2776
2777  nla_put_failure:
2778         err = -ENOBUFS;
2779  free_msg:
2780         nlmsg_free(msg);
2781         return err;
2782 }
2783
2784 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2785 {
2786         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2787         struct key_parse key;
2788         int err;
2789         struct net_device *dev = info->user_ptr[1];
2790
2791         err = nl80211_parse_key(info, &key);
2792         if (err)
2793                 return err;
2794
2795         if (key.idx < 0)
2796                 return -EINVAL;
2797
2798         /* only support setting default key */
2799         if (!key.def && !key.defmgmt)
2800                 return -EINVAL;
2801
2802         wdev_lock(dev->ieee80211_ptr);
2803
2804         if (key.def) {
2805                 if (!rdev->ops->set_default_key) {
2806                         err = -EOPNOTSUPP;
2807                         goto out;
2808                 }
2809
2810                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2811                 if (err)
2812                         goto out;
2813
2814                 err = rdev_set_default_key(rdev, dev, key.idx,
2815                                                  key.def_uni, key.def_multi);
2816
2817                 if (err)
2818                         goto out;
2819
2820 #ifdef CONFIG_CFG80211_WEXT
2821                 dev->ieee80211_ptr->wext.default_key = key.idx;
2822 #endif
2823         } else {
2824                 if (key.def_uni || !key.def_multi) {
2825                         err = -EINVAL;
2826                         goto out;
2827                 }
2828
2829                 if (!rdev->ops->set_default_mgmt_key) {
2830                         err = -EOPNOTSUPP;
2831                         goto out;
2832                 }
2833
2834                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2835                 if (err)
2836                         goto out;
2837
2838                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2839                 if (err)
2840                         goto out;
2841
2842 #ifdef CONFIG_CFG80211_WEXT
2843                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2844 #endif
2845         }
2846
2847  out:
2848         wdev_unlock(dev->ieee80211_ptr);
2849
2850         return err;
2851 }
2852
2853 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2854 {
2855         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2856         int err;
2857         struct net_device *dev = info->user_ptr[1];
2858         struct key_parse key;
2859         const u8 *mac_addr = NULL;
2860
2861         err = nl80211_parse_key(info, &key);
2862         if (err)
2863                 return err;
2864
2865         if (!key.p.key)
2866                 return -EINVAL;
2867
2868         if (info->attrs[NL80211_ATTR_MAC])
2869                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2870
2871         if (key.type == -1) {
2872                 if (mac_addr)
2873                         key.type = NL80211_KEYTYPE_PAIRWISE;
2874                 else
2875                         key.type = NL80211_KEYTYPE_GROUP;
2876         }
2877
2878         /* for now */
2879         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2880             key.type != NL80211_KEYTYPE_GROUP)
2881                 return -EINVAL;
2882
2883         if (!rdev->ops->add_key)
2884                 return -EOPNOTSUPP;
2885
2886         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2887                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2888                                            mac_addr))
2889                 return -EINVAL;
2890
2891         wdev_lock(dev->ieee80211_ptr);
2892         err = nl80211_key_allowed(dev->ieee80211_ptr);
2893         if (!err)
2894                 err = rdev_add_key(rdev, dev, key.idx,
2895                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2896                                     mac_addr, &key.p);
2897         wdev_unlock(dev->ieee80211_ptr);
2898
2899         return err;
2900 }
2901
2902 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2903 {
2904         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2905         int err;
2906         struct net_device *dev = info->user_ptr[1];
2907         u8 *mac_addr = NULL;
2908         struct key_parse key;
2909
2910         err = nl80211_parse_key(info, &key);
2911         if (err)
2912                 return err;
2913
2914         if (info->attrs[NL80211_ATTR_MAC])
2915                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2916
2917         if (key.type == -1) {
2918                 if (mac_addr)
2919                         key.type = NL80211_KEYTYPE_PAIRWISE;
2920                 else
2921                         key.type = NL80211_KEYTYPE_GROUP;
2922         }
2923
2924         /* for now */
2925         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2926             key.type != NL80211_KEYTYPE_GROUP)
2927                 return -EINVAL;
2928
2929         if (!rdev->ops->del_key)
2930                 return -EOPNOTSUPP;
2931
2932         wdev_lock(dev->ieee80211_ptr);
2933         err = nl80211_key_allowed(dev->ieee80211_ptr);
2934
2935         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2936             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2937                 err = -ENOENT;
2938
2939         if (!err)
2940                 err = rdev_del_key(rdev, dev, key.idx,
2941                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2942                                    mac_addr);
2943
2944 #ifdef CONFIG_CFG80211_WEXT
2945         if (!err) {
2946                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
2947                         dev->ieee80211_ptr->wext.default_key = -1;
2948                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2949                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2950         }
2951 #endif
2952         wdev_unlock(dev->ieee80211_ptr);
2953
2954         return err;
2955 }
2956
2957 /* This function returns an error or the number of nested attributes */
2958 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
2959 {
2960         struct nlattr *attr;
2961         int n_entries = 0, tmp;
2962
2963         nla_for_each_nested(attr, nl_attr, tmp) {
2964                 if (nla_len(attr) != ETH_ALEN)
2965                         return -EINVAL;
2966
2967                 n_entries++;
2968         }
2969
2970         return n_entries;
2971 }
2972
2973 /*
2974  * This function parses ACL information and allocates memory for ACL data.
2975  * On successful return, the calling function is responsible to free the
2976  * ACL buffer returned by this function.
2977  */
2978 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
2979                                                 struct genl_info *info)
2980 {
2981         enum nl80211_acl_policy acl_policy;
2982         struct nlattr *attr;
2983         struct cfg80211_acl_data *acl;
2984         int i = 0, n_entries, tmp;
2985
2986         if (!wiphy->max_acl_mac_addrs)
2987                 return ERR_PTR(-EOPNOTSUPP);
2988
2989         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
2990                 return ERR_PTR(-EINVAL);
2991
2992         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
2993         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
2994             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
2995                 return ERR_PTR(-EINVAL);
2996
2997         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
2998                 return ERR_PTR(-EINVAL);
2999
3000         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3001         if (n_entries < 0)
3002                 return ERR_PTR(n_entries);
3003
3004         if (n_entries > wiphy->max_acl_mac_addrs)
3005                 return ERR_PTR(-ENOTSUPP);
3006
3007         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3008                       GFP_KERNEL);
3009         if (!acl)
3010                 return ERR_PTR(-ENOMEM);
3011
3012         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3013                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3014                 i++;
3015         }
3016
3017         acl->n_acl_entries = n_entries;
3018         acl->acl_policy = acl_policy;
3019
3020         return acl;
3021 }
3022
3023 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3024 {
3025         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3026         struct net_device *dev = info->user_ptr[1];
3027         struct cfg80211_acl_data *acl;
3028         int err;
3029
3030         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3031             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3032                 return -EOPNOTSUPP;
3033
3034         if (!dev->ieee80211_ptr->beacon_interval)
3035                 return -EINVAL;
3036
3037         acl = parse_acl_data(&rdev->wiphy, info);
3038         if (IS_ERR(acl))
3039                 return PTR_ERR(acl);
3040
3041         err = rdev_set_mac_acl(rdev, dev, acl);
3042
3043         kfree(acl);
3044
3045         return err;
3046 }
3047
3048 static int nl80211_parse_beacon(struct nlattr *attrs[],
3049                                 struct cfg80211_beacon_data *bcn)
3050 {
3051         bool haveinfo = false;
3052
3053         if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
3054             !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
3055             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
3056             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
3057                 return -EINVAL;
3058
3059         memset(bcn, 0, sizeof(*bcn));
3060
3061         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
3062                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
3063                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
3064                 if (!bcn->head_len)
3065                         return -EINVAL;
3066                 haveinfo = true;
3067         }
3068
3069         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
3070                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
3071                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
3072                 haveinfo = true;
3073         }
3074
3075         if (!haveinfo)
3076                 return -EINVAL;
3077
3078         if (attrs[NL80211_ATTR_IE]) {
3079                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
3080                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3081         }
3082
3083         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3084                 bcn->proberesp_ies =
3085                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3086                 bcn->proberesp_ies_len =
3087                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3088         }
3089
3090         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3091                 bcn->assocresp_ies =
3092                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3093                 bcn->assocresp_ies_len =
3094                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3095         }
3096
3097         if (attrs[NL80211_ATTR_PROBE_RESP]) {
3098                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
3099                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3100         }
3101
3102         return 0;
3103 }
3104
3105 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
3106                                    struct cfg80211_ap_settings *params)
3107 {
3108         struct wireless_dev *wdev;
3109         bool ret = false;
3110
3111         list_for_each_entry(wdev, &rdev->wdev_list, list) {
3112                 if (wdev->iftype != NL80211_IFTYPE_AP &&
3113                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
3114                         continue;
3115
3116                 if (!wdev->preset_chandef.chan)
3117                         continue;
3118
3119                 params->chandef = wdev->preset_chandef;
3120                 ret = true;
3121                 break;
3122         }
3123
3124         return ret;
3125 }
3126
3127 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3128                                     enum nl80211_auth_type auth_type,
3129                                     enum nl80211_commands cmd)
3130 {
3131         if (auth_type > NL80211_AUTHTYPE_MAX)
3132                 return false;
3133
3134         switch (cmd) {
3135         case NL80211_CMD_AUTHENTICATE:
3136                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3137                     auth_type == NL80211_AUTHTYPE_SAE)
3138                         return false;
3139                 return true;
3140         case NL80211_CMD_CONNECT:
3141         case NL80211_CMD_START_AP:
3142                 /* SAE not supported yet */
3143                 if (auth_type == NL80211_AUTHTYPE_SAE)
3144                         return false;
3145                 return true;
3146         default:
3147                 return false;
3148         }
3149 }
3150
3151 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3152 {
3153         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3154         struct net_device *dev = info->user_ptr[1];
3155         struct wireless_dev *wdev = dev->ieee80211_ptr;
3156         struct cfg80211_ap_settings params;
3157         int err;
3158
3159         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3160             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3161                 return -EOPNOTSUPP;
3162
3163         if (!rdev->ops->start_ap)
3164                 return -EOPNOTSUPP;
3165
3166         if (wdev->beacon_interval)
3167                 return -EALREADY;
3168
3169         memset(&params, 0, sizeof(params));
3170
3171         /* these are required for START_AP */
3172         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3173             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3174             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3175                 return -EINVAL;
3176
3177         err = nl80211_parse_beacon(info->attrs, &params.beacon);
3178         if (err)
3179                 return err;
3180
3181         params.beacon_interval =
3182                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3183         params.dtim_period =
3184                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3185
3186         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
3187         if (err)
3188                 return err;
3189
3190         /*
3191          * In theory, some of these attributes should be required here
3192          * but since they were not used when the command was originally
3193          * added, keep them optional for old user space programs to let
3194          * them continue to work with drivers that do not need the
3195          * additional information -- drivers must check!
3196          */
3197         if (info->attrs[NL80211_ATTR_SSID]) {
3198                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3199                 params.ssid_len =
3200                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3201                 if (params.ssid_len == 0 ||
3202                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3203                         return -EINVAL;
3204         }
3205
3206         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3207                 params.hidden_ssid = nla_get_u32(
3208                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3209                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3210                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3211                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3212                         return -EINVAL;
3213         }
3214
3215         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3216
3217         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3218                 params.auth_type = nla_get_u32(
3219                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3220                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3221                                              NL80211_CMD_START_AP))
3222                         return -EINVAL;
3223         } else
3224                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3225
3226         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3227                                       NL80211_MAX_NR_CIPHER_SUITES);
3228         if (err)
3229                 return err;
3230
3231         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3232                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3233                         return -EOPNOTSUPP;
3234                 params.inactivity_timeout = nla_get_u16(
3235                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3236         }
3237
3238         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3239                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3240                         return -EINVAL;
3241                 params.p2p_ctwindow =
3242                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3243                 if (params.p2p_ctwindow > 127)
3244                         return -EINVAL;
3245                 if (params.p2p_ctwindow != 0 &&
3246                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3247                         return -EINVAL;
3248         }
3249
3250         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3251                 u8 tmp;
3252
3253                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3254                         return -EINVAL;
3255                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3256                 if (tmp > 1)
3257                         return -EINVAL;
3258                 params.p2p_opp_ps = tmp;
3259                 if (params.p2p_opp_ps != 0 &&
3260                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3261                         return -EINVAL;
3262         }
3263
3264         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3265                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
3266                 if (err)
3267                         return err;
3268         } else if (wdev->preset_chandef.chan) {
3269                 params.chandef = wdev->preset_chandef;
3270         } else if (!nl80211_get_ap_channel(rdev, &params))
3271                 return -EINVAL;
3272
3273         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef,
3274                                      wdev->iftype))
3275                 return -EINVAL;
3276
3277         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3278                 params.acl = parse_acl_data(&rdev->wiphy, info);
3279                 if (IS_ERR(params.acl))
3280                         return PTR_ERR(params.acl);
3281         }
3282
3283         wdev_lock(wdev);
3284         err = rdev_start_ap(rdev, dev, &params);
3285         if (!err) {
3286                 wdev->preset_chandef = params.chandef;
3287                 wdev->beacon_interval = params.beacon_interval;
3288                 wdev->chandef = params.chandef;
3289                 wdev->ssid_len = params.ssid_len;
3290                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3291         }
3292         wdev_unlock(wdev);
3293
3294         kfree(params.acl);
3295
3296         return err;
3297 }
3298
3299 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3300 {
3301         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3302         struct net_device *dev = info->user_ptr[1];
3303         struct wireless_dev *wdev = dev->ieee80211_ptr;
3304         struct cfg80211_beacon_data params;
3305         int err;
3306
3307         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3308             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3309                 return -EOPNOTSUPP;
3310
3311         if (!rdev->ops->change_beacon)
3312                 return -EOPNOTSUPP;
3313
3314         if (!wdev->beacon_interval)
3315                 return -EINVAL;
3316
3317         err = nl80211_parse_beacon(info->attrs, &params);
3318         if (err)
3319                 return err;
3320
3321         wdev_lock(wdev);
3322         err = rdev_change_beacon(rdev, dev, &params);
3323         wdev_unlock(wdev);
3324
3325         return err;
3326 }
3327
3328 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3329 {
3330         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3331         struct net_device *dev = info->user_ptr[1];
3332
3333         return cfg80211_stop_ap(rdev, dev, false);
3334 }
3335
3336 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3337         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3338         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3339         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3340         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3341         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3342         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3343 };
3344
3345 static int parse_station_flags(struct genl_info *info,
3346                                enum nl80211_iftype iftype,
3347                                struct station_parameters *params)
3348 {
3349         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3350         struct nlattr *nla;
3351         int flag;
3352
3353         /*
3354          * Try parsing the new attribute first so userspace
3355          * can specify both for older kernels.
3356          */
3357         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3358         if (nla) {
3359                 struct nl80211_sta_flag_update *sta_flags;
3360
3361                 sta_flags = nla_data(nla);
3362                 params->sta_flags_mask = sta_flags->mask;
3363                 params->sta_flags_set = sta_flags->set;
3364                 params->sta_flags_set &= params->sta_flags_mask;
3365                 if ((params->sta_flags_mask |
3366                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3367                         return -EINVAL;
3368                 return 0;
3369         }
3370
3371         /* if present, parse the old attribute */
3372
3373         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3374         if (!nla)
3375                 return 0;
3376
3377         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3378                              nla, sta_flags_policy))
3379                 return -EINVAL;
3380
3381         /*
3382          * Only allow certain flags for interface types so that
3383          * other attributes are silently ignored. Remember that
3384          * this is backward compatibility code with old userspace
3385          * and shouldn't be hit in other cases anyway.
3386          */
3387         switch (iftype) {
3388         case NL80211_IFTYPE_AP:
3389         case NL80211_IFTYPE_AP_VLAN:
3390         case NL80211_IFTYPE_P2P_GO:
3391                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3392                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3393                                          BIT(NL80211_STA_FLAG_WME) |
3394                                          BIT(NL80211_STA_FLAG_MFP);
3395                 break;
3396         case NL80211_IFTYPE_P2P_CLIENT:
3397         case NL80211_IFTYPE_STATION:
3398                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3399                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3400                 break;
3401         case NL80211_IFTYPE_MESH_POINT:
3402                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3403                                          BIT(NL80211_STA_FLAG_MFP) |
3404                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3405         default:
3406                 return -EINVAL;
3407         }
3408
3409         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3410                 if (flags[flag]) {
3411                         params->sta_flags_set |= (1<<flag);
3412
3413                         /* no longer support new API additions in old API */
3414                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3415                                 return -EINVAL;
3416                 }
3417         }
3418
3419         return 0;
3420 }
3421
3422 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3423                                  int attr)
3424 {
3425         struct nlattr *rate;
3426         u32 bitrate;
3427         u16 bitrate_compat;
3428
3429         rate = nla_nest_start(msg, attr);
3430         if (!rate)
3431                 return false;
3432
3433         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3434         bitrate = cfg80211_calculate_bitrate(info);
3435         /* report 16-bit bitrate only if we can */
3436         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3437         if (bitrate > 0 &&
3438             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3439                 return false;
3440         if (bitrate_compat > 0 &&
3441             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3442                 return false;
3443
3444         if (info->flags & RATE_INFO_FLAGS_MCS) {
3445                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3446                         return false;
3447                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3448                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3449                         return false;
3450                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3451                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3452                         return false;
3453         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3454                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3455                         return false;
3456                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3457                         return false;
3458                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3459                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3460                         return false;
3461                 if (info->flags & RATE_INFO_FLAGS_80_MHZ_WIDTH &&
3462                     nla_put_flag(msg, NL80211_RATE_INFO_80_MHZ_WIDTH))
3463                         return false;
3464                 if (info->flags & RATE_INFO_FLAGS_80P80_MHZ_WIDTH &&
3465                     nla_put_flag(msg, NL80211_RATE_INFO_80P80_MHZ_WIDTH))
3466                         return false;
3467                 if (info->flags & RATE_INFO_FLAGS_160_MHZ_WIDTH &&
3468                     nla_put_flag(msg, NL80211_RATE_INFO_160_MHZ_WIDTH))
3469                         return false;
3470                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3471                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3472                         return false;
3473         }
3474
3475         nla_nest_end(msg, rate);
3476         return true;
3477 }
3478
3479 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
3480                                int id)
3481 {
3482         void *attr;
3483         int i = 0;
3484
3485         if (!mask)
3486                 return true;
3487
3488         attr = nla_nest_start(msg, id);
3489         if (!attr)
3490                 return false;
3491
3492         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
3493                 if (!(mask & BIT(i)))
3494                         continue;
3495
3496                 if (nla_put_u8(msg, i, signal[i]))
3497                         return false;
3498         }
3499
3500         nla_nest_end(msg, attr);
3501
3502         return true;
3503 }
3504
3505 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
3506                                 int flags,
3507                                 struct cfg80211_registered_device *rdev,
3508                                 struct net_device *dev,
3509                                 const u8 *mac_addr, struct station_info *sinfo)
3510 {
3511         void *hdr;
3512         struct nlattr *sinfoattr, *bss_param;
3513
3514         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3515         if (!hdr)
3516                 return -1;
3517
3518         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3519             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3520             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3521                 goto nla_put_failure;
3522
3523         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3524         if (!sinfoattr)
3525                 goto nla_put_failure;
3526         if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
3527             nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
3528                         sinfo->connected_time))
3529                 goto nla_put_failure;
3530         if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
3531             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
3532                         sinfo->inactive_time))
3533                 goto nla_put_failure;
3534         if ((sinfo->filled & (STATION_INFO_RX_BYTES |
3535                               STATION_INFO_RX_BYTES64)) &&
3536             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3537                         (u32)sinfo->rx_bytes))
3538                 goto nla_put_failure;
3539         if ((sinfo->filled & (STATION_INFO_TX_BYTES |
3540                               STATION_INFO_TX_BYTES64)) &&
3541             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3542                         (u32)sinfo->tx_bytes))
3543                 goto nla_put_failure;
3544         if ((sinfo->filled & STATION_INFO_RX_BYTES64) &&
3545             nla_put_u64(msg, NL80211_STA_INFO_RX_BYTES64,
3546                         sinfo->rx_bytes))
3547                 goto nla_put_failure;
3548         if ((sinfo->filled & STATION_INFO_TX_BYTES64) &&
3549             nla_put_u64(msg, NL80211_STA_INFO_TX_BYTES64,
3550                         sinfo->tx_bytes))
3551                 goto nla_put_failure;
3552         if ((sinfo->filled & STATION_INFO_LLID) &&
3553             nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
3554                 goto nla_put_failure;
3555         if ((sinfo->filled & STATION_INFO_PLID) &&
3556             nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
3557                 goto nla_put_failure;
3558         if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
3559             nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
3560                        sinfo->plink_state))
3561                 goto nla_put_failure;
3562         switch (rdev->wiphy.signal_type) {
3563         case CFG80211_SIGNAL_TYPE_MBM:
3564                 if ((sinfo->filled & STATION_INFO_SIGNAL) &&
3565                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
3566                                sinfo->signal))
3567                         goto nla_put_failure;
3568                 if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
3569                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
3570                                sinfo->signal_avg))
3571                         goto nla_put_failure;
3572                 break;
3573         default:
3574                 break;
3575         }
3576         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL) {
3577                 if (!nl80211_put_signal(msg, sinfo->chains,
3578                                         sinfo->chain_signal,
3579                                         NL80211_STA_INFO_CHAIN_SIGNAL))
3580                         goto nla_put_failure;
3581         }
3582         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL_AVG) {
3583                 if (!nl80211_put_signal(msg, sinfo->chains,
3584                                         sinfo->chain_signal_avg,
3585                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
3586                         goto nla_put_failure;
3587         }
3588         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
3589                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3590                                           NL80211_STA_INFO_TX_BITRATE))
3591                         goto nla_put_failure;
3592         }
3593         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
3594                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3595                                           NL80211_STA_INFO_RX_BITRATE))
3596                         goto nla_put_failure;
3597         }
3598         if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
3599             nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
3600                         sinfo->rx_packets))
3601                 goto nla_put_failure;
3602         if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
3603             nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
3604                         sinfo->tx_packets))
3605                 goto nla_put_failure;
3606         if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
3607             nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
3608                         sinfo->tx_retries))
3609                 goto nla_put_failure;
3610         if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
3611             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
3612                         sinfo->tx_failed))
3613                 goto nla_put_failure;
3614         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
3615             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
3616                         sinfo->beacon_loss_count))
3617                 goto nla_put_failure;
3618         if ((sinfo->filled & STATION_INFO_LOCAL_PM) &&
3619             nla_put_u32(msg, NL80211_STA_INFO_LOCAL_PM,
3620                         sinfo->local_pm))
3621                 goto nla_put_failure;
3622         if ((sinfo->filled & STATION_INFO_PEER_PM) &&
3623             nla_put_u32(msg, NL80211_STA_INFO_PEER_PM,
3624                         sinfo->peer_pm))
3625                 goto nla_put_failure;
3626         if ((sinfo->filled & STATION_INFO_NONPEER_PM) &&
3627             nla_put_u32(msg, NL80211_STA_INFO_NONPEER_PM,
3628                         sinfo->nonpeer_pm))
3629                 goto nla_put_failure;
3630         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
3631                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3632                 if (!bss_param)
3633                         goto nla_put_failure;
3634
3635                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3636                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3637                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3638                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3639                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3640                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3641                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3642                                sinfo->bss_param.dtim_period) ||
3643                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3644                                 sinfo->bss_param.beacon_interval))
3645                         goto nla_put_failure;
3646
3647                 nla_nest_end(msg, bss_param);
3648         }
3649         if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
3650             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3651                     sizeof(struct nl80211_sta_flag_update),
3652                     &sinfo->sta_flags))
3653                 goto nla_put_failure;
3654         if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
3655                 nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
3656                             sinfo->t_offset))
3657                 goto nla_put_failure;
3658         nla_nest_end(msg, sinfoattr);
3659
3660         if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
3661             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3662                     sinfo->assoc_req_ies))
3663                 goto nla_put_failure;
3664
3665         return genlmsg_end(msg, hdr);
3666
3667  nla_put_failure:
3668         genlmsg_cancel(msg, hdr);
3669         return -EMSGSIZE;
3670 }
3671
3672 static int nl80211_dump_station(struct sk_buff *skb,
3673                                 struct netlink_callback *cb)
3674 {
3675         struct station_info sinfo;
3676         struct cfg80211_registered_device *rdev;
3677         struct wireless_dev *wdev;
3678         u8 mac_addr[ETH_ALEN];
3679         int sta_idx = cb->args[2];
3680         int err;
3681
3682         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
3683         if (err)
3684                 return err;
3685
3686         if (!wdev->netdev) {
3687                 err = -EINVAL;
3688                 goto out_err;
3689         }
3690
3691         if (!rdev->ops->dump_station) {
3692                 err = -EOPNOTSUPP;
3693                 goto out_err;
3694         }
3695
3696         while (1) {
3697                 memset(&sinfo, 0, sizeof(sinfo));
3698                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
3699                                         mac_addr, &sinfo);
3700                 if (err == -ENOENT)
3701                         break;
3702                 if (err)
3703                         goto out_err;
3704
3705                 if (nl80211_send_station(skb,
3706                                 NETLINK_CB(cb->skb).portid,
3707                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3708                                 rdev, wdev->netdev, mac_addr,
3709                                 &sinfo) < 0)
3710                         goto out;
3711
3712                 sta_idx++;
3713         }
3714
3715
3716  out:
3717         cb->args[2] = sta_idx;
3718         err = skb->len;
3719  out_err:
3720         nl80211_finish_wdev_dump(rdev);
3721
3722         return err;
3723 }
3724
3725 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3726 {
3727         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3728         struct net_device *dev = info->user_ptr[1];
3729         struct station_info sinfo;
3730         struct sk_buff *msg;
3731         u8 *mac_addr = NULL;
3732         int err;
3733
3734         memset(&sinfo, 0, sizeof(sinfo));
3735
3736         if (!info->attrs[NL80211_ATTR_MAC])
3737                 return -EINVAL;
3738
3739         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3740
3741         if (!rdev->ops->get_station)
3742                 return -EOPNOTSUPP;
3743
3744         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3745         if (err)
3746                 return err;
3747
3748         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3749         if (!msg)
3750                 return -ENOMEM;
3751
3752         if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3753                                  rdev, dev, mac_addr, &sinfo) < 0) {
3754                 nlmsg_free(msg);
3755                 return -ENOBUFS;
3756         }
3757
3758         return genlmsg_reply(msg, info);
3759 }
3760
3761 int cfg80211_check_station_change(struct wiphy *wiphy,
3762                                   struct station_parameters *params,
3763                                   enum cfg80211_station_type statype)
3764 {
3765         if (params->listen_interval != -1)
3766                 return -EINVAL;
3767         if (params->aid)
3768                 return -EINVAL;
3769
3770         /* When you run into this, adjust the code below for the new flag */
3771         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
3772
3773         switch (statype) {
3774         case CFG80211_STA_MESH_PEER_KERNEL:
3775         case CFG80211_STA_MESH_PEER_USER:
3776                 /*
3777                  * No ignoring the TDLS flag here -- the userspace mesh
3778                  * code doesn't have the bug of including TDLS in the
3779                  * mask everywhere.
3780                  */
3781                 if (params->sta_flags_mask &
3782                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3783                                   BIT(NL80211_STA_FLAG_MFP) |
3784                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3785                         return -EINVAL;
3786                 break;
3787         case CFG80211_STA_TDLS_PEER_SETUP:
3788         case CFG80211_STA_TDLS_PEER_ACTIVE:
3789                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3790                         return -EINVAL;
3791                 /* ignore since it can't change */
3792                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3793                 break;
3794         default:
3795                 /* disallow mesh-specific things */
3796                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3797                         return -EINVAL;
3798                 if (params->local_pm)
3799                         return -EINVAL;
3800                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3801                         return -EINVAL;
3802         }
3803
3804         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
3805             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
3806                 /* TDLS can't be set, ... */
3807                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3808                         return -EINVAL;
3809                 /*
3810                  * ... but don't bother the driver with it. This works around
3811                  * a hostapd/wpa_supplicant issue -- it always includes the
3812                  * TLDS_PEER flag in the mask even for AP mode.
3813                  */
3814                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3815         }
3816
3817         if (statype != CFG80211_STA_TDLS_PEER_SETUP) {
3818                 /* reject other things that can't change */
3819                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
3820                         return -EINVAL;
3821                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
3822                         return -EINVAL;
3823                 if (params->supported_rates)
3824                         return -EINVAL;
3825                 if (params->ext_capab || params->ht_capa || params->vht_capa)
3826                         return -EINVAL;
3827         }
3828
3829         if (statype != CFG80211_STA_AP_CLIENT) {
3830                 if (params->vlan)
3831                         return -EINVAL;
3832         }
3833
3834         switch (statype) {
3835         case CFG80211_STA_AP_MLME_CLIENT:
3836                 /* Use this only for authorizing/unauthorizing a station */
3837                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
3838                         return -EOPNOTSUPP;
3839                 break;
3840         case CFG80211_STA_AP_CLIENT:
3841                 /* accept only the listed bits */
3842                 if (params->sta_flags_mask &
3843                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3844                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3845                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
3846                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3847                                   BIT(NL80211_STA_FLAG_WME) |
3848                                   BIT(NL80211_STA_FLAG_MFP)))
3849                         return -EINVAL;
3850
3851                 /* but authenticated/associated only if driver handles it */
3852                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
3853                     params->sta_flags_mask &
3854                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3855                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
3856                         return -EINVAL;
3857                 break;
3858         case CFG80211_STA_IBSS:
3859         case CFG80211_STA_AP_STA:
3860                 /* reject any changes other than AUTHORIZED */
3861                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
3862                         return -EINVAL;
3863                 break;
3864         case CFG80211_STA_TDLS_PEER_SETUP:
3865                 /* reject any changes other than AUTHORIZED or WME */
3866                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3867                                                BIT(NL80211_STA_FLAG_WME)))
3868                         return -EINVAL;
3869                 /* force (at least) rates when authorizing */
3870                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
3871                     !params->supported_rates)
3872                         return -EINVAL;
3873                 break;
3874         case CFG80211_STA_TDLS_PEER_ACTIVE:
3875                 /* reject any changes */
3876                 return -EINVAL;
3877         case CFG80211_STA_MESH_PEER_KERNEL:
3878                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3879                         return -EINVAL;
3880                 break;
3881         case CFG80211_STA_MESH_PEER_USER:
3882                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3883                         return -EINVAL;
3884                 break;
3885         }
3886
3887         return 0;
3888 }
3889 EXPORT_SYMBOL(cfg80211_check_station_change);
3890
3891 /*
3892  * Get vlan interface making sure it is running and on the right wiphy.
3893  */
3894 static struct net_device *get_vlan(struct genl_info *info,
3895                                    struct cfg80211_registered_device *rdev)
3896 {
3897         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
3898         struct net_device *v;
3899         int ret;
3900
3901         if (!vlanattr)
3902                 return NULL;
3903
3904         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
3905         if (!v)
3906                 return ERR_PTR(-ENODEV);
3907
3908         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
3909                 ret = -EINVAL;
3910                 goto error;
3911         }
3912
3913         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
3914             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3915             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
3916                 ret = -EINVAL;
3917                 goto error;
3918         }
3919
3920         if (!netif_running(v)) {
3921                 ret = -ENETDOWN;
3922                 goto error;
3923         }
3924
3925         return v;
3926  error:
3927         dev_put(v);
3928         return ERR_PTR(ret);
3929 }
3930
3931 static const struct nla_policy
3932 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
3933         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
3934         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
3935 };
3936
3937 static int nl80211_parse_sta_wme(struct genl_info *info,
3938                                  struct station_parameters *params)
3939 {
3940         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
3941         struct nlattr *nla;
3942         int err;
3943
3944         /* parse WME attributes if present */
3945         if (!info->attrs[NL80211_ATTR_STA_WME])
3946                 return 0;
3947
3948         nla = info->attrs[NL80211_ATTR_STA_WME];
3949         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
3950                                nl80211_sta_wme_policy);
3951         if (err)
3952                 return err;
3953
3954         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
3955                 params->uapsd_queues = nla_get_u8(
3956                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
3957         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
3958                 return -EINVAL;
3959
3960         if (tb[NL80211_STA_WME_MAX_SP])
3961                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
3962
3963         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
3964                 return -EINVAL;
3965
3966         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
3967
3968         return 0;
3969 }
3970
3971 static int nl80211_parse_sta_channel_info(struct genl_info *info,
3972                                       struct station_parameters *params)
3973 {
3974         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
3975                 params->supported_channels =
3976                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
3977                 params->supported_channels_len =
3978                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
3979                 /*
3980                  * Need to include at least one (first channel, number of
3981                  * channels) tuple for each subband, and must have proper
3982                  * tuples for the rest of the data as well.
3983                  */
3984                 if (params->supported_channels_len < 2)
3985                         return -EINVAL;
3986                 if (params->supported_channels_len % 2)
3987                         return -EINVAL;
3988         }
3989
3990         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
3991                 params->supported_oper_classes =
3992                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
3993                 params->supported_oper_classes_len =
3994                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
3995                 /*
3996                  * The value of the Length field of the Supported Operating
3997                  * Classes element is between 2 and 253.
3998                  */
3999                 if (params->supported_oper_classes_len < 2 ||
4000                     params->supported_oper_classes_len > 253)
4001                         return -EINVAL;
4002         }
4003         return 0;
4004 }
4005
4006 static int nl80211_set_station_tdls(struct genl_info *info,
4007                                     struct station_parameters *params)
4008 {
4009         int err;
4010         /* Dummy STA entry gets updated once the peer capabilities are known */
4011         if (info->attrs[NL80211_ATTR_PEER_AID])
4012                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4013         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4014                 params->ht_capa =
4015                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4016         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4017                 params->vht_capa =
4018                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4019
4020         err = nl80211_parse_sta_channel_info(info, params);
4021         if (err)
4022                 return err;
4023
4024         return nl80211_parse_sta_wme(info, params);
4025 }
4026
4027 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
4028 {
4029         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4030         struct net_device *dev = info->user_ptr[1];
4031         struct station_parameters params;
4032         u8 *mac_addr;
4033         int err;
4034
4035         memset(&params, 0, sizeof(params));
4036
4037         params.listen_interval = -1;
4038
4039         if (!rdev->ops->change_station)
4040                 return -EOPNOTSUPP;
4041
4042         if (info->attrs[NL80211_ATTR_STA_AID])
4043                 return -EINVAL;
4044
4045         if (!info->attrs[NL80211_ATTR_MAC])
4046                 return -EINVAL;
4047
4048         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4049
4050         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
4051                 params.supported_rates =
4052                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4053                 params.supported_rates_len =
4054                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4055         }
4056
4057         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4058                 params.capability =
4059                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4060                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4061         }
4062
4063         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4064                 params.ext_capab =
4065                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4066                 params.ext_capab_len =
4067                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4068         }
4069
4070         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4071                 return -EINVAL;
4072
4073         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4074                 return -EINVAL;
4075
4076         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4077                 params.plink_action =
4078                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4079                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4080                         return -EINVAL;
4081         }
4082
4083         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
4084                 params.plink_state =
4085                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
4086                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
4087                         return -EINVAL;
4088                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
4089         }
4090
4091         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
4092                 enum nl80211_mesh_power_mode pm = nla_get_u32(
4093                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
4094
4095                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
4096                     pm > NL80211_MESH_POWER_MAX)
4097                         return -EINVAL;
4098
4099                 params.local_pm = pm;
4100         }
4101
4102         /* Include parameters for TDLS peer (will check later) */
4103         err = nl80211_set_station_tdls(info, &params);
4104         if (err)
4105                 return err;
4106
4107         params.vlan = get_vlan(info, rdev);
4108         if (IS_ERR(params.vlan))
4109                 return PTR_ERR(params.vlan);
4110
4111         switch (dev->ieee80211_ptr->iftype) {
4112         case NL80211_IFTYPE_AP:
4113         case NL80211_IFTYPE_AP_VLAN:
4114         case NL80211_IFTYPE_P2P_GO:
4115         case NL80211_IFTYPE_P2P_CLIENT:
4116         case NL80211_IFTYPE_STATION:
4117         case NL80211_IFTYPE_ADHOC:
4118         case NL80211_IFTYPE_MESH_POINT:
4119                 break;
4120         default:
4121                 err = -EOPNOTSUPP;
4122                 goto out_put_vlan;
4123         }
4124
4125         /* driver will call cfg80211_check_station_change() */
4126         err = rdev_change_station(rdev, dev, mac_addr, &params);
4127
4128  out_put_vlan:
4129         if (params.vlan)
4130                 dev_put(params.vlan);
4131
4132         return err;
4133 }
4134
4135 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
4136 {
4137         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4138         int err;
4139         struct net_device *dev = info->user_ptr[1];
4140         struct station_parameters params;
4141         u8 *mac_addr = NULL;
4142
4143         memset(&params, 0, sizeof(params));
4144
4145         if (!rdev->ops->add_station)
4146                 return -EOPNOTSUPP;
4147
4148         if (!info->attrs[NL80211_ATTR_MAC])
4149                 return -EINVAL;
4150
4151         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4152                 return -EINVAL;
4153
4154         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
4155                 return -EINVAL;
4156
4157         if (!info->attrs[NL80211_ATTR_STA_AID] &&
4158             !info->attrs[NL80211_ATTR_PEER_AID])
4159                 return -EINVAL;
4160
4161         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4162         params.supported_rates =
4163                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4164         params.supported_rates_len =
4165                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4166         params.listen_interval =
4167                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4168
4169         if (info->attrs[NL80211_ATTR_PEER_AID])
4170                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4171         else
4172                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4173         if (!params.aid || params.aid > IEEE80211_MAX_AID)
4174                 return -EINVAL;
4175
4176         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4177                 params.capability =
4178                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4179                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4180         }
4181
4182         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4183                 params.ext_capab =
4184                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4185                 params.ext_capab_len =
4186                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4187         }
4188
4189         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4190                 params.ht_capa =
4191                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4192
4193         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4194                 params.vht_capa =
4195                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4196
4197         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
4198                 params.opmode_notif_used = true;
4199                 params.opmode_notif =
4200                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
4201         }
4202
4203         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4204                 params.plink_action =
4205                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4206                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4207                         return -EINVAL;
4208         }
4209
4210         err = nl80211_parse_sta_channel_info(info, &params);
4211         if (err)
4212                 return err;
4213
4214         err = nl80211_parse_sta_wme(info, &params);
4215         if (err)
4216                 return err;
4217
4218         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4219                 return -EINVAL;
4220
4221         /* When you run into this, adjust the code below for the new flag */
4222         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4223
4224         switch (dev->ieee80211_ptr->iftype) {
4225         case NL80211_IFTYPE_AP:
4226         case NL80211_IFTYPE_AP_VLAN:
4227         case NL80211_IFTYPE_P2P_GO:
4228                 /* ignore WME attributes if iface/sta is not capable */
4229                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
4230                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
4231                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4232
4233                 /* TDLS peers cannot be added */
4234                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4235                     info->attrs[NL80211_ATTR_PEER_AID])
4236                         return -EINVAL;
4237                 /* but don't bother the driver with it */
4238                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4239
4240                 /* allow authenticated/associated only if driver handles it */
4241                 if (!(rdev->wiphy.features &
4242                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4243                     params.sta_flags_mask &
4244                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4245                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4246                         return -EINVAL;
4247
4248                 /* must be last in here for error handling */
4249                 params.vlan = get_vlan(info, rdev);
4250                 if (IS_ERR(params.vlan))
4251                         return PTR_ERR(params.vlan);
4252                 break;
4253         case NL80211_IFTYPE_MESH_POINT:
4254                 /* ignore uAPSD data */
4255                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4256
4257                 /* associated is disallowed */
4258                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
4259                         return -EINVAL;
4260                 /* TDLS peers cannot be added */
4261                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4262                     info->attrs[NL80211_ATTR_PEER_AID])
4263                         return -EINVAL;
4264                 break;
4265         case NL80211_IFTYPE_STATION:
4266         case NL80211_IFTYPE_P2P_CLIENT:
4267                 /* ignore uAPSD data */
4268                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4269
4270                 /* these are disallowed */
4271                 if (params.sta_flags_mask &
4272                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
4273                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4274                         return -EINVAL;
4275                 /* Only TDLS peers can be added */
4276                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4277                         return -EINVAL;
4278                 /* Can only add if TDLS ... */
4279                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
4280                         return -EOPNOTSUPP;
4281                 /* ... with external setup is supported */
4282                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
4283                         return -EOPNOTSUPP;
4284                 /*
4285                  * Older wpa_supplicant versions always mark the TDLS peer
4286                  * as authorized, but it shouldn't yet be.
4287                  */
4288                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4289                 break;
4290         default:
4291                 return -EOPNOTSUPP;
4292         }
4293
4294         /* be aware of params.vlan when changing code here */
4295
4296         err = rdev_add_station(rdev, dev, mac_addr, &params);
4297
4298         if (params.vlan)
4299                 dev_put(params.vlan);
4300         return err;
4301 }
4302
4303 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
4304 {
4305         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4306         struct net_device *dev = info->user_ptr[1];
4307         u8 *mac_addr = NULL;
4308
4309         if (info->attrs[NL80211_ATTR_MAC])
4310                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4311
4312         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4313             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4314             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4315             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4316                 return -EINVAL;
4317
4318         if (!rdev->ops->del_station)
4319                 return -EOPNOTSUPP;
4320
4321         return rdev_del_station(rdev, dev, mac_addr);
4322 }
4323
4324 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4325                                 int flags, struct net_device *dev,
4326                                 u8 *dst, u8 *next_hop,
4327                                 struct mpath_info *pinfo)
4328 {
4329         void *hdr;
4330         struct nlattr *pinfoattr;
4331
4332         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
4333         if (!hdr)
4334                 return -1;
4335
4336         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4337             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
4338             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
4339             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
4340                 goto nla_put_failure;
4341
4342         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
4343         if (!pinfoattr)
4344                 goto nla_put_failure;
4345         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
4346             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
4347                         pinfo->frame_qlen))
4348                 goto nla_put_failure;
4349         if (((pinfo->filled & MPATH_INFO_SN) &&
4350              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
4351             ((pinfo->filled & MPATH_INFO_METRIC) &&
4352              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
4353                          pinfo->metric)) ||
4354             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
4355              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
4356                          pinfo->exptime)) ||
4357             ((pinfo->filled & MPATH_INFO_FLAGS) &&
4358              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
4359                         pinfo->flags)) ||
4360             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
4361              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
4362                          pinfo->discovery_timeout)) ||
4363             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
4364              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
4365                         pinfo->discovery_retries)))
4366                 goto nla_put_failure;
4367
4368         nla_nest_end(msg, pinfoattr);
4369
4370         return genlmsg_end(msg, hdr);
4371
4372  nla_put_failure:
4373         genlmsg_cancel(msg, hdr);
4374         return -EMSGSIZE;
4375 }
4376
4377 static int nl80211_dump_mpath(struct sk_buff *skb,
4378                               struct netlink_callback *cb)
4379 {
4380         struct mpath_info pinfo;
4381         struct cfg80211_registered_device *rdev;
4382         struct wireless_dev *wdev;
4383         u8 dst[ETH_ALEN];
4384         u8 next_hop[ETH_ALEN];
4385         int path_idx = cb->args[2];
4386         int err;
4387
4388         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4389         if (err)
4390                 return err;
4391
4392         if (!rdev->ops->dump_mpath) {
4393                 err = -EOPNOTSUPP;
4394                 goto out_err;
4395         }
4396
4397         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4398                 err = -EOPNOTSUPP;
4399                 goto out_err;
4400         }
4401
4402         while (1) {
4403                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
4404                                       next_hop, &pinfo);
4405                 if (err == -ENOENT)
4406                         break;
4407                 if (err)
4408                         goto out_err;
4409
4410                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4411                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4412                                        wdev->netdev, dst, next_hop,
4413                                        &pinfo) < 0)
4414                         goto out;
4415
4416                 path_idx++;
4417         }
4418
4419
4420  out:
4421         cb->args[2] = path_idx;
4422         err = skb->len;
4423  out_err:
4424         nl80211_finish_wdev_dump(rdev);
4425         return err;
4426 }
4427
4428 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
4429 {
4430         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4431         int err;
4432         struct net_device *dev = info->user_ptr[1];
4433         struct mpath_info pinfo;
4434         struct sk_buff *msg;
4435         u8 *dst = NULL;
4436         u8 next_hop[ETH_ALEN];
4437
4438         memset(&pinfo, 0, sizeof(pinfo));
4439
4440         if (!info->attrs[NL80211_ATTR_MAC])
4441                 return -EINVAL;
4442
4443         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4444
4445         if (!rdev->ops->get_mpath)
4446                 return -EOPNOTSUPP;
4447
4448         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4449                 return -EOPNOTSUPP;
4450
4451         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4452         if (err)
4453                 return err;
4454
4455         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4456         if (!msg)
4457                 return -ENOMEM;
4458
4459         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4460                                  dev, dst, next_hop, &pinfo) < 0) {
4461                 nlmsg_free(msg);
4462                 return -ENOBUFS;
4463         }
4464
4465         return genlmsg_reply(msg, info);
4466 }
4467
4468 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
4469 {
4470         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4471         struct net_device *dev = info->user_ptr[1];
4472         u8 *dst = NULL;
4473         u8 *next_hop = NULL;
4474
4475         if (!info->attrs[NL80211_ATTR_MAC])
4476                 return -EINVAL;
4477
4478         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4479                 return -EINVAL;
4480
4481         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4482         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4483
4484         if (!rdev->ops->change_mpath)
4485                 return -EOPNOTSUPP;
4486
4487         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4488                 return -EOPNOTSUPP;
4489
4490         return rdev_change_mpath(rdev, dev, dst, next_hop);
4491 }
4492
4493 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
4494 {
4495         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4496         struct net_device *dev = info->user_ptr[1];
4497         u8 *dst = NULL;
4498         u8 *next_hop = NULL;
4499
4500         if (!info->attrs[NL80211_ATTR_MAC])
4501                 return -EINVAL;
4502
4503         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4504                 return -EINVAL;
4505
4506         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4507         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4508
4509         if (!rdev->ops->add_mpath)
4510                 return -EOPNOTSUPP;
4511
4512         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4513                 return -EOPNOTSUPP;
4514
4515         return rdev_add_mpath(rdev, dev, dst, next_hop);
4516 }
4517
4518 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
4519 {
4520         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4521         struct net_device *dev = info->user_ptr[1];
4522         u8 *dst = NULL;
4523
4524         if (info->attrs[NL80211_ATTR_MAC])
4525                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4526
4527         if (!rdev->ops->del_mpath)
4528                 return -EOPNOTSUPP;
4529
4530         return rdev_del_mpath(rdev, dev, dst);
4531 }
4532
4533 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
4534 {
4535         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4536         struct net_device *dev = info->user_ptr[1];
4537         struct wireless_dev *wdev = dev->ieee80211_ptr;
4538         struct bss_parameters params;
4539         int err;
4540
4541         memset(&params, 0, sizeof(params));
4542         /* default to not changing parameters */
4543         params.use_cts_prot = -1;
4544         params.use_short_preamble = -1;
4545         params.use_short_slot_time = -1;
4546         params.ap_isolate = -1;
4547         params.ht_opmode = -1;
4548         params.p2p_ctwindow = -1;
4549         params.p2p_opp_ps = -1;
4550
4551         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
4552                 params.use_cts_prot =
4553                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
4554         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
4555                 params.use_short_preamble =
4556                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
4557         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
4558                 params.use_short_slot_time =
4559                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4560         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4561                 params.basic_rates =
4562                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4563                 params.basic_rates_len =
4564                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4565         }
4566         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
4567                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4568         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
4569                 params.ht_opmode =
4570                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4571
4572         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4573                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4574                         return -EINVAL;
4575                 params.p2p_ctwindow =
4576                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4577                 if (params.p2p_ctwindow < 0)
4578                         return -EINVAL;
4579                 if (params.p2p_ctwindow != 0 &&
4580                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4581                         return -EINVAL;
4582         }
4583
4584         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4585                 u8 tmp;
4586
4587                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4588                         return -EINVAL;
4589                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4590                 if (tmp > 1)
4591                         return -EINVAL;
4592                 params.p2p_opp_ps = tmp;
4593                 if (params.p2p_opp_ps &&
4594                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4595                         return -EINVAL;
4596         }
4597
4598         if (!rdev->ops->change_bss)
4599                 return -EOPNOTSUPP;
4600
4601         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4602             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4603                 return -EOPNOTSUPP;
4604
4605         wdev_lock(wdev);
4606         err = rdev_change_bss(rdev, dev, &params);
4607         wdev_unlock(wdev);
4608
4609         return err;
4610 }
4611
4612 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
4613         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
4614         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
4615         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
4616         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
4617         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
4618         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
4619         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
4620 };
4621
4622 static int parse_reg_rule(struct nlattr *tb[],
4623         struct ieee80211_reg_rule *reg_rule)
4624 {
4625         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
4626         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
4627
4628         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
4629                 return -EINVAL;
4630         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
4631                 return -EINVAL;
4632         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
4633                 return -EINVAL;
4634         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
4635                 return -EINVAL;
4636         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
4637                 return -EINVAL;
4638
4639         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
4640
4641         freq_range->start_freq_khz =
4642                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
4643         freq_range->end_freq_khz =
4644                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
4645         freq_range->max_bandwidth_khz =
4646                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
4647
4648         power_rule->max_eirp =
4649                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
4650
4651         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
4652                 power_rule->max_antenna_gain =
4653                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
4654
4655         if (tb[NL80211_ATTR_DFS_CAC_TIME])
4656                 reg_rule->dfs_cac_ms =
4657                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
4658
4659         return 0;
4660 }
4661
4662 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
4663 {
4664         char *data = NULL;
4665         enum nl80211_user_reg_hint_type user_reg_hint_type;
4666
4667         /*
4668          * You should only get this when cfg80211 hasn't yet initialized
4669          * completely when built-in to the kernel right between the time
4670          * window between nl80211_init() and regulatory_init(), if that is
4671          * even possible.
4672          */
4673         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4674                 return -EINPROGRESS;
4675
4676         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
4677                 user_reg_hint_type =
4678                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
4679         else
4680                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
4681
4682         switch (user_reg_hint_type) {
4683         case NL80211_USER_REG_HINT_USER:
4684         case NL80211_USER_REG_HINT_CELL_BASE:
4685                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4686                         return -EINVAL;
4687
4688                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4689                 return regulatory_hint_user(data, user_reg_hint_type);
4690         case NL80211_USER_REG_HINT_INDOOR:
4691                 return regulatory_hint_indoor_user();
4692         default:
4693                 return -EINVAL;
4694         }
4695 }
4696
4697 static int nl80211_get_mesh_config(struct sk_buff *skb,
4698                                    struct genl_info *info)
4699 {
4700         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4701         struct net_device *dev = info->user_ptr[1];
4702         struct wireless_dev *wdev = dev->ieee80211_ptr;
4703         struct mesh_config cur_params;
4704         int err = 0;
4705         void *hdr;
4706         struct nlattr *pinfoattr;
4707         struct sk_buff *msg;
4708
4709         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4710                 return -EOPNOTSUPP;
4711
4712         if (!rdev->ops->get_mesh_config)
4713                 return -EOPNOTSUPP;
4714
4715         wdev_lock(wdev);
4716         /* If not connected, get default parameters */
4717         if (!wdev->mesh_id_len)
4718                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
4719         else
4720                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
4721         wdev_unlock(wdev);
4722
4723         if (err)
4724                 return err;
4725
4726         /* Draw up a netlink message to send back */
4727         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4728         if (!msg)
4729                 return -ENOMEM;
4730         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4731                              NL80211_CMD_GET_MESH_CONFIG);
4732         if (!hdr)
4733                 goto out;
4734         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
4735         if (!pinfoattr)
4736                 goto nla_put_failure;
4737         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4738             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
4739                         cur_params.dot11MeshRetryTimeout) ||
4740             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4741                         cur_params.dot11MeshConfirmTimeout) ||
4742             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
4743                         cur_params.dot11MeshHoldingTimeout) ||
4744             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
4745                         cur_params.dot11MeshMaxPeerLinks) ||
4746             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
4747                        cur_params.dot11MeshMaxRetries) ||
4748             nla_put_u8(msg, NL80211_MESHCONF_TTL,
4749                        cur_params.dot11MeshTTL) ||
4750             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
4751                        cur_params.element_ttl) ||
4752             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4753                        cur_params.auto_open_plinks) ||
4754             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4755                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
4756             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4757                        cur_params.dot11MeshHWMPmaxPREQretries) ||
4758             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
4759                         cur_params.path_refresh_time) ||
4760             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4761                         cur_params.min_discovery_timeout) ||
4762             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4763                         cur_params.dot11MeshHWMPactivePathTimeout) ||
4764             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4765                         cur_params.dot11MeshHWMPpreqMinInterval) ||
4766             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4767                         cur_params.dot11MeshHWMPperrMinInterval) ||
4768             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4769                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
4770             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
4771                        cur_params.dot11MeshHWMPRootMode) ||
4772             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4773                         cur_params.dot11MeshHWMPRannInterval) ||
4774             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4775                        cur_params.dot11MeshGateAnnouncementProtocol) ||
4776             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
4777                        cur_params.dot11MeshForwarding) ||
4778             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
4779                         cur_params.rssi_threshold) ||
4780             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
4781                         cur_params.ht_opmode) ||
4782             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4783                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
4784             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4785                         cur_params.dot11MeshHWMProotInterval) ||
4786             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4787                         cur_params.dot11MeshHWMPconfirmationInterval) ||
4788             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
4789                         cur_params.power_mode) ||
4790             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
4791                         cur_params.dot11MeshAwakeWindowDuration) ||
4792             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
4793                         cur_params.plink_timeout))
4794                 goto nla_put_failure;
4795         nla_nest_end(msg, pinfoattr);
4796         genlmsg_end(msg, hdr);
4797         return genlmsg_reply(msg, info);
4798
4799  nla_put_failure:
4800         genlmsg_cancel(msg, hdr);
4801  out:
4802         nlmsg_free(msg);
4803         return -ENOBUFS;
4804 }
4805
4806 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
4807         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
4808         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
4809         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
4810         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
4811         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
4812         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
4813         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
4814         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
4815         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
4816         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
4817         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
4818         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
4819         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
4820         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
4821         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
4822         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
4823         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
4824         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
4825         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
4826         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
4827         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
4828         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
4829         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
4830         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
4831         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
4832         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
4833         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
4834         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
4835 };
4836
4837 static const struct nla_policy
4838         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
4839         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
4840         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
4841         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
4842         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
4843         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
4844         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
4845         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
4846                                     .len = IEEE80211_MAX_DATA_LEN },
4847         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
4848 };
4849
4850 static int nl80211_parse_mesh_config(struct genl_info *info,
4851                                      struct mesh_config *cfg,
4852                                      u32 *mask_out)
4853 {
4854         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
4855         u32 mask = 0;
4856
4857 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
4858 do {                                                                        \
4859         if (tb[attr]) {                                                     \
4860                 if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
4861                         return -EINVAL;                                     \
4862                 cfg->param = fn(tb[attr]);                                  \
4863                 mask |= (1 << (attr - 1));                                  \
4864         }                                                                   \
4865 } while (0)
4866
4867
4868         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
4869                 return -EINVAL;
4870         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
4871                              info->attrs[NL80211_ATTR_MESH_CONFIG],
4872                              nl80211_meshconf_params_policy))
4873                 return -EINVAL;
4874
4875         /* This makes sure that there aren't more than 32 mesh config
4876          * parameters (otherwise our bitfield scheme would not work.) */
4877         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
4878
4879         /* Fill in the params struct */
4880         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
4881                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
4882                                   nla_get_u16);
4883         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
4884                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4885                                   nla_get_u16);
4886         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
4887                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
4888                                   nla_get_u16);
4889         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
4890                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
4891                                   nla_get_u16);
4892         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
4893                                   mask, NL80211_MESHCONF_MAX_RETRIES,
4894                                   nla_get_u8);
4895         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
4896                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
4897         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
4898                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
4899                                   nla_get_u8);
4900         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
4901                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4902                                   nla_get_u8);
4903         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
4904                                   1, 255, mask,
4905                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4906                                   nla_get_u32);
4907         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
4908                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4909                                   nla_get_u8);
4910         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
4911                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
4912                                   nla_get_u32);
4913         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
4914                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4915                                   nla_get_u16);
4916         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
4917                                   1, 65535, mask,
4918                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4919                                   nla_get_u32);
4920         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
4921                                   1, 65535, mask,
4922                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4923                                   nla_get_u16);
4924         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
4925                                   1, 65535, mask,
4926                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4927                                   nla_get_u16);
4928         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4929                                   dot11MeshHWMPnetDiameterTraversalTime,
4930                                   1, 65535, mask,
4931                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4932                                   nla_get_u16);
4933         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
4934                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
4935                                   nla_get_u8);
4936         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
4937                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4938                                   nla_get_u16);
4939         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4940                                   dot11MeshGateAnnouncementProtocol, 0, 1,
4941                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4942                                   nla_get_u8);
4943         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
4944                                   mask, NL80211_MESHCONF_FORWARDING,
4945                                   nla_get_u8);
4946         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
4947                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
4948                                   nla_get_s32);
4949         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
4950                                   mask, NL80211_MESHCONF_HT_OPMODE,
4951                                   nla_get_u16);
4952         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
4953                                   1, 65535, mask,
4954                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4955                                   nla_get_u32);
4956         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
4957                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4958                                   nla_get_u16);
4959         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4960                                   dot11MeshHWMPconfirmationInterval,
4961                                   1, 65535, mask,
4962                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4963                                   nla_get_u16);
4964         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
4965                                   NL80211_MESH_POWER_ACTIVE,
4966                                   NL80211_MESH_POWER_MAX,
4967                                   mask, NL80211_MESHCONF_POWER_MODE,
4968                                   nla_get_u32);
4969         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
4970                                   0, 65535, mask,
4971                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
4972         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 1, 0xffffffff,
4973                                   mask, NL80211_MESHCONF_PLINK_TIMEOUT,
4974                                   nla_get_u32);
4975         if (mask_out)
4976                 *mask_out = mask;
4977
4978         return 0;
4979
4980 #undef FILL_IN_MESH_PARAM_IF_SET
4981 }
4982
4983 static int nl80211_parse_mesh_setup(struct genl_info *info,
4984                                      struct mesh_setup *setup)
4985 {
4986         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4987         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
4988
4989         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
4990                 return -EINVAL;
4991         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
4992                              info->attrs[NL80211_ATTR_MESH_SETUP],
4993                              nl80211_mesh_setup_params_policy))
4994                 return -EINVAL;
4995
4996         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
4997                 setup->sync_method =
4998                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
4999                  IEEE80211_SYNC_METHOD_VENDOR :
5000                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
5001
5002         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
5003                 setup->path_sel_proto =
5004                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
5005                  IEEE80211_PATH_PROTOCOL_VENDOR :
5006                  IEEE80211_PATH_PROTOCOL_HWMP;
5007
5008         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
5009                 setup->path_metric =
5010                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
5011                  IEEE80211_PATH_METRIC_VENDOR :
5012                  IEEE80211_PATH_METRIC_AIRTIME;
5013
5014
5015         if (tb[NL80211_MESH_SETUP_IE]) {
5016                 struct nlattr *ieattr =
5017                         tb[NL80211_MESH_SETUP_IE];
5018                 if (!is_valid_ie_attr(ieattr))
5019                         return -EINVAL;
5020                 setup->ie = nla_data(ieattr);
5021                 setup->ie_len = nla_len(ieattr);
5022         }
5023         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
5024             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
5025                 return -EINVAL;
5026         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
5027         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
5028         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
5029         if (setup->is_secure)
5030                 setup->user_mpm = true;
5031
5032         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
5033                 if (!setup->user_mpm)
5034                         return -EINVAL;
5035                 setup->auth_id =
5036                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
5037         }
5038
5039         return 0;
5040 }
5041
5042 static int nl80211_update_mesh_config(struct sk_buff *skb,
5043                                       struct genl_info *info)
5044 {
5045         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5046         struct net_device *dev = info->user_ptr[1];
5047         struct wireless_dev *wdev = dev->ieee80211_ptr;
5048         struct mesh_config cfg;
5049         u32 mask;
5050         int err;
5051
5052         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5053                 return -EOPNOTSUPP;
5054
5055         if (!rdev->ops->update_mesh_config)
5056                 return -EOPNOTSUPP;
5057
5058         err = nl80211_parse_mesh_config(info, &cfg, &mask);
5059         if (err)
5060                 return err;
5061
5062         wdev_lock(wdev);
5063         if (!wdev->mesh_id_len)
5064                 err = -ENOLINK;
5065
5066         if (!err)
5067                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
5068
5069         wdev_unlock(wdev);
5070
5071         return err;
5072 }
5073
5074 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
5075 {
5076         const struct ieee80211_regdomain *regdom;
5077         struct sk_buff *msg;
5078         void *hdr = NULL;
5079         struct nlattr *nl_reg_rules;
5080         unsigned int i;
5081
5082         if (!cfg80211_regdomain)
5083                 return -EINVAL;
5084
5085         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5086         if (!msg)
5087                 return -ENOBUFS;
5088
5089         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5090                              NL80211_CMD_GET_REG);
5091         if (!hdr)
5092                 goto put_failure;
5093
5094         if (reg_last_request_cell_base() &&
5095             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
5096                         NL80211_USER_REG_HINT_CELL_BASE))
5097                 goto nla_put_failure;
5098
5099         rcu_read_lock();
5100         regdom = rcu_dereference(cfg80211_regdomain);
5101
5102         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
5103             (regdom->dfs_region &&
5104              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
5105                 goto nla_put_failure_rcu;
5106
5107         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
5108         if (!nl_reg_rules)
5109                 goto nla_put_failure_rcu;
5110
5111         for (i = 0; i < regdom->n_reg_rules; i++) {
5112                 struct nlattr *nl_reg_rule;
5113                 const struct ieee80211_reg_rule *reg_rule;
5114                 const struct ieee80211_freq_range *freq_range;
5115                 const struct ieee80211_power_rule *power_rule;
5116                 unsigned int max_bandwidth_khz;
5117
5118                 reg_rule = &regdom->reg_rules[i];
5119                 freq_range = &reg_rule->freq_range;
5120                 power_rule = &reg_rule->power_rule;
5121
5122                 nl_reg_rule = nla_nest_start(msg, i);
5123                 if (!nl_reg_rule)
5124                         goto nla_put_failure_rcu;
5125
5126                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
5127                 if (!max_bandwidth_khz)
5128                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
5129                                                                   reg_rule);
5130
5131                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
5132                                 reg_rule->flags) ||
5133                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
5134                                 freq_range->start_freq_khz) ||
5135                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
5136                                 freq_range->end_freq_khz) ||
5137                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
5138                                 max_bandwidth_khz) ||
5139                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
5140                                 power_rule->max_antenna_gain) ||
5141                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
5142                                 power_rule->max_eirp) ||
5143                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
5144                                 reg_rule->dfs_cac_ms))
5145                         goto nla_put_failure_rcu;
5146
5147                 nla_nest_end(msg, nl_reg_rule);
5148         }
5149         rcu_read_unlock();
5150
5151         nla_nest_end(msg, nl_reg_rules);
5152
5153         genlmsg_end(msg, hdr);
5154         return genlmsg_reply(msg, info);
5155
5156 nla_put_failure_rcu:
5157         rcu_read_unlock();
5158 nla_put_failure:
5159         genlmsg_cancel(msg, hdr);
5160 put_failure:
5161         nlmsg_free(msg);
5162         return -EMSGSIZE;
5163 }
5164
5165 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
5166 {
5167         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
5168         struct nlattr *nl_reg_rule;
5169         char *alpha2 = NULL;
5170         int rem_reg_rules = 0, r = 0;
5171         u32 num_rules = 0, rule_idx = 0, size_of_regd;
5172         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
5173         struct ieee80211_regdomain *rd = NULL;
5174
5175         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5176                 return -EINVAL;
5177
5178         if (!info->attrs[NL80211_ATTR_REG_RULES])
5179                 return -EINVAL;
5180
5181         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5182
5183         if (info->attrs[NL80211_ATTR_DFS_REGION])
5184                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
5185
5186         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5187                             rem_reg_rules) {
5188                 num_rules++;
5189                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
5190                         return -EINVAL;
5191         }
5192
5193         if (!reg_is_valid_request(alpha2))
5194                 return -EINVAL;
5195
5196         size_of_regd = sizeof(struct ieee80211_regdomain) +
5197                        num_rules * sizeof(struct ieee80211_reg_rule);
5198
5199         rd = kzalloc(size_of_regd, GFP_KERNEL);
5200         if (!rd)
5201                 return -ENOMEM;
5202
5203         rd->n_reg_rules = num_rules;
5204         rd->alpha2[0] = alpha2[0];
5205         rd->alpha2[1] = alpha2[1];
5206
5207         /*
5208          * Disable DFS master mode if the DFS region was
5209          * not supported or known on this kernel.
5210          */
5211         if (reg_supported_dfs_region(dfs_region))
5212                 rd->dfs_region = dfs_region;
5213
5214         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5215                             rem_reg_rules) {
5216                 r = nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
5217                               nla_data(nl_reg_rule), nla_len(nl_reg_rule),
5218                               reg_rule_policy);
5219                 if (r)
5220                         goto bad_reg;
5221                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
5222                 if (r)
5223                         goto bad_reg;
5224
5225                 rule_idx++;
5226
5227                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
5228                         r = -EINVAL;
5229                         goto bad_reg;
5230                 }
5231         }
5232
5233         r = set_regdom(rd);
5234         /* set_regdom took ownership */
5235         rd = NULL;
5236
5237  bad_reg:
5238         kfree(rd);
5239         return r;
5240 }
5241
5242 static int validate_scan_freqs(struct nlattr *freqs)
5243 {
5244         struct nlattr *attr1, *attr2;
5245         int n_channels = 0, tmp1, tmp2;
5246
5247         nla_for_each_nested(attr1, freqs, tmp1) {
5248                 n_channels++;
5249                 /*
5250                  * Some hardware has a limited channel list for
5251                  * scanning, and it is pretty much nonsensical
5252                  * to scan for a channel twice, so disallow that
5253                  * and don't require drivers to check that the
5254                  * channel list they get isn't longer than what
5255                  * they can scan, as long as they can scan all
5256                  * the channels they registered at once.
5257                  */
5258                 nla_for_each_nested(attr2, freqs, tmp2)
5259                         if (attr1 != attr2 &&
5260                             nla_get_u32(attr1) == nla_get_u32(attr2))
5261                                 return 0;
5262         }
5263
5264         return n_channels;
5265 }
5266
5267 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
5268 {
5269         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5270         struct wireless_dev *wdev = info->user_ptr[1];
5271         struct cfg80211_scan_request *request;
5272         struct nlattr *attr;
5273         struct wiphy *wiphy;
5274         int err, tmp, n_ssids = 0, n_channels, i;
5275         size_t ie_len;
5276
5277         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5278                 return -EINVAL;
5279
5280         wiphy = &rdev->wiphy;
5281
5282         if (!rdev->ops->scan)
5283                 return -EOPNOTSUPP;
5284
5285         if (rdev->scan_req || rdev->scan_msg) {
5286                 err = -EBUSY;
5287                 goto unlock;
5288         }
5289
5290         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5291                 n_channels = validate_scan_freqs(
5292                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5293                 if (!n_channels) {
5294                         err = -EINVAL;
5295                         goto unlock;
5296                 }
5297         } else {
5298                 n_channels = ieee80211_get_num_supported_channels(wiphy);
5299         }
5300
5301         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5302                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
5303                         n_ssids++;
5304
5305         if (n_ssids > wiphy->max_scan_ssids) {
5306                 err = -EINVAL;
5307                 goto unlock;
5308         }
5309
5310         if (info->attrs[NL80211_ATTR_IE])
5311                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5312         else
5313                 ie_len = 0;
5314
5315         if (ie_len > wiphy->max_scan_ie_len) {
5316                 err = -EINVAL;
5317                 goto unlock;
5318         }
5319
5320         request = kzalloc(sizeof(*request)
5321                         + sizeof(*request->ssids) * n_ssids
5322                         + sizeof(*request->channels) * n_channels
5323                         + ie_len, GFP_KERNEL);
5324         if (!request) {
5325                 err = -ENOMEM;
5326                 goto unlock;
5327         }
5328
5329         if (n_ssids)
5330                 request->ssids = (void *)&request->channels[n_channels];
5331         request->n_ssids = n_ssids;
5332         if (ie_len) {
5333                 if (request->ssids)
5334                         request->ie = (void *)(request->ssids + n_ssids);
5335                 else
5336                         request->ie = (void *)(request->channels + n_channels);
5337         }
5338
5339         i = 0;
5340         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5341                 /* user specified, bail out if channel not found */
5342                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
5343                         struct ieee80211_channel *chan;
5344
5345                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5346
5347                         if (!chan) {
5348                                 err = -EINVAL;
5349                                 goto out_free;
5350                         }
5351
5352                         /* ignore disabled channels */
5353                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5354                                 continue;
5355
5356                         request->channels[i] = chan;
5357                         i++;
5358                 }
5359         } else {
5360                 enum ieee80211_band band;
5361
5362                 /* all channels */
5363                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5364                         int j;
5365                         if (!wiphy->bands[band])
5366                                 continue;
5367                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5368                                 struct ieee80211_channel *chan;
5369
5370                                 chan = &wiphy->bands[band]->channels[j];
5371
5372                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5373                                         continue;
5374
5375                                 request->channels[i] = chan;
5376                                 i++;
5377                         }
5378                 }
5379         }
5380
5381         if (!i) {
5382                 err = -EINVAL;
5383                 goto out_free;
5384         }
5385
5386         request->n_channels = i;
5387
5388         i = 0;
5389         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5390                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
5391                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5392                                 err = -EINVAL;
5393                                 goto out_free;
5394                         }
5395                         request->ssids[i].ssid_len = nla_len(attr);
5396                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
5397                         i++;
5398                 }
5399         }
5400
5401         if (info->attrs[NL80211_ATTR_IE]) {
5402                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5403                 memcpy((void *)request->ie,
5404                        nla_data(info->attrs[NL80211_ATTR_IE]),
5405                        request->ie_len);
5406         }
5407
5408         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
5409                 if (wiphy->bands[i])
5410                         request->rates[i] =
5411                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
5412
5413         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
5414                 nla_for_each_nested(attr,
5415                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
5416                                     tmp) {
5417                         enum ieee80211_band band = nla_type(attr);
5418
5419                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
5420                                 err = -EINVAL;
5421                                 goto out_free;
5422                         }
5423
5424                         if (!wiphy->bands[band])
5425                                 continue;
5426
5427                         err = ieee80211_get_ratemask(wiphy->bands[band],
5428                                                      nla_data(attr),
5429                                                      nla_len(attr),
5430                                                      &request->rates[band]);
5431                         if (err)
5432                                 goto out_free;
5433                 }
5434         }
5435
5436         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5437                 request->flags = nla_get_u32(
5438                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5439                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5440                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
5441                         err = -EOPNOTSUPP;
5442                         goto out_free;
5443                 }
5444         }
5445
5446         request->no_cck =
5447                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
5448
5449         request->wdev = wdev;
5450         request->wiphy = &rdev->wiphy;
5451         request->scan_start = jiffies;
5452
5453         rdev->scan_req = request;
5454         err = rdev_scan(rdev, request);
5455
5456         if (!err) {
5457                 nl80211_send_scan_start(rdev, wdev);
5458                 if (wdev->netdev)
5459                         dev_hold(wdev->netdev);
5460         } else {
5461  out_free:
5462                 rdev->scan_req = NULL;
5463                 kfree(request);
5464         }
5465
5466  unlock:
5467         return err;
5468 }
5469
5470 static int nl80211_start_sched_scan(struct sk_buff *skb,
5471                                     struct genl_info *info)
5472 {
5473         struct cfg80211_sched_scan_request *request;
5474         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5475         struct net_device *dev = info->user_ptr[1];
5476         struct nlattr *attr;
5477         struct wiphy *wiphy;
5478         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
5479         u32 interval;
5480         enum ieee80211_band band;
5481         size_t ie_len;
5482         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
5483         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
5484
5485         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5486             !rdev->ops->sched_scan_start)
5487                 return -EOPNOTSUPP;
5488
5489         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5490                 return -EINVAL;
5491
5492         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
5493                 return -EINVAL;
5494
5495         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
5496         if (interval == 0)
5497                 return -EINVAL;
5498
5499         wiphy = &rdev->wiphy;
5500
5501         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5502                 n_channels = validate_scan_freqs(
5503                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5504                 if (!n_channels)
5505                         return -EINVAL;
5506         } else {
5507                 n_channels = ieee80211_get_num_supported_channels(wiphy);
5508         }
5509
5510         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5511                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5512                                     tmp)
5513                         n_ssids++;
5514
5515         if (n_ssids > wiphy->max_sched_scan_ssids)
5516                 return -EINVAL;
5517
5518         /*
5519          * First, count the number of 'real' matchsets. Due to an issue with
5520          * the old implementation, matchsets containing only the RSSI attribute
5521          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
5522          * RSSI for all matchsets, rather than their own matchset for reporting
5523          * all APs with a strong RSSI. This is needed to be compatible with
5524          * older userspace that treated a matchset with only the RSSI as the
5525          * global RSSI for all other matchsets - if there are other matchsets.
5526          */
5527         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5528                 nla_for_each_nested(attr,
5529                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5530                                     tmp) {
5531                         struct nlattr *rssi;
5532
5533                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5534                                         nla_data(attr), nla_len(attr),
5535                                         nl80211_match_policy);
5536                         if (err)
5537                                 return err;
5538                         /* add other standalone attributes here */
5539                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]) {
5540                                 n_match_sets++;
5541                                 continue;
5542                         }
5543                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5544                         if (rssi)
5545                                 default_match_rssi = nla_get_s32(rssi);
5546                 }
5547         }
5548
5549         /* However, if there's no other matchset, add the RSSI one */
5550         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
5551                 n_match_sets = 1;
5552
5553         if (n_match_sets > wiphy->max_match_sets)
5554                 return -EINVAL;
5555
5556         if (info->attrs[NL80211_ATTR_IE])
5557                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5558         else
5559                 ie_len = 0;
5560
5561         if (ie_len > wiphy->max_sched_scan_ie_len)
5562                 return -EINVAL;
5563
5564         if (rdev->sched_scan_req) {
5565                 err = -EINPROGRESS;
5566                 goto out;
5567         }
5568
5569         request = kzalloc(sizeof(*request)
5570                         + sizeof(*request->ssids) * n_ssids
5571                         + sizeof(*request->match_sets) * n_match_sets
5572                         + sizeof(*request->channels) * n_channels
5573                         + ie_len, GFP_KERNEL);
5574         if (!request) {
5575                 err = -ENOMEM;
5576                 goto out;
5577         }
5578
5579         if (n_ssids)
5580                 request->ssids = (void *)&request->channels[n_channels];
5581         request->n_ssids = n_ssids;
5582         if (ie_len) {
5583                 if (request->ssids)
5584                         request->ie = (void *)(request->ssids + n_ssids);
5585                 else
5586                         request->ie = (void *)(request->channels + n_channels);
5587         }
5588
5589         if (n_match_sets) {
5590                 if (request->ie)
5591                         request->match_sets = (void *)(request->ie + ie_len);
5592                 else if (request->ssids)
5593                         request->match_sets =
5594                                 (void *)(request->ssids + n_ssids);
5595                 else
5596                         request->match_sets =
5597                                 (void *)(request->channels + n_channels);
5598         }
5599         request->n_match_sets = n_match_sets;
5600
5601         i = 0;
5602         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5603                 /* user specified, bail out if channel not found */
5604                 nla_for_each_nested(attr,
5605                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
5606                                     tmp) {
5607                         struct ieee80211_channel *chan;
5608
5609                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5610
5611                         if (!chan) {
5612                                 err = -EINVAL;
5613                                 goto out_free;
5614                         }
5615
5616                         /* ignore disabled channels */
5617                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5618                                 continue;
5619
5620                         request->channels[i] = chan;
5621                         i++;
5622                 }
5623         } else {
5624                 /* all channels */
5625                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5626                         int j;
5627                         if (!wiphy->bands[band])
5628                                 continue;
5629                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5630                                 struct ieee80211_channel *chan;
5631
5632                                 chan = &wiphy->bands[band]->channels[j];
5633
5634                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5635                                         continue;
5636
5637                                 request->channels[i] = chan;
5638                                 i++;
5639                         }
5640                 }
5641         }
5642
5643         if (!i) {
5644                 err = -EINVAL;
5645                 goto out_free;
5646         }
5647
5648         request->n_channels = i;
5649
5650         i = 0;
5651         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5652                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5653                                     tmp) {
5654                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5655                                 err = -EINVAL;
5656                                 goto out_free;
5657                         }
5658                         request->ssids[i].ssid_len = nla_len(attr);
5659                         memcpy(request->ssids[i].ssid, nla_data(attr),
5660                                nla_len(attr));
5661                         i++;
5662                 }
5663         }
5664
5665         i = 0;
5666         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5667                 nla_for_each_nested(attr,
5668                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5669                                     tmp) {
5670                         struct nlattr *ssid, *rssi;
5671
5672                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5673                                         nla_data(attr), nla_len(attr),
5674                                         nl80211_match_policy);
5675                         if (err)
5676                                 goto out_free;
5677                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
5678                         if (ssid) {
5679                                 if (WARN_ON(i >= n_match_sets)) {
5680                                         /* this indicates a programming error,
5681                                          * the loop above should have verified
5682                                          * things properly
5683                                          */
5684                                         err = -EINVAL;
5685                                         goto out_free;
5686                                 }
5687
5688                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
5689                                         err = -EINVAL;
5690                                         goto out_free;
5691                                 }
5692                                 memcpy(request->match_sets[i].ssid.ssid,
5693                                        nla_data(ssid), nla_len(ssid));
5694                                 request->match_sets[i].ssid.ssid_len =
5695                                         nla_len(ssid);
5696                                 /* special attribute - old implemenation w/a */
5697                                 request->match_sets[i].rssi_thold =
5698                                         default_match_rssi;
5699                                 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5700                                 if (rssi)
5701                                         request->match_sets[i].rssi_thold =
5702                                                 nla_get_s32(rssi);
5703                         }
5704                         i++;
5705                 }
5706
5707                 /* there was no other matchset, so the RSSI one is alone */
5708                 if (i == 0)
5709                         request->match_sets[0].rssi_thold = default_match_rssi;
5710
5711                 request->min_rssi_thold = INT_MAX;
5712                 for (i = 0; i < n_match_sets; i++)
5713                         request->min_rssi_thold =
5714                                 min(request->match_sets[i].rssi_thold,
5715                                     request->min_rssi_thold);
5716         } else {
5717                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
5718         }
5719
5720         if (ie_len) {
5721                 request->ie_len = ie_len;
5722                 memcpy((void *)request->ie,
5723                        nla_data(info->attrs[NL80211_ATTR_IE]),
5724                        request->ie_len);
5725         }
5726
5727         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5728                 request->flags = nla_get_u32(
5729                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5730                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5731                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
5732                         err = -EOPNOTSUPP;
5733                         goto out_free;
5734                 }
5735         }
5736
5737         request->dev = dev;
5738         request->wiphy = &rdev->wiphy;
5739         request->interval = interval;
5740         request->scan_start = jiffies;
5741
5742         err = rdev_sched_scan_start(rdev, dev, request);
5743         if (!err) {
5744                 rdev->sched_scan_req = request;
5745                 nl80211_send_sched_scan(rdev, dev,
5746                                         NL80211_CMD_START_SCHED_SCAN);
5747                 goto out;
5748         }
5749
5750 out_free:
5751         kfree(request);
5752 out:
5753         return err;
5754 }
5755
5756 static int nl80211_stop_sched_scan(struct sk_buff *skb,
5757                                    struct genl_info *info)
5758 {
5759         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5760
5761         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5762             !rdev->ops->sched_scan_stop)
5763                 return -EOPNOTSUPP;
5764
5765         return __cfg80211_stop_sched_scan(rdev, false);
5766 }
5767
5768 static int nl80211_start_radar_detection(struct sk_buff *skb,
5769                                          struct genl_info *info)
5770 {
5771         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5772         struct net_device *dev = info->user_ptr[1];
5773         struct wireless_dev *wdev = dev->ieee80211_ptr;
5774         struct cfg80211_chan_def chandef;
5775         enum nl80211_dfs_regions dfs_region;
5776         unsigned int cac_time_ms;
5777         int err;
5778
5779         dfs_region = reg_get_dfs_region(wdev->wiphy);
5780         if (dfs_region == NL80211_DFS_UNSET)
5781                 return -EINVAL;
5782
5783         err = nl80211_parse_chandef(rdev, info, &chandef);
5784         if (err)
5785                 return err;
5786
5787         if (netif_carrier_ok(dev))
5788                 return -EBUSY;
5789
5790         if (wdev->cac_started)
5791                 return -EBUSY;
5792
5793         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef,
5794                                             NL80211_IFTYPE_UNSPECIFIED);
5795         if (err < 0)
5796                 return err;
5797
5798         if (err == 0)
5799                 return -EINVAL;
5800
5801         if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef))
5802                 return -EINVAL;
5803
5804         if (!rdev->ops->start_radar_detection)
5805                 return -EOPNOTSUPP;
5806
5807         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
5808         if (WARN_ON(!cac_time_ms))
5809                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
5810
5811         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef,
5812                                                cac_time_ms);
5813         if (!err) {
5814                 wdev->chandef = chandef;
5815                 wdev->cac_started = true;
5816                 wdev->cac_start_time = jiffies;
5817                 wdev->cac_time_ms = cac_time_ms;
5818         }
5819         return err;
5820 }
5821
5822 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
5823 {
5824         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5825         struct net_device *dev = info->user_ptr[1];
5826         struct wireless_dev *wdev = dev->ieee80211_ptr;
5827         struct cfg80211_csa_settings params;
5828         /* csa_attrs is defined static to avoid waste of stack size - this
5829          * function is called under RTNL lock, so this should not be a problem.
5830          */
5831         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
5832         u8 radar_detect_width = 0;
5833         int err;
5834         bool need_new_beacon = false;
5835
5836         if (!rdev->ops->channel_switch ||
5837             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
5838                 return -EOPNOTSUPP;
5839
5840         switch (dev->ieee80211_ptr->iftype) {
5841         case NL80211_IFTYPE_AP:
5842         case NL80211_IFTYPE_P2P_GO:
5843                 need_new_beacon = true;
5844
5845                 /* useless if AP is not running */
5846                 if (!wdev->beacon_interval)
5847                         return -ENOTCONN;
5848                 break;
5849         case NL80211_IFTYPE_ADHOC:
5850                 if (!wdev->ssid_len)
5851                         return -ENOTCONN;
5852                 break;
5853         case NL80211_IFTYPE_MESH_POINT:
5854                 if (!wdev->mesh_id_len)
5855                         return -ENOTCONN;
5856                 break;
5857         default:
5858                 return -EOPNOTSUPP;
5859         }
5860
5861         memset(&params, 0, sizeof(params));
5862
5863         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
5864             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
5865                 return -EINVAL;
5866
5867         /* only important for AP, IBSS and mesh create IEs internally */
5868         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
5869                 return -EINVAL;
5870
5871         params.count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
5872
5873         if (!need_new_beacon)
5874                 goto skip_beacons;
5875
5876         err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
5877         if (err)
5878                 return err;
5879
5880         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
5881                                info->attrs[NL80211_ATTR_CSA_IES],
5882                                nl80211_policy);
5883         if (err)
5884                 return err;
5885
5886         err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
5887         if (err)
5888                 return err;
5889
5890         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
5891                 return -EINVAL;
5892
5893         params.counter_offset_beacon =
5894                 nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
5895         if (params.counter_offset_beacon >= params.beacon_csa.tail_len)
5896                 return -EINVAL;
5897
5898         /* sanity check - counters should be the same */
5899         if (params.beacon_csa.tail[params.counter_offset_beacon] !=
5900             params.count)
5901                 return -EINVAL;
5902
5903         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
5904                 params.counter_offset_presp =
5905                         nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
5906                 if (params.counter_offset_presp >=
5907                     params.beacon_csa.probe_resp_len)
5908                         return -EINVAL;
5909
5910                 if (params.beacon_csa.probe_resp[params.counter_offset_presp] !=
5911                     params.count)
5912                         return -EINVAL;
5913         }
5914
5915 skip_beacons:
5916         err = nl80211_parse_chandef(rdev, info, &params.chandef);
5917         if (err)
5918                 return err;
5919
5920         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef,
5921                                      wdev->iftype))
5922                 return -EINVAL;
5923
5924         err = cfg80211_chandef_dfs_required(wdev->wiphy,
5925                                             &params.chandef,
5926                                             wdev->iftype);
5927         if (err < 0)
5928                 return err;
5929
5930         if (err > 0) {
5931                 radar_detect_width = BIT(params.chandef.width);
5932                 params.radar_required = true;
5933         }
5934
5935         /* TODO: I left this here for now.  With channel switch, the
5936          * verification is a bit more complicated, because we only do
5937          * it later when the channel switch really happens.
5938          */
5939         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
5940                                            params.chandef.chan,
5941                                            CHAN_MODE_SHARED,
5942                                            radar_detect_width);
5943         if (err)
5944                 return err;
5945
5946         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
5947                 params.block_tx = true;
5948
5949         wdev_lock(wdev);
5950         err = rdev_channel_switch(rdev, dev, &params);
5951         wdev_unlock(wdev);
5952
5953         return err;
5954 }
5955
5956 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
5957                             u32 seq, int flags,
5958                             struct cfg80211_registered_device *rdev,
5959                             struct wireless_dev *wdev,
5960                             struct cfg80211_internal_bss *intbss)
5961 {
5962         struct cfg80211_bss *res = &intbss->pub;
5963         const struct cfg80211_bss_ies *ies;
5964         void *hdr;
5965         struct nlattr *bss;
5966         bool tsf = false;
5967
5968         ASSERT_WDEV_LOCK(wdev);
5969
5970         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
5971                              NL80211_CMD_NEW_SCAN_RESULTS);
5972         if (!hdr)
5973                 return -1;
5974
5975         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
5976
5977         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
5978                 goto nla_put_failure;
5979         if (wdev->netdev &&
5980             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
5981                 goto nla_put_failure;
5982         if (nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
5983                 goto nla_put_failure;
5984
5985         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
5986         if (!bss)
5987                 goto nla_put_failure;
5988         if ((!is_zero_ether_addr(res->bssid) &&
5989              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
5990                 goto nla_put_failure;
5991
5992         rcu_read_lock();
5993         ies = rcu_dereference(res->ies);
5994         if (ies) {
5995                 if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5996                         goto fail_unlock_rcu;
5997                 tsf = true;
5998                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
5999                                         ies->len, ies->data))
6000                         goto fail_unlock_rcu;
6001         }
6002         ies = rcu_dereference(res->beacon_ies);
6003         if (ies) {
6004                 if (!tsf && nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
6005                         goto fail_unlock_rcu;
6006                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
6007                                         ies->len, ies->data))
6008                         goto fail_unlock_rcu;
6009         }
6010         rcu_read_unlock();
6011
6012         if (res->beacon_interval &&
6013             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
6014                 goto nla_put_failure;
6015         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
6016             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
6017             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
6018             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
6019                         jiffies_to_msecs(jiffies - intbss->ts)))
6020                 goto nla_put_failure;
6021
6022         switch (rdev->wiphy.signal_type) {
6023         case CFG80211_SIGNAL_TYPE_MBM:
6024                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
6025                         goto nla_put_failure;
6026                 break;
6027         case CFG80211_SIGNAL_TYPE_UNSPEC:
6028                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
6029                         goto nla_put_failure;
6030                 break;
6031         default:
6032                 break;
6033         }
6034
6035         switch (wdev->iftype) {
6036         case NL80211_IFTYPE_P2P_CLIENT:
6037         case NL80211_IFTYPE_STATION:
6038                 if (intbss == wdev->current_bss &&
6039                     nla_put_u32(msg, NL80211_BSS_STATUS,
6040                                 NL80211_BSS_STATUS_ASSOCIATED))
6041                         goto nla_put_failure;
6042                 break;
6043         case NL80211_IFTYPE_ADHOC:
6044                 if (intbss == wdev->current_bss &&
6045                     nla_put_u32(msg, NL80211_BSS_STATUS,
6046                                 NL80211_BSS_STATUS_IBSS_JOINED))
6047                         goto nla_put_failure;
6048                 break;
6049         default:
6050                 break;
6051         }
6052
6053         nla_nest_end(msg, bss);
6054
6055         return genlmsg_end(msg, hdr);
6056
6057  fail_unlock_rcu:
6058         rcu_read_unlock();
6059  nla_put_failure:
6060         genlmsg_cancel(msg, hdr);
6061         return -EMSGSIZE;
6062 }
6063
6064 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
6065 {
6066         struct cfg80211_registered_device *rdev;
6067         struct cfg80211_internal_bss *scan;
6068         struct wireless_dev *wdev;
6069         int start = cb->args[2], idx = 0;
6070         int err;
6071
6072         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
6073         if (err)
6074                 return err;
6075
6076         wdev_lock(wdev);
6077         spin_lock_bh(&rdev->bss_lock);
6078         cfg80211_bss_expire(rdev);
6079
6080         cb->seq = rdev->bss_generation;
6081
6082         list_for_each_entry(scan, &rdev->bss_list, list) {
6083                 if (++idx <= start)
6084                         continue;
6085                 if (nl80211_send_bss(skb, cb,
6086                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6087                                 rdev, wdev, scan) < 0) {
6088                         idx--;
6089                         break;
6090                 }
6091         }
6092
6093         spin_unlock_bh(&rdev->bss_lock);
6094         wdev_unlock(wdev);
6095
6096         cb->args[2] = idx;
6097         nl80211_finish_wdev_dump(rdev);
6098
6099         return skb->len;
6100 }
6101
6102 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
6103                                 int flags, struct net_device *dev,
6104                                 struct survey_info *survey)
6105 {
6106         void *hdr;
6107         struct nlattr *infoattr;
6108
6109         hdr = nl80211hdr_put(msg, portid, seq, flags,
6110                              NL80211_CMD_NEW_SURVEY_RESULTS);
6111         if (!hdr)
6112                 return -ENOMEM;
6113
6114         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
6115                 goto nla_put_failure;
6116
6117         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
6118         if (!infoattr)
6119                 goto nla_put_failure;
6120
6121         if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
6122                         survey->channel->center_freq))
6123                 goto nla_put_failure;
6124
6125         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
6126             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
6127                 goto nla_put_failure;
6128         if ((survey->filled & SURVEY_INFO_IN_USE) &&
6129             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
6130                 goto nla_put_failure;
6131         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
6132             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
6133                         survey->channel_time))
6134                 goto nla_put_failure;
6135         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
6136             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
6137                         survey->channel_time_busy))
6138                 goto nla_put_failure;
6139         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
6140             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
6141                         survey->channel_time_ext_busy))
6142                 goto nla_put_failure;
6143         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
6144             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
6145                         survey->channel_time_rx))
6146                 goto nla_put_failure;
6147         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
6148             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
6149                         survey->channel_time_tx))
6150                 goto nla_put_failure;
6151
6152         nla_nest_end(msg, infoattr);
6153
6154         return genlmsg_end(msg, hdr);
6155
6156  nla_put_failure:
6157         genlmsg_cancel(msg, hdr);
6158         return -EMSGSIZE;
6159 }
6160
6161 static int nl80211_dump_survey(struct sk_buff *skb,
6162                         struct netlink_callback *cb)
6163 {
6164         struct survey_info survey;
6165         struct cfg80211_registered_device *rdev;
6166         struct wireless_dev *wdev;
6167         int survey_idx = cb->args[2];
6168         int res;
6169
6170         res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
6171         if (res)
6172                 return res;
6173
6174         if (!wdev->netdev) {
6175                 res = -EINVAL;
6176                 goto out_err;
6177         }
6178
6179         if (!rdev->ops->dump_survey) {
6180                 res = -EOPNOTSUPP;
6181                 goto out_err;
6182         }
6183
6184         while (1) {
6185                 struct ieee80211_channel *chan;
6186
6187                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
6188                 if (res == -ENOENT)
6189                         break;
6190                 if (res)
6191                         goto out_err;
6192
6193                 /* Survey without a channel doesn't make sense */
6194                 if (!survey.channel) {
6195                         res = -EINVAL;
6196                         goto out;
6197                 }
6198
6199                 chan = ieee80211_get_channel(&rdev->wiphy,
6200                                              survey.channel->center_freq);
6201                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
6202                         survey_idx++;
6203                         continue;
6204                 }
6205
6206                 if (nl80211_send_survey(skb,
6207                                 NETLINK_CB(cb->skb).portid,
6208                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6209                                 wdev->netdev, &survey) < 0)
6210                         goto out;
6211                 survey_idx++;
6212         }
6213
6214  out:
6215         cb->args[2] = survey_idx;
6216         res = skb->len;
6217  out_err:
6218         nl80211_finish_wdev_dump(rdev);
6219         return res;
6220 }
6221
6222 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
6223 {
6224         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
6225                                   NL80211_WPA_VERSION_2));
6226 }
6227
6228 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
6229 {
6230         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6231         struct net_device *dev = info->user_ptr[1];
6232         struct ieee80211_channel *chan;
6233         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
6234         int err, ssid_len, ie_len = 0, sae_data_len = 0;
6235         enum nl80211_auth_type auth_type;
6236         struct key_parse key;
6237         bool local_state_change;
6238
6239         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6240                 return -EINVAL;
6241
6242         if (!info->attrs[NL80211_ATTR_MAC])
6243                 return -EINVAL;
6244
6245         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
6246                 return -EINVAL;
6247
6248         if (!info->attrs[NL80211_ATTR_SSID])
6249                 return -EINVAL;
6250
6251         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
6252                 return -EINVAL;
6253
6254         err = nl80211_parse_key(info, &key);
6255         if (err)
6256                 return err;
6257
6258         if (key.idx >= 0) {
6259                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
6260                         return -EINVAL;
6261                 if (!key.p.key || !key.p.key_len)
6262                         return -EINVAL;
6263                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
6264                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
6265                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
6266                      key.p.key_len != WLAN_KEY_LEN_WEP104))
6267                         return -EINVAL;
6268                 if (key.idx > 4)
6269                         return -EINVAL;
6270         } else {
6271                 key.p.key_len = 0;
6272                 key.p.key = NULL;
6273         }
6274
6275         if (key.idx >= 0) {
6276                 int i;
6277                 bool ok = false;
6278                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
6279                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
6280                                 ok = true;
6281                                 break;
6282                         }
6283                 }
6284                 if (!ok)
6285                         return -EINVAL;
6286         }
6287
6288         if (!rdev->ops->auth)
6289                 return -EOPNOTSUPP;
6290
6291         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6292             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6293                 return -EOPNOTSUPP;
6294
6295         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6296         chan = nl80211_get_valid_chan(&rdev->wiphy,
6297                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
6298         if (!chan)
6299                 return -EINVAL;
6300
6301         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6302         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6303
6304         if (info->attrs[NL80211_ATTR_IE]) {
6305                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6306                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6307         }
6308
6309         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6310         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
6311                 return -EINVAL;
6312
6313         if (auth_type == NL80211_AUTHTYPE_SAE &&
6314             !info->attrs[NL80211_ATTR_SAE_DATA])
6315                 return -EINVAL;
6316
6317         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
6318                 if (auth_type != NL80211_AUTHTYPE_SAE)
6319                         return -EINVAL;
6320                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
6321                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
6322                 /* need to include at least Auth Transaction and Status Code */
6323                 if (sae_data_len < 4)
6324                         return -EINVAL;
6325         }
6326
6327         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6328
6329         /*
6330          * Since we no longer track auth state, ignore
6331          * requests to only change local state.
6332          */
6333         if (local_state_change)
6334                 return 0;
6335
6336         wdev_lock(dev->ieee80211_ptr);
6337         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
6338                                  ssid, ssid_len, ie, ie_len,
6339                                  key.p.key, key.p.key_len, key.idx,
6340                                  sae_data, sae_data_len);
6341         wdev_unlock(dev->ieee80211_ptr);
6342         return err;
6343 }
6344
6345 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
6346                                    struct genl_info *info,
6347                                    struct cfg80211_crypto_settings *settings,
6348                                    int cipher_limit)
6349 {
6350         memset(settings, 0, sizeof(*settings));
6351
6352         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
6353
6354         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
6355                 u16 proto;
6356                 proto = nla_get_u16(
6357                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
6358                 settings->control_port_ethertype = cpu_to_be16(proto);
6359                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
6360                     proto != ETH_P_PAE)
6361                         return -EINVAL;
6362                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
6363                         settings->control_port_no_encrypt = true;
6364         } else
6365                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
6366
6367         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
6368                 void *data;
6369                 int len, i;
6370
6371                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6372                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6373                 settings->n_ciphers_pairwise = len / sizeof(u32);
6374
6375                 if (len % sizeof(u32))
6376                         return -EINVAL;
6377
6378                 if (settings->n_ciphers_pairwise > cipher_limit)
6379                         return -EINVAL;
6380
6381                 memcpy(settings->ciphers_pairwise, data, len);
6382
6383                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
6384                         if (!cfg80211_supported_cipher_suite(
6385                                         &rdev->wiphy,
6386                                         settings->ciphers_pairwise[i]))
6387                                 return -EINVAL;
6388         }
6389
6390         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
6391                 settings->cipher_group =
6392                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
6393                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
6394                                                      settings->cipher_group))
6395                         return -EINVAL;
6396         }
6397
6398         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
6399                 settings->wpa_versions =
6400                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
6401                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
6402                         return -EINVAL;
6403         }
6404
6405         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
6406                 void *data;
6407                 int len;
6408
6409                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
6410                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
6411                 settings->n_akm_suites = len / sizeof(u32);
6412
6413                 if (len % sizeof(u32))
6414                         return -EINVAL;
6415
6416                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
6417                         return -EINVAL;
6418
6419                 memcpy(settings->akm_suites, data, len);
6420         }
6421
6422         return 0;
6423 }
6424
6425 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
6426 {
6427         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6428         struct net_device *dev = info->user_ptr[1];
6429         struct ieee80211_channel *chan;
6430         struct cfg80211_assoc_request req = {};
6431         const u8 *bssid, *ssid;
6432         int err, ssid_len = 0;
6433
6434         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6435                 return -EINVAL;
6436
6437         if (!info->attrs[NL80211_ATTR_MAC] ||
6438             !info->attrs[NL80211_ATTR_SSID] ||
6439             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
6440                 return -EINVAL;
6441
6442         if (!rdev->ops->assoc)
6443                 return -EOPNOTSUPP;
6444
6445         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6446             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6447                 return -EOPNOTSUPP;
6448
6449         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6450
6451         chan = nl80211_get_valid_chan(&rdev->wiphy,
6452                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
6453         if (!chan)
6454                 return -EINVAL;
6455
6456         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6457         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6458
6459         if (info->attrs[NL80211_ATTR_IE]) {
6460                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6461                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6462         }
6463
6464         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6465                 enum nl80211_mfp mfp =
6466                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6467                 if (mfp == NL80211_MFP_REQUIRED)
6468                         req.use_mfp = true;
6469                 else if (mfp != NL80211_MFP_NO)
6470                         return -EINVAL;
6471         }
6472
6473         if (info->attrs[NL80211_ATTR_PREV_BSSID])
6474                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
6475
6476         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6477                 req.flags |= ASSOC_REQ_DISABLE_HT;
6478
6479         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6480                 memcpy(&req.ht_capa_mask,
6481                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6482                        sizeof(req.ht_capa_mask));
6483
6484         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6485                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6486                         return -EINVAL;
6487                 memcpy(&req.ht_capa,
6488                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6489                        sizeof(req.ht_capa));
6490         }
6491
6492         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
6493                 req.flags |= ASSOC_REQ_DISABLE_VHT;
6494
6495         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6496                 memcpy(&req.vht_capa_mask,
6497                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
6498                        sizeof(req.vht_capa_mask));
6499
6500         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
6501                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6502                         return -EINVAL;
6503                 memcpy(&req.vht_capa,
6504                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
6505                        sizeof(req.vht_capa));
6506         }
6507
6508         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
6509         if (!err) {
6510                 wdev_lock(dev->ieee80211_ptr);
6511                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
6512                                           ssid, ssid_len, &req);
6513                 wdev_unlock(dev->ieee80211_ptr);
6514         }
6515
6516         return err;
6517 }
6518
6519 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
6520 {
6521         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6522         struct net_device *dev = info->user_ptr[1];
6523         const u8 *ie = NULL, *bssid;
6524         int ie_len = 0, err;
6525         u16 reason_code;
6526         bool local_state_change;
6527
6528         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6529                 return -EINVAL;
6530
6531         if (!info->attrs[NL80211_ATTR_MAC])
6532                 return -EINVAL;
6533
6534         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6535                 return -EINVAL;
6536
6537         if (!rdev->ops->deauth)
6538                 return -EOPNOTSUPP;
6539
6540         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6541             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6542                 return -EOPNOTSUPP;
6543
6544         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6545
6546         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6547         if (reason_code == 0) {
6548                 /* Reason Code 0 is reserved */
6549                 return -EINVAL;
6550         }
6551
6552         if (info->attrs[NL80211_ATTR_IE]) {
6553                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6554                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6555         }
6556
6557         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6558
6559         wdev_lock(dev->ieee80211_ptr);
6560         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
6561                                    local_state_change);
6562         wdev_unlock(dev->ieee80211_ptr);
6563         return err;
6564 }
6565
6566 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
6567 {
6568         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6569         struct net_device *dev = info->user_ptr[1];
6570         const u8 *ie = NULL, *bssid;
6571         int ie_len = 0, err;
6572         u16 reason_code;
6573         bool local_state_change;
6574
6575         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6576                 return -EINVAL;
6577
6578         if (!info->attrs[NL80211_ATTR_MAC])
6579                 return -EINVAL;
6580
6581         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6582                 return -EINVAL;
6583
6584         if (!rdev->ops->disassoc)
6585                 return -EOPNOTSUPP;
6586
6587         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6588             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6589                 return -EOPNOTSUPP;
6590
6591         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6592
6593         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6594         if (reason_code == 0) {
6595                 /* Reason Code 0 is reserved */
6596                 return -EINVAL;
6597         }
6598
6599         if (info->attrs[NL80211_ATTR_IE]) {
6600                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6601                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6602         }
6603
6604         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6605
6606         wdev_lock(dev->ieee80211_ptr);
6607         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
6608                                      local_state_change);
6609         wdev_unlock(dev->ieee80211_ptr);
6610         return err;
6611 }
6612
6613 static bool
6614 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
6615                          int mcast_rate[IEEE80211_NUM_BANDS],
6616                          int rateval)
6617 {
6618         struct wiphy *wiphy = &rdev->wiphy;
6619         bool found = false;
6620         int band, i;
6621
6622         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
6623                 struct ieee80211_supported_band *sband;
6624
6625                 sband = wiphy->bands[band];
6626                 if (!sband)
6627                         continue;
6628
6629                 for (i = 0; i < sband->n_bitrates; i++) {
6630                         if (sband->bitrates[i].bitrate == rateval) {
6631                                 mcast_rate[band] = i + 1;
6632                                 found = true;
6633                                 break;
6634                         }
6635                 }
6636         }
6637
6638         return found;
6639 }
6640
6641 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
6642 {
6643         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6644         struct net_device *dev = info->user_ptr[1];
6645         struct cfg80211_ibss_params ibss;
6646         struct wiphy *wiphy;
6647         struct cfg80211_cached_keys *connkeys = NULL;
6648         int err;
6649
6650         memset(&ibss, 0, sizeof(ibss));
6651
6652         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6653                 return -EINVAL;
6654
6655         if (!info->attrs[NL80211_ATTR_SSID] ||
6656             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6657                 return -EINVAL;
6658
6659         ibss.beacon_interval = 100;
6660
6661         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
6662                 ibss.beacon_interval =
6663                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
6664                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
6665                         return -EINVAL;
6666         }
6667
6668         if (!rdev->ops->join_ibss)
6669                 return -EOPNOTSUPP;
6670
6671         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6672                 return -EOPNOTSUPP;
6673
6674         wiphy = &rdev->wiphy;
6675
6676         if (info->attrs[NL80211_ATTR_MAC]) {
6677                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6678
6679                 if (!is_valid_ether_addr(ibss.bssid))
6680                         return -EINVAL;
6681         }
6682         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6683         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6684
6685         if (info->attrs[NL80211_ATTR_IE]) {
6686                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6687                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6688         }
6689
6690         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
6691         if (err)
6692                 return err;
6693
6694         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
6695                                      NL80211_IFTYPE_ADHOC))
6696                 return -EINVAL;
6697
6698         switch (ibss.chandef.width) {
6699         case NL80211_CHAN_WIDTH_5:
6700         case NL80211_CHAN_WIDTH_10:
6701         case NL80211_CHAN_WIDTH_20_NOHT:
6702                 break;
6703         case NL80211_CHAN_WIDTH_20:
6704         case NL80211_CHAN_WIDTH_40:
6705                 if (rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)
6706                         break;
6707         default:
6708                 return -EINVAL;
6709         }
6710
6711         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
6712         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
6713
6714         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
6715                 u8 *rates =
6716                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6717                 int n_rates =
6718                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6719                 struct ieee80211_supported_band *sband =
6720                         wiphy->bands[ibss.chandef.chan->band];
6721
6722                 err = ieee80211_get_ratemask(sband, rates, n_rates,
6723                                              &ibss.basic_rates);
6724                 if (err)
6725                         return err;
6726         }
6727
6728         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6729                 memcpy(&ibss.ht_capa_mask,
6730                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6731                        sizeof(ibss.ht_capa_mask));
6732
6733         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6734                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6735                         return -EINVAL;
6736                 memcpy(&ibss.ht_capa,
6737                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6738                        sizeof(ibss.ht_capa));
6739         }
6740
6741         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
6742             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
6743                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
6744                 return -EINVAL;
6745
6746         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6747                 bool no_ht = false;
6748
6749                 connkeys = nl80211_parse_connkeys(rdev,
6750                                           info->attrs[NL80211_ATTR_KEYS],
6751                                           &no_ht);
6752                 if (IS_ERR(connkeys))
6753                         return PTR_ERR(connkeys);
6754
6755                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
6756                     no_ht) {
6757                         kfree(connkeys);
6758                         return -EINVAL;
6759                 }
6760         }
6761
6762         ibss.control_port =
6763                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
6764
6765         ibss.userspace_handles_dfs =
6766                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
6767
6768         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
6769         if (err)
6770                 kfree(connkeys);
6771         return err;
6772 }
6773
6774 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
6775 {
6776         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6777         struct net_device *dev = info->user_ptr[1];
6778
6779         if (!rdev->ops->leave_ibss)
6780                 return -EOPNOTSUPP;
6781
6782         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6783                 return -EOPNOTSUPP;
6784
6785         return cfg80211_leave_ibss(rdev, dev, false);
6786 }
6787
6788 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
6789 {
6790         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6791         struct net_device *dev = info->user_ptr[1];
6792         int mcast_rate[IEEE80211_NUM_BANDS];
6793         u32 nla_rate;
6794         int err;
6795
6796         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
6797             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6798                 return -EOPNOTSUPP;
6799
6800         if (!rdev->ops->set_mcast_rate)
6801                 return -EOPNOTSUPP;
6802
6803         memset(mcast_rate, 0, sizeof(mcast_rate));
6804
6805         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
6806                 return -EINVAL;
6807
6808         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
6809         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
6810                 return -EINVAL;
6811
6812         err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
6813
6814         return err;
6815 }
6816
6817 static struct sk_buff *
6818 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
6819                             int approxlen, u32 portid, u32 seq,
6820                             enum nl80211_commands cmd,
6821                             enum nl80211_attrs attr,
6822                             const struct nl80211_vendor_cmd_info *info,
6823                             gfp_t gfp)
6824 {
6825         struct sk_buff *skb;
6826         void *hdr;
6827         struct nlattr *data;
6828
6829         skb = nlmsg_new(approxlen + 100, gfp);
6830         if (!skb)
6831                 return NULL;
6832
6833         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
6834         if (!hdr) {
6835                 kfree_skb(skb);
6836                 return NULL;
6837         }
6838
6839         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
6840                 goto nla_put_failure;
6841
6842         if (info) {
6843                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
6844                                 info->vendor_id))
6845                         goto nla_put_failure;
6846                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
6847                                 info->subcmd))
6848                         goto nla_put_failure;
6849         }
6850
6851         data = nla_nest_start(skb, attr);
6852
6853         ((void **)skb->cb)[0] = rdev;
6854         ((void **)skb->cb)[1] = hdr;
6855         ((void **)skb->cb)[2] = data;
6856
6857         return skb;
6858
6859  nla_put_failure:
6860         kfree_skb(skb);
6861         return NULL;
6862 }
6863
6864 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
6865                                            enum nl80211_commands cmd,
6866                                            enum nl80211_attrs attr,
6867                                            int vendor_event_idx,
6868                                            int approxlen, gfp_t gfp)
6869 {
6870         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
6871         const struct nl80211_vendor_cmd_info *info;
6872
6873         switch (cmd) {
6874         case NL80211_CMD_TESTMODE:
6875                 if (WARN_ON(vendor_event_idx != -1))
6876                         return NULL;
6877                 info = NULL;
6878                 break;
6879         case NL80211_CMD_VENDOR:
6880                 if (WARN_ON(vendor_event_idx < 0 ||
6881                             vendor_event_idx >= wiphy->n_vendor_events))
6882                         return NULL;
6883                 info = &wiphy->vendor_events[vendor_event_idx];
6884                 break;
6885         default:
6886                 WARN_ON(1);
6887                 return NULL;
6888         }
6889
6890         return __cfg80211_alloc_vendor_skb(rdev, approxlen, 0, 0,
6891                                            cmd, attr, info, gfp);
6892 }
6893 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
6894
6895 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
6896 {
6897         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
6898         void *hdr = ((void **)skb->cb)[1];
6899         struct nlattr *data = ((void **)skb->cb)[2];
6900         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
6901
6902         nla_nest_end(skb, data);
6903         genlmsg_end(skb, hdr);
6904
6905         if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
6906                 mcgrp = NL80211_MCGRP_VENDOR;
6907
6908         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
6909                                 mcgrp, gfp);
6910 }
6911 EXPORT_SYMBOL(__cfg80211_send_event_skb);
6912
6913 #ifdef CONFIG_NL80211_TESTMODE
6914 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
6915 {
6916         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6917         struct wireless_dev *wdev =
6918                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
6919         int err;
6920
6921         if (!rdev->ops->testmode_cmd)
6922                 return -EOPNOTSUPP;
6923
6924         if (IS_ERR(wdev)) {
6925                 err = PTR_ERR(wdev);
6926                 if (err != -EINVAL)
6927                         return err;
6928                 wdev = NULL;
6929         } else if (wdev->wiphy != &rdev->wiphy) {
6930                 return -EINVAL;
6931         }
6932
6933         if (!info->attrs[NL80211_ATTR_TESTDATA])
6934                 return -EINVAL;
6935
6936         rdev->cur_cmd_info = info;
6937         err = rdev_testmode_cmd(rdev, wdev,
6938                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
6939                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
6940         rdev->cur_cmd_info = NULL;
6941
6942         return err;
6943 }
6944
6945 static int nl80211_testmode_dump(struct sk_buff *skb,
6946                                  struct netlink_callback *cb)
6947 {
6948         struct cfg80211_registered_device *rdev;
6949         int err;
6950         long phy_idx;
6951         void *data = NULL;
6952         int data_len = 0;
6953
6954         rtnl_lock();
6955
6956         if (cb->args[0]) {
6957                 /*
6958                  * 0 is a valid index, but not valid for args[0],
6959                  * so we need to offset by 1.
6960                  */
6961                 phy_idx = cb->args[0] - 1;
6962         } else {
6963                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
6964                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
6965                                   nl80211_policy);
6966                 if (err)
6967                         goto out_err;
6968
6969                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
6970                                                   nl80211_fam.attrbuf);
6971                 if (IS_ERR(rdev)) {
6972                         err = PTR_ERR(rdev);
6973                         goto out_err;
6974                 }
6975                 phy_idx = rdev->wiphy_idx;
6976                 rdev = NULL;
6977
6978                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
6979                         cb->args[1] =
6980                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
6981         }
6982
6983         if (cb->args[1]) {
6984                 data = nla_data((void *)cb->args[1]);
6985                 data_len = nla_len((void *)cb->args[1]);
6986         }
6987
6988         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
6989         if (!rdev) {
6990                 err = -ENOENT;
6991                 goto out_err;
6992         }
6993
6994         if (!rdev->ops->testmode_dump) {
6995                 err = -EOPNOTSUPP;
6996                 goto out_err;
6997         }
6998
6999         while (1) {
7000                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
7001                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
7002                                            NL80211_CMD_TESTMODE);
7003                 struct nlattr *tmdata;
7004
7005                 if (!hdr)
7006                         break;
7007
7008                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
7009                         genlmsg_cancel(skb, hdr);
7010                         break;
7011                 }
7012
7013                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
7014                 if (!tmdata) {
7015                         genlmsg_cancel(skb, hdr);
7016                         break;
7017                 }
7018                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
7019                 nla_nest_end(skb, tmdata);
7020
7021                 if (err == -ENOBUFS || err == -ENOENT) {
7022                         genlmsg_cancel(skb, hdr);
7023                         break;
7024                 } else if (err) {
7025                         genlmsg_cancel(skb, hdr);
7026                         goto out_err;
7027                 }
7028
7029                 genlmsg_end(skb, hdr);
7030         }
7031
7032         err = skb->len;
7033         /* see above */
7034         cb->args[0] = phy_idx + 1;
7035  out_err:
7036         rtnl_unlock();
7037         return err;
7038 }
7039 #endif
7040
7041 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
7042 {
7043         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7044         struct net_device *dev = info->user_ptr[1];
7045         struct cfg80211_connect_params connect;
7046         struct wiphy *wiphy;
7047         struct cfg80211_cached_keys *connkeys = NULL;
7048         int err;
7049
7050         memset(&connect, 0, sizeof(connect));
7051
7052         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7053                 return -EINVAL;
7054
7055         if (!info->attrs[NL80211_ATTR_SSID] ||
7056             !nla_len(info->attrs[NL80211_ATTR_SSID]))
7057                 return -EINVAL;
7058
7059         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
7060                 connect.auth_type =
7061                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
7062                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
7063                                              NL80211_CMD_CONNECT))
7064                         return -EINVAL;
7065         } else
7066                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
7067
7068         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
7069
7070         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
7071                                       NL80211_MAX_NR_CIPHER_SUITES);
7072         if (err)
7073                 return err;
7074
7075         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7076             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7077                 return -EOPNOTSUPP;
7078
7079         wiphy = &rdev->wiphy;
7080
7081         connect.bg_scan_period = -1;
7082         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
7083                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
7084                 connect.bg_scan_period =
7085                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
7086         }
7087
7088         if (info->attrs[NL80211_ATTR_MAC])
7089                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7090         else if (info->attrs[NL80211_ATTR_MAC_HINT])
7091                 connect.bssid_hint =
7092                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
7093         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7094         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7095
7096         if (info->attrs[NL80211_ATTR_IE]) {
7097                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7098                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7099         }
7100
7101         if (info->attrs[NL80211_ATTR_USE_MFP]) {
7102                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
7103                 if (connect.mfp != NL80211_MFP_REQUIRED &&
7104                     connect.mfp != NL80211_MFP_NO)
7105                         return -EINVAL;
7106         } else {
7107                 connect.mfp = NL80211_MFP_NO;
7108         }
7109
7110         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7111                 connect.channel = nl80211_get_valid_chan(
7112                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7113                 if (!connect.channel)
7114                         return -EINVAL;
7115         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
7116                 connect.channel_hint = nl80211_get_valid_chan(
7117                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
7118                 if (!connect.channel_hint)
7119                         return -EINVAL;
7120         }
7121
7122         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
7123                 connkeys = nl80211_parse_connkeys(rdev,
7124                                           info->attrs[NL80211_ATTR_KEYS], NULL);
7125                 if (IS_ERR(connkeys))
7126                         return PTR_ERR(connkeys);
7127         }
7128
7129         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
7130                 connect.flags |= ASSOC_REQ_DISABLE_HT;
7131
7132         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7133                 memcpy(&connect.ht_capa_mask,
7134                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7135                        sizeof(connect.ht_capa_mask));
7136
7137         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7138                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
7139                         kfree(connkeys);
7140                         return -EINVAL;
7141                 }
7142                 memcpy(&connect.ht_capa,
7143                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7144                        sizeof(connect.ht_capa));
7145         }
7146
7147         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
7148                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
7149
7150         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7151                 memcpy(&connect.vht_capa_mask,
7152                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
7153                        sizeof(connect.vht_capa_mask));
7154
7155         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
7156                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
7157                         kfree(connkeys);
7158                         return -EINVAL;
7159                 }
7160                 memcpy(&connect.vht_capa,
7161                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
7162                        sizeof(connect.vht_capa));
7163         }
7164
7165         wdev_lock(dev->ieee80211_ptr);
7166         err = cfg80211_connect(rdev, dev, &connect, connkeys, NULL);
7167         wdev_unlock(dev->ieee80211_ptr);
7168         if (err)
7169                 kfree(connkeys);
7170         return err;
7171 }
7172
7173 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
7174 {
7175         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7176         struct net_device *dev = info->user_ptr[1];
7177         u16 reason;
7178         int ret;
7179
7180         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7181                 reason = WLAN_REASON_DEAUTH_LEAVING;
7182         else
7183                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7184
7185         if (reason == 0)
7186                 return -EINVAL;
7187
7188         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7189             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7190                 return -EOPNOTSUPP;
7191
7192         wdev_lock(dev->ieee80211_ptr);
7193         ret = cfg80211_disconnect(rdev, dev, reason, true);
7194         wdev_unlock(dev->ieee80211_ptr);
7195         return ret;
7196 }
7197
7198 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
7199 {
7200         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7201         struct net *net;
7202         int err;
7203         u32 pid;
7204
7205         if (!info->attrs[NL80211_ATTR_PID])
7206                 return -EINVAL;
7207
7208         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
7209
7210         net = get_net_ns_by_pid(pid);
7211         if (IS_ERR(net))
7212                 return PTR_ERR(net);
7213
7214         err = 0;
7215
7216         /* check if anything to do */
7217         if (!net_eq(wiphy_net(&rdev->wiphy), net))
7218                 err = cfg80211_switch_netns(rdev, net);
7219
7220         put_net(net);
7221         return err;
7222 }
7223
7224 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
7225 {
7226         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7227         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
7228                         struct cfg80211_pmksa *pmksa) = NULL;
7229         struct net_device *dev = info->user_ptr[1];
7230         struct cfg80211_pmksa pmksa;
7231
7232         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
7233
7234         if (!info->attrs[NL80211_ATTR_MAC])
7235                 return -EINVAL;
7236
7237         if (!info->attrs[NL80211_ATTR_PMKID])
7238                 return -EINVAL;
7239
7240         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
7241         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7242
7243         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7244             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7245                 return -EOPNOTSUPP;
7246
7247         switch (info->genlhdr->cmd) {
7248         case NL80211_CMD_SET_PMKSA:
7249                 rdev_ops = rdev->ops->set_pmksa;
7250                 break;
7251         case NL80211_CMD_DEL_PMKSA:
7252                 rdev_ops = rdev->ops->del_pmksa;
7253                 break;
7254         default:
7255                 WARN_ON(1);
7256                 break;
7257         }
7258
7259         if (!rdev_ops)
7260                 return -EOPNOTSUPP;
7261
7262         return rdev_ops(&rdev->wiphy, dev, &pmksa);
7263 }
7264
7265 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
7266 {
7267         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7268         struct net_device *dev = info->user_ptr[1];
7269
7270         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7271             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7272                 return -EOPNOTSUPP;
7273
7274         if (!rdev->ops->flush_pmksa)
7275                 return -EOPNOTSUPP;
7276
7277         return rdev_flush_pmksa(rdev, dev);
7278 }
7279
7280 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
7281 {
7282         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7283         struct net_device *dev = info->user_ptr[1];
7284         u8 action_code, dialog_token;
7285         u32 peer_capability = 0;
7286         u16 status_code;
7287         u8 *peer;
7288
7289         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
7290             !rdev->ops->tdls_mgmt)
7291                 return -EOPNOTSUPP;
7292
7293         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
7294             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
7295             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
7296             !info->attrs[NL80211_ATTR_IE] ||
7297             !info->attrs[NL80211_ATTR_MAC])
7298                 return -EINVAL;
7299
7300         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
7301         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
7302         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
7303         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
7304         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
7305                 peer_capability =
7306                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
7307
7308         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
7309                               dialog_token, status_code, peer_capability,
7310                               nla_data(info->attrs[NL80211_ATTR_IE]),
7311                               nla_len(info->attrs[NL80211_ATTR_IE]));
7312 }
7313
7314 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
7315 {
7316         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7317         struct net_device *dev = info->user_ptr[1];
7318         enum nl80211_tdls_operation operation;
7319         u8 *peer;
7320
7321         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
7322             !rdev->ops->tdls_oper)
7323                 return -EOPNOTSUPP;
7324
7325         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
7326             !info->attrs[NL80211_ATTR_MAC])
7327                 return -EINVAL;
7328
7329         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
7330         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
7331
7332         return rdev_tdls_oper(rdev, dev, peer, operation);
7333 }
7334
7335 static int nl80211_remain_on_channel(struct sk_buff *skb,
7336                                      struct genl_info *info)
7337 {
7338         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7339         struct wireless_dev *wdev = info->user_ptr[1];
7340         struct cfg80211_chan_def chandef;
7341         struct sk_buff *msg;
7342         void *hdr;
7343         u64 cookie;
7344         u32 duration;
7345         int err;
7346
7347         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
7348             !info->attrs[NL80211_ATTR_DURATION])
7349                 return -EINVAL;
7350
7351         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7352
7353         if (!rdev->ops->remain_on_channel ||
7354             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
7355                 return -EOPNOTSUPP;
7356
7357         /*
7358          * We should be on that channel for at least a minimum amount of
7359          * time (10ms) but no longer than the driver supports.
7360          */
7361         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7362             duration > rdev->wiphy.max_remain_on_channel_duration)
7363                 return -EINVAL;
7364
7365         err = nl80211_parse_chandef(rdev, info, &chandef);
7366         if (err)
7367                 return err;
7368
7369         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7370         if (!msg)
7371                 return -ENOMEM;
7372
7373         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7374                              NL80211_CMD_REMAIN_ON_CHANNEL);
7375         if (!hdr) {
7376                 err = -ENOBUFS;
7377                 goto free_msg;
7378         }
7379
7380         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
7381                                      duration, &cookie);
7382
7383         if (err)
7384                 goto free_msg;
7385
7386         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7387                 goto nla_put_failure;
7388
7389         genlmsg_end(msg, hdr);
7390
7391         return genlmsg_reply(msg, info);
7392
7393  nla_put_failure:
7394         err = -ENOBUFS;
7395  free_msg:
7396         nlmsg_free(msg);
7397         return err;
7398 }
7399
7400 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
7401                                             struct genl_info *info)
7402 {
7403         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7404         struct wireless_dev *wdev = info->user_ptr[1];
7405         u64 cookie;
7406
7407         if (!info->attrs[NL80211_ATTR_COOKIE])
7408                 return -EINVAL;
7409
7410         if (!rdev->ops->cancel_remain_on_channel)
7411                 return -EOPNOTSUPP;
7412
7413         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7414
7415         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
7416 }
7417
7418 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
7419                            u8 *rates, u8 rates_len)
7420 {
7421         u8 i;
7422         u32 mask = 0;
7423
7424         for (i = 0; i < rates_len; i++) {
7425                 int rate = (rates[i] & 0x7f) * 5;
7426                 int ridx;
7427                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
7428                         struct ieee80211_rate *srate =
7429                                 &sband->bitrates[ridx];
7430                         if (rate == srate->bitrate) {
7431                                 mask |= 1 << ridx;
7432                                 break;
7433                         }
7434                 }
7435                 if (ridx == sband->n_bitrates)
7436                         return 0; /* rate not found */
7437         }
7438
7439         return mask;
7440 }
7441
7442 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
7443                                u8 *rates, u8 rates_len,
7444                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
7445 {
7446         u8 i;
7447
7448         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
7449
7450         for (i = 0; i < rates_len; i++) {
7451                 int ridx, rbit;
7452
7453                 ridx = rates[i] / 8;
7454                 rbit = BIT(rates[i] % 8);
7455
7456                 /* check validity */
7457                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
7458                         return false;
7459
7460                 /* check availability */
7461                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
7462                         mcs[ridx] |= rbit;
7463                 else
7464                         return false;
7465         }
7466
7467         return true;
7468 }
7469
7470 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
7471 {
7472         u16 mcs_mask = 0;
7473
7474         switch (vht_mcs_map) {
7475         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
7476                 break;
7477         case IEEE80211_VHT_MCS_SUPPORT_0_7:
7478                 mcs_mask = 0x00FF;
7479                 break;
7480         case IEEE80211_VHT_MCS_SUPPORT_0_8:
7481                 mcs_mask = 0x01FF;
7482                 break;
7483         case IEEE80211_VHT_MCS_SUPPORT_0_9:
7484                 mcs_mask = 0x03FF;
7485                 break;
7486         default:
7487                 break;
7488         }
7489
7490         return mcs_mask;
7491 }
7492
7493 static void vht_build_mcs_mask(u16 vht_mcs_map,
7494                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
7495 {
7496         u8 nss;
7497
7498         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
7499                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
7500                 vht_mcs_map >>= 2;
7501         }
7502 }
7503
7504 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
7505                              struct nl80211_txrate_vht *txrate,
7506                              u16 mcs[NL80211_VHT_NSS_MAX])
7507 {
7508         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
7509         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
7510         u8 i;
7511
7512         if (!sband->vht_cap.vht_supported)
7513                 return false;
7514
7515         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
7516
7517         /* Build vht_mcs_mask from VHT capabilities */
7518         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
7519
7520         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
7521                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
7522                         mcs[i] = txrate->mcs[i];
7523                 else
7524                         return false;
7525         }
7526
7527         return true;
7528 }
7529
7530 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
7531         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
7532                                     .len = NL80211_MAX_SUPP_RATES },
7533         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
7534                                 .len = NL80211_MAX_SUPP_HT_RATES },
7535         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
7536         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
7537 };
7538
7539 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
7540                                        struct genl_info *info)
7541 {
7542         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
7543         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7544         struct cfg80211_bitrate_mask mask;
7545         int rem, i;
7546         struct net_device *dev = info->user_ptr[1];
7547         struct nlattr *tx_rates;
7548         struct ieee80211_supported_band *sband;
7549         u16 vht_tx_mcs_map;
7550
7551         if (!rdev->ops->set_bitrate_mask)
7552                 return -EOPNOTSUPP;
7553
7554         memset(&mask, 0, sizeof(mask));
7555         /* Default to all rates enabled */
7556         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
7557                 sband = rdev->wiphy.bands[i];
7558
7559                 if (!sband)
7560                         continue;
7561
7562                 mask.control[i].legacy = (1 << sband->n_bitrates) - 1;
7563                 memcpy(mask.control[i].ht_mcs,
7564                        sband->ht_cap.mcs.rx_mask,
7565                        sizeof(mask.control[i].ht_mcs));
7566
7567                 if (!sband->vht_cap.vht_supported)
7568                         continue;
7569
7570                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
7571                 vht_build_mcs_mask(vht_tx_mcs_map, mask.control[i].vht_mcs);
7572         }
7573
7574         /* if no rates are given set it back to the defaults */
7575         if (!info->attrs[NL80211_ATTR_TX_RATES])
7576                 goto out;
7577
7578         /*
7579          * The nested attribute uses enum nl80211_band as the index. This maps
7580          * directly to the enum ieee80211_band values used in cfg80211.
7581          */
7582         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
7583         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
7584                 enum ieee80211_band band = nla_type(tx_rates);
7585                 int err;
7586
7587                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
7588                         return -EINVAL;
7589                 sband = rdev->wiphy.bands[band];
7590                 if (sband == NULL)
7591                         return -EINVAL;
7592                 err = nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
7593                                 nla_len(tx_rates), nl80211_txattr_policy);
7594                 if (err)
7595                         return err;
7596                 if (tb[NL80211_TXRATE_LEGACY]) {
7597                         mask.control[band].legacy = rateset_to_mask(
7598                                 sband,
7599                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
7600                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
7601                         if ((mask.control[band].legacy == 0) &&
7602                             nla_len(tb[NL80211_TXRATE_LEGACY]))
7603                                 return -EINVAL;
7604                 }
7605                 if (tb[NL80211_TXRATE_HT]) {
7606                         if (!ht_rateset_to_mask(
7607                                         sband,
7608                                         nla_data(tb[NL80211_TXRATE_HT]),
7609                                         nla_len(tb[NL80211_TXRATE_HT]),
7610                                         mask.control[band].ht_mcs))
7611                                 return -EINVAL;
7612                 }
7613                 if (tb[NL80211_TXRATE_VHT]) {
7614                         if (!vht_set_mcs_mask(
7615                                         sband,
7616                                         nla_data(tb[NL80211_TXRATE_VHT]),
7617                                         mask.control[band].vht_mcs))
7618                                 return -EINVAL;
7619                 }
7620                 if (tb[NL80211_TXRATE_GI]) {
7621                         mask.control[band].gi =
7622                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
7623                         if (mask.control[band].gi > NL80211_TXRATE_FORCE_LGI)
7624                                 return -EINVAL;
7625                 }
7626
7627                 if (mask.control[band].legacy == 0) {
7628                         /* don't allow empty legacy rates if HT or VHT
7629                          * are not even supported.
7630                          */
7631                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
7632                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
7633                                 return -EINVAL;
7634
7635                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
7636                                 if (mask.control[band].ht_mcs[i])
7637                                         goto out;
7638
7639                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
7640                                 if (mask.control[band].vht_mcs[i])
7641                                         goto out;
7642
7643                         /* legacy and mcs rates may not be both empty */
7644                         return -EINVAL;
7645                 }
7646         }
7647
7648 out:
7649         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
7650 }
7651
7652 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
7653 {
7654         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7655         struct wireless_dev *wdev = info->user_ptr[1];
7656         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
7657
7658         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
7659                 return -EINVAL;
7660
7661         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
7662                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
7663
7664         switch (wdev->iftype) {
7665         case NL80211_IFTYPE_STATION:
7666         case NL80211_IFTYPE_ADHOC:
7667         case NL80211_IFTYPE_P2P_CLIENT:
7668         case NL80211_IFTYPE_AP:
7669         case NL80211_IFTYPE_AP_VLAN:
7670         case NL80211_IFTYPE_MESH_POINT:
7671         case NL80211_IFTYPE_P2P_GO:
7672         case NL80211_IFTYPE_P2P_DEVICE:
7673                 break;
7674         default:
7675                 return -EOPNOTSUPP;
7676         }
7677
7678         /* not much point in registering if we can't reply */
7679         if (!rdev->ops->mgmt_tx)
7680                 return -EOPNOTSUPP;
7681
7682         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
7683                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
7684                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
7685 }
7686
7687 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
7688 {
7689         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7690         struct wireless_dev *wdev = info->user_ptr[1];
7691         struct cfg80211_chan_def chandef;
7692         int err;
7693         void *hdr = NULL;
7694         u64 cookie;
7695         struct sk_buff *msg = NULL;
7696         struct cfg80211_mgmt_tx_params params = {
7697                 .dont_wait_for_ack =
7698                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
7699         };
7700
7701         if (!info->attrs[NL80211_ATTR_FRAME])
7702                 return -EINVAL;
7703
7704         if (!rdev->ops->mgmt_tx)
7705                 return -EOPNOTSUPP;
7706
7707         switch (wdev->iftype) {
7708         case NL80211_IFTYPE_P2P_DEVICE:
7709                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
7710                         return -EINVAL;
7711         case NL80211_IFTYPE_STATION:
7712         case NL80211_IFTYPE_ADHOC:
7713         case NL80211_IFTYPE_P2P_CLIENT:
7714         case NL80211_IFTYPE_AP:
7715         case NL80211_IFTYPE_AP_VLAN:
7716         case NL80211_IFTYPE_MESH_POINT:
7717         case NL80211_IFTYPE_P2P_GO:
7718                 break;
7719         default:
7720                 return -EOPNOTSUPP;
7721         }
7722
7723         if (info->attrs[NL80211_ATTR_DURATION]) {
7724                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7725                         return -EINVAL;
7726                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7727
7728                 /*
7729                  * We should wait on the channel for at least a minimum amount
7730                  * of time (10ms) but no longer than the driver supports.
7731                  */
7732                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7733                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
7734                         return -EINVAL;
7735
7736         }
7737
7738         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
7739
7740         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7741                 return -EINVAL;
7742
7743         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7744
7745         /* get the channel if any has been specified, otherwise pass NULL to
7746          * the driver. The latter will use the current one
7747          */
7748         chandef.chan = NULL;
7749         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7750                 err = nl80211_parse_chandef(rdev, info, &chandef);
7751                 if (err)
7752                         return err;
7753         }
7754
7755         if (!chandef.chan && params.offchan)
7756                 return -EINVAL;
7757
7758         if (!params.dont_wait_for_ack) {
7759                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7760                 if (!msg)
7761                         return -ENOMEM;
7762
7763                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7764                                      NL80211_CMD_FRAME);
7765                 if (!hdr) {
7766                         err = -ENOBUFS;
7767                         goto free_msg;
7768                 }
7769         }
7770
7771         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
7772         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
7773         params.chan = chandef.chan;
7774         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
7775         if (err)
7776                 goto free_msg;
7777
7778         if (msg) {
7779                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7780                         goto nla_put_failure;
7781
7782                 genlmsg_end(msg, hdr);
7783                 return genlmsg_reply(msg, info);
7784         }
7785
7786         return 0;
7787
7788  nla_put_failure:
7789         err = -ENOBUFS;
7790  free_msg:
7791         nlmsg_free(msg);
7792         return err;
7793 }
7794
7795 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
7796 {
7797         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7798         struct wireless_dev *wdev = info->user_ptr[1];
7799         u64 cookie;
7800
7801         if (!info->attrs[NL80211_ATTR_COOKIE])
7802                 return -EINVAL;
7803
7804         if (!rdev->ops->mgmt_tx_cancel_wait)
7805                 return -EOPNOTSUPP;
7806
7807         switch (wdev->iftype) {
7808         case NL80211_IFTYPE_STATION:
7809         case NL80211_IFTYPE_ADHOC:
7810         case NL80211_IFTYPE_P2P_CLIENT:
7811         case NL80211_IFTYPE_AP:
7812         case NL80211_IFTYPE_AP_VLAN:
7813         case NL80211_IFTYPE_P2P_GO:
7814         case NL80211_IFTYPE_P2P_DEVICE:
7815                 break;
7816         default:
7817                 return -EOPNOTSUPP;
7818         }
7819
7820         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7821
7822         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
7823 }
7824
7825 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
7826 {
7827         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7828         struct wireless_dev *wdev;
7829         struct net_device *dev = info->user_ptr[1];
7830         u8 ps_state;
7831         bool state;
7832         int err;
7833
7834         if (!info->attrs[NL80211_ATTR_PS_STATE])
7835                 return -EINVAL;
7836
7837         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
7838
7839         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
7840                 return -EINVAL;
7841
7842         wdev = dev->ieee80211_ptr;
7843
7844         if (!rdev->ops->set_power_mgmt)
7845                 return -EOPNOTSUPP;
7846
7847         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
7848
7849         if (state == wdev->ps)
7850                 return 0;
7851
7852         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
7853         if (!err)
7854                 wdev->ps = state;
7855         return err;
7856 }
7857
7858 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
7859 {
7860         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7861         enum nl80211_ps_state ps_state;
7862         struct wireless_dev *wdev;
7863         struct net_device *dev = info->user_ptr[1];
7864         struct sk_buff *msg;
7865         void *hdr;
7866         int err;
7867
7868         wdev = dev->ieee80211_ptr;
7869
7870         if (!rdev->ops->set_power_mgmt)
7871                 return -EOPNOTSUPP;
7872
7873         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7874         if (!msg)
7875                 return -ENOMEM;
7876
7877         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7878                              NL80211_CMD_GET_POWER_SAVE);
7879         if (!hdr) {
7880                 err = -ENOBUFS;
7881                 goto free_msg;
7882         }
7883
7884         if (wdev->ps)
7885                 ps_state = NL80211_PS_ENABLED;
7886         else
7887                 ps_state = NL80211_PS_DISABLED;
7888
7889         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
7890                 goto nla_put_failure;
7891
7892         genlmsg_end(msg, hdr);
7893         return genlmsg_reply(msg, info);
7894
7895  nla_put_failure:
7896         err = -ENOBUFS;
7897  free_msg:
7898         nlmsg_free(msg);
7899         return err;
7900 }
7901
7902 static const struct nla_policy
7903 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
7904         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
7905         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
7906         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
7907         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
7908         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
7909         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
7910 };
7911
7912 static int nl80211_set_cqm_txe(struct genl_info *info,
7913                                u32 rate, u32 pkts, u32 intvl)
7914 {
7915         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7916         struct net_device *dev = info->user_ptr[1];
7917         struct wireless_dev *wdev = dev->ieee80211_ptr;
7918
7919         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
7920                 return -EINVAL;
7921
7922         if (!rdev->ops->set_cqm_txe_config)
7923                 return -EOPNOTSUPP;
7924
7925         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7926             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7927                 return -EOPNOTSUPP;
7928
7929         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
7930 }
7931
7932 static int nl80211_set_cqm_rssi(struct genl_info *info,
7933                                 s32 threshold, u32 hysteresis)
7934 {
7935         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7936         struct net_device *dev = info->user_ptr[1];
7937         struct wireless_dev *wdev = dev->ieee80211_ptr;
7938
7939         if (threshold > 0)
7940                 return -EINVAL;
7941
7942         /* disabling - hysteresis should also be zero then */
7943         if (threshold == 0)
7944                 hysteresis = 0;
7945
7946         if (!rdev->ops->set_cqm_rssi_config)
7947                 return -EOPNOTSUPP;
7948
7949         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7950             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7951                 return -EOPNOTSUPP;
7952
7953         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
7954 }
7955
7956 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
7957 {
7958         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
7959         struct nlattr *cqm;
7960         int err;
7961
7962         cqm = info->attrs[NL80211_ATTR_CQM];
7963         if (!cqm)
7964                 return -EINVAL;
7965
7966         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
7967                                nl80211_attr_cqm_policy);
7968         if (err)
7969                 return err;
7970
7971         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
7972             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
7973                 s32 threshold = nla_get_s32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
7974                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
7975
7976                 return nl80211_set_cqm_rssi(info, threshold, hysteresis);
7977         }
7978
7979         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
7980             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
7981             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
7982                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
7983                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
7984                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
7985
7986                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
7987         }
7988
7989         return -EINVAL;
7990 }
7991
7992 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
7993 {
7994         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7995         struct net_device *dev = info->user_ptr[1];
7996         struct mesh_config cfg;
7997         struct mesh_setup setup;
7998         int err;
7999
8000         /* start with default */
8001         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
8002         memcpy(&setup, &default_mesh_setup, sizeof(setup));
8003
8004         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
8005                 /* and parse parameters if given */
8006                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
8007                 if (err)
8008                         return err;
8009         }
8010
8011         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
8012             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
8013                 return -EINVAL;
8014
8015         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
8016         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
8017
8018         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
8019             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
8020                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
8021                         return -EINVAL;
8022
8023         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
8024                 setup.beacon_interval =
8025                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
8026                 if (setup.beacon_interval < 10 ||
8027                     setup.beacon_interval > 10000)
8028                         return -EINVAL;
8029         }
8030
8031         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
8032                 setup.dtim_period =
8033                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
8034                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
8035                         return -EINVAL;
8036         }
8037
8038         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
8039                 /* parse additional setup parameters if given */
8040                 err = nl80211_parse_mesh_setup(info, &setup);
8041                 if (err)
8042                         return err;
8043         }
8044
8045         if (setup.user_mpm)
8046                 cfg.auto_open_plinks = false;
8047
8048         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8049                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
8050                 if (err)
8051                         return err;
8052         } else {
8053                 /* cfg80211_join_mesh() will sort it out */
8054                 setup.chandef.chan = NULL;
8055         }
8056
8057         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8058                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8059                 int n_rates =
8060                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8061                 struct ieee80211_supported_band *sband;
8062
8063                 if (!setup.chandef.chan)
8064                         return -EINVAL;
8065
8066                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
8067
8068                 err = ieee80211_get_ratemask(sband, rates, n_rates,
8069                                              &setup.basic_rates);
8070                 if (err)
8071                         return err;
8072         }
8073
8074         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
8075 }
8076
8077 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
8078 {
8079         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8080         struct net_device *dev = info->user_ptr[1];
8081
8082         return cfg80211_leave_mesh(rdev, dev);
8083 }
8084
8085 #ifdef CONFIG_PM
8086 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
8087                                         struct cfg80211_registered_device *rdev)
8088 {
8089         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
8090         struct nlattr *nl_pats, *nl_pat;
8091         int i, pat_len;
8092
8093         if (!wowlan->n_patterns)
8094                 return 0;
8095
8096         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
8097         if (!nl_pats)
8098                 return -ENOBUFS;
8099
8100         for (i = 0; i < wowlan->n_patterns; i++) {
8101                 nl_pat = nla_nest_start(msg, i + 1);
8102                 if (!nl_pat)
8103                         return -ENOBUFS;
8104                 pat_len = wowlan->patterns[i].pattern_len;
8105                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
8106                             wowlan->patterns[i].mask) ||
8107                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
8108                             wowlan->patterns[i].pattern) ||
8109                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
8110                                 wowlan->patterns[i].pkt_offset))
8111                         return -ENOBUFS;
8112                 nla_nest_end(msg, nl_pat);
8113         }
8114         nla_nest_end(msg, nl_pats);
8115
8116         return 0;
8117 }
8118
8119 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
8120                                    struct cfg80211_wowlan_tcp *tcp)
8121 {
8122         struct nlattr *nl_tcp;
8123
8124         if (!tcp)
8125                 return 0;
8126
8127         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
8128         if (!nl_tcp)
8129                 return -ENOBUFS;
8130
8131         if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
8132             nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
8133             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
8134             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
8135             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
8136             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
8137                     tcp->payload_len, tcp->payload) ||
8138             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
8139                         tcp->data_interval) ||
8140             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
8141                     tcp->wake_len, tcp->wake_data) ||
8142             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
8143                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
8144                 return -ENOBUFS;
8145
8146         if (tcp->payload_seq.len &&
8147             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
8148                     sizeof(tcp->payload_seq), &tcp->payload_seq))
8149                 return -ENOBUFS;
8150
8151         if (tcp->payload_tok.len &&
8152             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
8153                     sizeof(tcp->payload_tok) + tcp->tokens_size,
8154                     &tcp->payload_tok))
8155                 return -ENOBUFS;
8156
8157         nla_nest_end(msg, nl_tcp);
8158
8159         return 0;
8160 }
8161
8162 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
8163 {
8164         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8165         struct sk_buff *msg;
8166         void *hdr;
8167         u32 size = NLMSG_DEFAULT_SIZE;
8168
8169         if (!rdev->wiphy.wowlan)
8170                 return -EOPNOTSUPP;
8171
8172         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
8173                 /* adjust size to have room for all the data */
8174                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
8175                         rdev->wiphy.wowlan_config->tcp->payload_len +
8176                         rdev->wiphy.wowlan_config->tcp->wake_len +
8177                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
8178         }
8179
8180         msg = nlmsg_new(size, GFP_KERNEL);
8181         if (!msg)
8182                 return -ENOMEM;
8183
8184         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8185                              NL80211_CMD_GET_WOWLAN);
8186         if (!hdr)
8187                 goto nla_put_failure;
8188
8189         if (rdev->wiphy.wowlan_config) {
8190                 struct nlattr *nl_wowlan;
8191
8192                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
8193                 if (!nl_wowlan)
8194                         goto nla_put_failure;
8195
8196                 if ((rdev->wiphy.wowlan_config->any &&
8197                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
8198                     (rdev->wiphy.wowlan_config->disconnect &&
8199                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
8200                     (rdev->wiphy.wowlan_config->magic_pkt &&
8201                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
8202                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
8203                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
8204                     (rdev->wiphy.wowlan_config->eap_identity_req &&
8205                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
8206                     (rdev->wiphy.wowlan_config->four_way_handshake &&
8207                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
8208                     (rdev->wiphy.wowlan_config->rfkill_release &&
8209                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
8210                         goto nla_put_failure;
8211
8212                 if (nl80211_send_wowlan_patterns(msg, rdev))
8213                         goto nla_put_failure;
8214
8215                 if (nl80211_send_wowlan_tcp(msg,
8216                                             rdev->wiphy.wowlan_config->tcp))
8217                         goto nla_put_failure;
8218
8219                 nla_nest_end(msg, nl_wowlan);
8220         }
8221
8222         genlmsg_end(msg, hdr);
8223         return genlmsg_reply(msg, info);
8224
8225 nla_put_failure:
8226         nlmsg_free(msg);
8227         return -ENOBUFS;
8228 }
8229
8230 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
8231                                     struct nlattr *attr,
8232                                     struct cfg80211_wowlan *trig)
8233 {
8234         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
8235         struct cfg80211_wowlan_tcp *cfg;
8236         struct nl80211_wowlan_tcp_data_token *tok = NULL;
8237         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
8238         u32 size;
8239         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
8240         int err, port;
8241
8242         if (!rdev->wiphy.wowlan->tcp)
8243                 return -EINVAL;
8244
8245         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
8246                         nla_data(attr), nla_len(attr),
8247                         nl80211_wowlan_tcp_policy);
8248         if (err)
8249                 return err;
8250
8251         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
8252             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
8253             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
8254             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
8255             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
8256             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
8257             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
8258             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
8259                 return -EINVAL;
8260
8261         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
8262         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
8263                 return -EINVAL;
8264
8265         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
8266                         rdev->wiphy.wowlan->tcp->data_interval_max ||
8267             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
8268                 return -EINVAL;
8269
8270         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
8271         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
8272                 return -EINVAL;
8273
8274         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
8275         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
8276                 return -EINVAL;
8277
8278         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
8279                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
8280
8281                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
8282                 tokens_size = tokln - sizeof(*tok);
8283
8284                 if (!tok->len || tokens_size % tok->len)
8285                         return -EINVAL;
8286                 if (!rdev->wiphy.wowlan->tcp->tok)
8287                         return -EINVAL;
8288                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
8289                         return -EINVAL;
8290                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
8291                         return -EINVAL;
8292                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
8293                         return -EINVAL;
8294                 if (tok->offset + tok->len > data_size)
8295                         return -EINVAL;
8296         }
8297
8298         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
8299                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
8300                 if (!rdev->wiphy.wowlan->tcp->seq)
8301                         return -EINVAL;
8302                 if (seq->len == 0 || seq->len > 4)
8303                         return -EINVAL;
8304                 if (seq->len + seq->offset > data_size)
8305                         return -EINVAL;
8306         }
8307
8308         size = sizeof(*cfg);
8309         size += data_size;
8310         size += wake_size + wake_mask_size;
8311         size += tokens_size;
8312
8313         cfg = kzalloc(size, GFP_KERNEL);
8314         if (!cfg)
8315                 return -ENOMEM;
8316         cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
8317         cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
8318         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
8319                ETH_ALEN);
8320         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
8321                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
8322         else
8323                 port = 0;
8324 #ifdef CONFIG_INET
8325         /* allocate a socket and port for it and use it */
8326         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
8327                             IPPROTO_TCP, &cfg->sock, 1);
8328         if (err) {
8329                 kfree(cfg);
8330                 return err;
8331         }
8332         if (inet_csk_get_port(cfg->sock->sk, port)) {
8333                 sock_release(cfg->sock);
8334                 kfree(cfg);
8335                 return -EADDRINUSE;
8336         }
8337         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
8338 #else
8339         if (!port) {
8340                 kfree(cfg);
8341                 return -EINVAL;
8342         }
8343         cfg->src_port = port;
8344 #endif
8345
8346         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
8347         cfg->payload_len = data_size;
8348         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
8349         memcpy((void *)cfg->payload,
8350                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
8351                data_size);
8352         if (seq)
8353                 cfg->payload_seq = *seq;
8354         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
8355         cfg->wake_len = wake_size;
8356         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
8357         memcpy((void *)cfg->wake_data,
8358                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
8359                wake_size);
8360         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
8361                          data_size + wake_size;
8362         memcpy((void *)cfg->wake_mask,
8363                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
8364                wake_mask_size);
8365         if (tok) {
8366                 cfg->tokens_size = tokens_size;
8367                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
8368         }
8369
8370         trig->tcp = cfg;
8371
8372         return 0;
8373 }
8374
8375 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
8376 {
8377         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8378         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
8379         struct cfg80211_wowlan new_triggers = {};
8380         struct cfg80211_wowlan *ntrig;
8381         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
8382         int err, i;
8383         bool prev_enabled = rdev->wiphy.wowlan_config;
8384
8385         if (!wowlan)
8386                 return -EOPNOTSUPP;
8387
8388         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
8389                 cfg80211_rdev_free_wowlan(rdev);
8390                 rdev->wiphy.wowlan_config = NULL;
8391                 goto set_wakeup;
8392         }
8393
8394         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
8395                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
8396                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
8397                         nl80211_wowlan_policy);
8398         if (err)
8399                 return err;
8400
8401         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
8402                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
8403                         return -EINVAL;
8404                 new_triggers.any = true;
8405         }
8406
8407         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
8408                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
8409                         return -EINVAL;
8410                 new_triggers.disconnect = true;
8411         }
8412
8413         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
8414                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
8415                         return -EINVAL;
8416                 new_triggers.magic_pkt = true;
8417         }
8418
8419         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
8420                 return -EINVAL;
8421
8422         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
8423                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
8424                         return -EINVAL;
8425                 new_triggers.gtk_rekey_failure = true;
8426         }
8427
8428         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
8429                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
8430                         return -EINVAL;
8431                 new_triggers.eap_identity_req = true;
8432         }
8433
8434         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
8435                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
8436                         return -EINVAL;
8437                 new_triggers.four_way_handshake = true;
8438         }
8439
8440         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
8441                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
8442                         return -EINVAL;
8443                 new_triggers.rfkill_release = true;
8444         }
8445
8446         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
8447                 struct nlattr *pat;
8448                 int n_patterns = 0;
8449                 int rem, pat_len, mask_len, pkt_offset;
8450                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
8451
8452                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
8453                                     rem)
8454                         n_patterns++;
8455                 if (n_patterns > wowlan->n_patterns)
8456                         return -EINVAL;
8457
8458                 new_triggers.patterns = kcalloc(n_patterns,
8459                                                 sizeof(new_triggers.patterns[0]),
8460                                                 GFP_KERNEL);
8461                 if (!new_triggers.patterns)
8462                         return -ENOMEM;
8463
8464                 new_triggers.n_patterns = n_patterns;
8465                 i = 0;
8466
8467                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
8468                                     rem) {
8469                         nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
8470                                   nla_len(pat), NULL);
8471                         err = -EINVAL;
8472                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
8473                             !pat_tb[NL80211_PKTPAT_PATTERN])
8474                                 goto error;
8475                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
8476                         mask_len = DIV_ROUND_UP(pat_len, 8);
8477                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
8478                                 goto error;
8479                         if (pat_len > wowlan->pattern_max_len ||
8480                             pat_len < wowlan->pattern_min_len)
8481                                 goto error;
8482
8483                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
8484                                 pkt_offset = 0;
8485                         else
8486                                 pkt_offset = nla_get_u32(
8487                                         pat_tb[NL80211_PKTPAT_OFFSET]);
8488                         if (pkt_offset > wowlan->max_pkt_offset)
8489                                 goto error;
8490                         new_triggers.patterns[i].pkt_offset = pkt_offset;
8491
8492                         new_triggers.patterns[i].mask =
8493                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
8494                         if (!new_triggers.patterns[i].mask) {
8495                                 err = -ENOMEM;
8496                                 goto error;
8497                         }
8498                         new_triggers.patterns[i].pattern =
8499                                 new_triggers.patterns[i].mask + mask_len;
8500                         memcpy(new_triggers.patterns[i].mask,
8501                                nla_data(pat_tb[NL80211_PKTPAT_MASK]),
8502                                mask_len);
8503                         new_triggers.patterns[i].pattern_len = pat_len;
8504                         memcpy(new_triggers.patterns[i].pattern,
8505                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
8506                                pat_len);
8507                         i++;
8508                 }
8509         }
8510
8511         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
8512                 err = nl80211_parse_wowlan_tcp(
8513                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
8514                         &new_triggers);
8515                 if (err)
8516                         goto error;
8517         }
8518
8519         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
8520         if (!ntrig) {
8521                 err = -ENOMEM;
8522                 goto error;
8523         }
8524         cfg80211_rdev_free_wowlan(rdev);
8525         rdev->wiphy.wowlan_config = ntrig;
8526
8527  set_wakeup:
8528         if (rdev->ops->set_wakeup &&
8529             prev_enabled != !!rdev->wiphy.wowlan_config)
8530                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
8531
8532         return 0;
8533  error:
8534         for (i = 0; i < new_triggers.n_patterns; i++)
8535                 kfree(new_triggers.patterns[i].mask);
8536         kfree(new_triggers.patterns);
8537         if (new_triggers.tcp && new_triggers.tcp->sock)
8538                 sock_release(new_triggers.tcp->sock);
8539         kfree(new_triggers.tcp);
8540         return err;
8541 }
8542 #endif
8543
8544 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
8545                                        struct cfg80211_registered_device *rdev)
8546 {
8547         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
8548         int i, j, pat_len;
8549         struct cfg80211_coalesce_rules *rule;
8550
8551         if (!rdev->coalesce->n_rules)
8552                 return 0;
8553
8554         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
8555         if (!nl_rules)
8556                 return -ENOBUFS;
8557
8558         for (i = 0; i < rdev->coalesce->n_rules; i++) {
8559                 nl_rule = nla_nest_start(msg, i + 1);
8560                 if (!nl_rule)
8561                         return -ENOBUFS;
8562
8563                 rule = &rdev->coalesce->rules[i];
8564                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
8565                                 rule->delay))
8566                         return -ENOBUFS;
8567
8568                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
8569                                 rule->condition))
8570                         return -ENOBUFS;
8571
8572                 nl_pats = nla_nest_start(msg,
8573                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
8574                 if (!nl_pats)
8575                         return -ENOBUFS;
8576
8577                 for (j = 0; j < rule->n_patterns; j++) {
8578                         nl_pat = nla_nest_start(msg, j + 1);
8579                         if (!nl_pat)
8580                                 return -ENOBUFS;
8581                         pat_len = rule->patterns[j].pattern_len;
8582                         if (nla_put(msg, NL80211_PKTPAT_MASK,
8583                                     DIV_ROUND_UP(pat_len, 8),
8584                                     rule->patterns[j].mask) ||
8585                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
8586                                     rule->patterns[j].pattern) ||
8587                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
8588                                         rule->patterns[j].pkt_offset))
8589                                 return -ENOBUFS;
8590                         nla_nest_end(msg, nl_pat);
8591                 }
8592                 nla_nest_end(msg, nl_pats);
8593                 nla_nest_end(msg, nl_rule);
8594         }
8595         nla_nest_end(msg, nl_rules);
8596
8597         return 0;
8598 }
8599
8600 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
8601 {
8602         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8603         struct sk_buff *msg;
8604         void *hdr;
8605
8606         if (!rdev->wiphy.coalesce)
8607                 return -EOPNOTSUPP;
8608
8609         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8610         if (!msg)
8611                 return -ENOMEM;
8612
8613         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8614                              NL80211_CMD_GET_COALESCE);
8615         if (!hdr)
8616                 goto nla_put_failure;
8617
8618         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
8619                 goto nla_put_failure;
8620
8621         genlmsg_end(msg, hdr);
8622         return genlmsg_reply(msg, info);
8623
8624 nla_put_failure:
8625         nlmsg_free(msg);
8626         return -ENOBUFS;
8627 }
8628
8629 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
8630 {
8631         struct cfg80211_coalesce *coalesce = rdev->coalesce;
8632         int i, j;
8633         struct cfg80211_coalesce_rules *rule;
8634
8635         if (!coalesce)
8636                 return;
8637
8638         for (i = 0; i < coalesce->n_rules; i++) {
8639                 rule = &coalesce->rules[i];
8640                 for (j = 0; j < rule->n_patterns; j++)
8641                         kfree(rule->patterns[j].mask);
8642                 kfree(rule->patterns);
8643         }
8644         kfree(coalesce->rules);
8645         kfree(coalesce);
8646         rdev->coalesce = NULL;
8647 }
8648
8649 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
8650                                        struct nlattr *rule,
8651                                        struct cfg80211_coalesce_rules *new_rule)
8652 {
8653         int err, i;
8654         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
8655         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
8656         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
8657         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
8658
8659         err = nla_parse(tb, NL80211_ATTR_COALESCE_RULE_MAX, nla_data(rule),
8660                         nla_len(rule), nl80211_coalesce_policy);
8661         if (err)
8662                 return err;
8663
8664         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
8665                 new_rule->delay =
8666                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
8667         if (new_rule->delay > coalesce->max_delay)
8668                 return -EINVAL;
8669
8670         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
8671                 new_rule->condition =
8672                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
8673         if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
8674             new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
8675                 return -EINVAL;
8676
8677         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
8678                 return -EINVAL;
8679
8680         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
8681                             rem)
8682                 n_patterns++;
8683         if (n_patterns > coalesce->n_patterns)
8684                 return -EINVAL;
8685
8686         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
8687                                      GFP_KERNEL);
8688         if (!new_rule->patterns)
8689                 return -ENOMEM;
8690
8691         new_rule->n_patterns = n_patterns;
8692         i = 0;
8693
8694         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
8695                             rem) {
8696                 nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
8697                           nla_len(pat), NULL);
8698                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
8699                     !pat_tb[NL80211_PKTPAT_PATTERN])
8700                         return -EINVAL;
8701                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
8702                 mask_len = DIV_ROUND_UP(pat_len, 8);
8703                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
8704                         return -EINVAL;
8705                 if (pat_len > coalesce->pattern_max_len ||
8706                     pat_len < coalesce->pattern_min_len)
8707                         return -EINVAL;
8708
8709                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
8710                         pkt_offset = 0;
8711                 else
8712                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
8713                 if (pkt_offset > coalesce->max_pkt_offset)
8714                         return -EINVAL;
8715                 new_rule->patterns[i].pkt_offset = pkt_offset;
8716
8717                 new_rule->patterns[i].mask =
8718                         kmalloc(mask_len + pat_len, GFP_KERNEL);
8719                 if (!new_rule->patterns[i].mask)
8720                         return -ENOMEM;
8721                 new_rule->patterns[i].pattern =
8722                         new_rule->patterns[i].mask + mask_len;
8723                 memcpy(new_rule->patterns[i].mask,
8724                        nla_data(pat_tb[NL80211_PKTPAT_MASK]), mask_len);
8725                 new_rule->patterns[i].pattern_len = pat_len;
8726                 memcpy(new_rule->patterns[i].pattern,
8727                        nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), pat_len);
8728                 i++;
8729         }
8730
8731         return 0;
8732 }
8733
8734 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
8735 {
8736         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8737         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
8738         struct cfg80211_coalesce new_coalesce = {};
8739         struct cfg80211_coalesce *n_coalesce;
8740         int err, rem_rule, n_rules = 0, i, j;
8741         struct nlattr *rule;
8742         struct cfg80211_coalesce_rules *tmp_rule;
8743
8744         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
8745                 return -EOPNOTSUPP;
8746
8747         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
8748                 cfg80211_rdev_free_coalesce(rdev);
8749                 rdev->ops->set_coalesce(&rdev->wiphy, NULL);
8750                 return 0;
8751         }
8752
8753         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
8754                             rem_rule)
8755                 n_rules++;
8756         if (n_rules > coalesce->n_rules)
8757                 return -EINVAL;
8758
8759         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
8760                                      GFP_KERNEL);
8761         if (!new_coalesce.rules)
8762                 return -ENOMEM;
8763
8764         new_coalesce.n_rules = n_rules;
8765         i = 0;
8766
8767         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
8768                             rem_rule) {
8769                 err = nl80211_parse_coalesce_rule(rdev, rule,
8770                                                   &new_coalesce.rules[i]);
8771                 if (err)
8772                         goto error;
8773
8774                 i++;
8775         }
8776
8777         err = rdev->ops->set_coalesce(&rdev->wiphy, &new_coalesce);
8778         if (err)
8779                 goto error;
8780
8781         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
8782         if (!n_coalesce) {
8783                 err = -ENOMEM;
8784                 goto error;
8785         }
8786         cfg80211_rdev_free_coalesce(rdev);
8787         rdev->coalesce = n_coalesce;
8788
8789         return 0;
8790 error:
8791         for (i = 0; i < new_coalesce.n_rules; i++) {
8792                 tmp_rule = &new_coalesce.rules[i];
8793                 for (j = 0; j < tmp_rule->n_patterns; j++)
8794                         kfree(tmp_rule->patterns[j].mask);
8795                 kfree(tmp_rule->patterns);
8796         }
8797         kfree(new_coalesce.rules);
8798
8799         return err;
8800 }
8801
8802 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
8803 {
8804         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8805         struct net_device *dev = info->user_ptr[1];
8806         struct wireless_dev *wdev = dev->ieee80211_ptr;
8807         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
8808         struct cfg80211_gtk_rekey_data rekey_data;
8809         int err;
8810
8811         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
8812                 return -EINVAL;
8813
8814         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
8815                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
8816                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
8817                         nl80211_rekey_policy);
8818         if (err)
8819                 return err;
8820
8821         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
8822                 return -ERANGE;
8823         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
8824                 return -ERANGE;
8825         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
8826                 return -ERANGE;
8827
8828         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
8829                NL80211_KEK_LEN);
8830         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
8831                NL80211_KCK_LEN);
8832         memcpy(rekey_data.replay_ctr,
8833                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
8834                NL80211_REPLAY_CTR_LEN);
8835
8836         wdev_lock(wdev);
8837         if (!wdev->current_bss) {
8838                 err = -ENOTCONN;
8839                 goto out;
8840         }
8841
8842         if (!rdev->ops->set_rekey_data) {
8843                 err = -EOPNOTSUPP;
8844                 goto out;
8845         }
8846
8847         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
8848  out:
8849         wdev_unlock(wdev);
8850         return err;
8851 }
8852
8853 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
8854                                              struct genl_info *info)
8855 {
8856         struct net_device *dev = info->user_ptr[1];
8857         struct wireless_dev *wdev = dev->ieee80211_ptr;
8858
8859         if (wdev->iftype != NL80211_IFTYPE_AP &&
8860             wdev->iftype != NL80211_IFTYPE_P2P_GO)
8861                 return -EINVAL;
8862
8863         if (wdev->ap_unexpected_nlportid)
8864                 return -EBUSY;
8865
8866         wdev->ap_unexpected_nlportid = info->snd_portid;
8867         return 0;
8868 }
8869
8870 static int nl80211_probe_client(struct sk_buff *skb,
8871                                 struct genl_info *info)
8872 {
8873         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8874         struct net_device *dev = info->user_ptr[1];
8875         struct wireless_dev *wdev = dev->ieee80211_ptr;
8876         struct sk_buff *msg;
8877         void *hdr;
8878         const u8 *addr;
8879         u64 cookie;
8880         int err;
8881
8882         if (wdev->iftype != NL80211_IFTYPE_AP &&
8883             wdev->iftype != NL80211_IFTYPE_P2P_GO)
8884                 return -EOPNOTSUPP;
8885
8886         if (!info->attrs[NL80211_ATTR_MAC])
8887                 return -EINVAL;
8888
8889         if (!rdev->ops->probe_client)
8890                 return -EOPNOTSUPP;
8891
8892         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8893         if (!msg)
8894                 return -ENOMEM;
8895
8896         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8897                              NL80211_CMD_PROBE_CLIENT);
8898         if (!hdr) {
8899                 err = -ENOBUFS;
8900                 goto free_msg;
8901         }
8902
8903         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
8904
8905         err = rdev_probe_client(rdev, dev, addr, &cookie);
8906         if (err)
8907                 goto free_msg;
8908
8909         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8910                 goto nla_put_failure;
8911
8912         genlmsg_end(msg, hdr);
8913
8914         return genlmsg_reply(msg, info);
8915
8916  nla_put_failure:
8917         err = -ENOBUFS;
8918  free_msg:
8919         nlmsg_free(msg);
8920         return err;
8921 }
8922
8923 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
8924 {
8925         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8926         struct cfg80211_beacon_registration *reg, *nreg;
8927         int rv;
8928
8929         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
8930                 return -EOPNOTSUPP;
8931
8932         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
8933         if (!nreg)
8934                 return -ENOMEM;
8935
8936         /* First, check if already registered. */
8937         spin_lock_bh(&rdev->beacon_registrations_lock);
8938         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
8939                 if (reg->nlportid == info->snd_portid) {
8940                         rv = -EALREADY;
8941                         goto out_err;
8942                 }
8943         }
8944         /* Add it to the list */
8945         nreg->nlportid = info->snd_portid;
8946         list_add(&nreg->list, &rdev->beacon_registrations);
8947
8948         spin_unlock_bh(&rdev->beacon_registrations_lock);
8949
8950         return 0;
8951 out_err:
8952         spin_unlock_bh(&rdev->beacon_registrations_lock);
8953         kfree(nreg);
8954         return rv;
8955 }
8956
8957 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
8958 {
8959         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8960         struct wireless_dev *wdev = info->user_ptr[1];
8961         int err;
8962
8963         if (!rdev->ops->start_p2p_device)
8964                 return -EOPNOTSUPP;
8965
8966         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
8967                 return -EOPNOTSUPP;
8968
8969         if (wdev->p2p_started)
8970                 return 0;
8971
8972         if (rfkill_blocked(rdev->rfkill))
8973                 return -ERFKILL;
8974
8975         err = rdev_start_p2p_device(rdev, wdev);
8976         if (err)
8977                 return err;
8978
8979         wdev->p2p_started = true;
8980         rdev->opencount++;
8981
8982         return 0;
8983 }
8984
8985 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
8986 {
8987         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8988         struct wireless_dev *wdev = info->user_ptr[1];
8989
8990         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
8991                 return -EOPNOTSUPP;
8992
8993         if (!rdev->ops->stop_p2p_device)
8994                 return -EOPNOTSUPP;
8995
8996         cfg80211_stop_p2p_device(rdev, wdev);
8997
8998         return 0;
8999 }
9000
9001 static int nl80211_get_protocol_features(struct sk_buff *skb,
9002                                          struct genl_info *info)
9003 {
9004         void *hdr;
9005         struct sk_buff *msg;
9006
9007         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9008         if (!msg)
9009                 return -ENOMEM;
9010
9011         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9012                              NL80211_CMD_GET_PROTOCOL_FEATURES);
9013         if (!hdr)
9014                 goto nla_put_failure;
9015
9016         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
9017                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
9018                 goto nla_put_failure;
9019
9020         genlmsg_end(msg, hdr);
9021         return genlmsg_reply(msg, info);
9022
9023  nla_put_failure:
9024         kfree_skb(msg);
9025         return -ENOBUFS;
9026 }
9027
9028 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
9029 {
9030         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9031         struct cfg80211_update_ft_ies_params ft_params;
9032         struct net_device *dev = info->user_ptr[1];
9033
9034         if (!rdev->ops->update_ft_ies)
9035                 return -EOPNOTSUPP;
9036
9037         if (!info->attrs[NL80211_ATTR_MDID] ||
9038             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
9039                 return -EINVAL;
9040
9041         memset(&ft_params, 0, sizeof(ft_params));
9042         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
9043         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9044         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9045
9046         return rdev_update_ft_ies(rdev, dev, &ft_params);
9047 }
9048
9049 static int nl80211_crit_protocol_start(struct sk_buff *skb,
9050                                        struct genl_info *info)
9051 {
9052         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9053         struct wireless_dev *wdev = info->user_ptr[1];
9054         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
9055         u16 duration;
9056         int ret;
9057
9058         if (!rdev->ops->crit_proto_start)
9059                 return -EOPNOTSUPP;
9060
9061         if (WARN_ON(!rdev->ops->crit_proto_stop))
9062                 return -EINVAL;
9063
9064         if (rdev->crit_proto_nlportid)
9065                 return -EBUSY;
9066
9067         /* determine protocol if provided */
9068         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
9069                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
9070
9071         if (proto >= NUM_NL80211_CRIT_PROTO)
9072                 return -EINVAL;
9073
9074         /* timeout must be provided */
9075         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
9076                 return -EINVAL;
9077
9078         duration =
9079                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
9080
9081         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
9082                 return -ERANGE;
9083
9084         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
9085         if (!ret)
9086                 rdev->crit_proto_nlportid = info->snd_portid;
9087
9088         return ret;
9089 }
9090
9091 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
9092                                       struct genl_info *info)
9093 {
9094         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9095         struct wireless_dev *wdev = info->user_ptr[1];
9096
9097         if (!rdev->ops->crit_proto_stop)
9098                 return -EOPNOTSUPP;
9099
9100         if (rdev->crit_proto_nlportid) {
9101                 rdev->crit_proto_nlportid = 0;
9102                 rdev_crit_proto_stop(rdev, wdev);
9103         }
9104         return 0;
9105 }
9106
9107 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
9108 {
9109         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9110         struct wireless_dev *wdev =
9111                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
9112         int i, err;
9113         u32 vid, subcmd;
9114
9115         if (!rdev->wiphy.vendor_commands)
9116                 return -EOPNOTSUPP;
9117
9118         if (IS_ERR(wdev)) {
9119                 err = PTR_ERR(wdev);
9120                 if (err != -EINVAL)
9121                         return err;
9122                 wdev = NULL;
9123         } else if (wdev->wiphy != &rdev->wiphy) {
9124                 return -EINVAL;
9125         }
9126
9127         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
9128             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
9129                 return -EINVAL;
9130
9131         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
9132         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
9133         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
9134                 const struct wiphy_vendor_command *vcmd;
9135                 void *data = NULL;
9136                 int len = 0;
9137
9138                 vcmd = &rdev->wiphy.vendor_commands[i];
9139
9140                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
9141                         continue;
9142
9143                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
9144                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
9145                         if (!wdev)
9146                                 return -EINVAL;
9147                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
9148                             !wdev->netdev)
9149                                 return -EINVAL;
9150
9151                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
9152                                 if (wdev->netdev &&
9153                                     !netif_running(wdev->netdev))
9154                                         return -ENETDOWN;
9155                                 if (!wdev->netdev && !wdev->p2p_started)
9156                                         return -ENETDOWN;
9157                         }
9158                 } else {
9159                         wdev = NULL;
9160                 }
9161
9162                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
9163                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
9164                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
9165                 }
9166
9167                 rdev->cur_cmd_info = info;
9168                 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
9169                                                           data, len);
9170                 rdev->cur_cmd_info = NULL;
9171                 return err;
9172         }
9173
9174         return -EOPNOTSUPP;
9175 }
9176
9177 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
9178                                            enum nl80211_commands cmd,
9179                                            enum nl80211_attrs attr,
9180                                            int approxlen)
9181 {
9182         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
9183
9184         if (WARN_ON(!rdev->cur_cmd_info))
9185                 return NULL;
9186
9187         return __cfg80211_alloc_vendor_skb(rdev, approxlen,
9188                                            rdev->cur_cmd_info->snd_portid,
9189                                            rdev->cur_cmd_info->snd_seq,
9190                                            cmd, attr, NULL, GFP_KERNEL);
9191 }
9192 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
9193
9194 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
9195 {
9196         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
9197         void *hdr = ((void **)skb->cb)[1];
9198         struct nlattr *data = ((void **)skb->cb)[2];
9199
9200         if (WARN_ON(!rdev->cur_cmd_info)) {
9201                 kfree_skb(skb);
9202                 return -EINVAL;
9203         }
9204
9205         nla_nest_end(skb, data);
9206         genlmsg_end(skb, hdr);
9207         return genlmsg_reply(skb, rdev->cur_cmd_info);
9208 }
9209 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
9210
9211
9212 static int nl80211_set_qos_map(struct sk_buff *skb,
9213                                struct genl_info *info)
9214 {
9215         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9216         struct cfg80211_qos_map *qos_map = NULL;
9217         struct net_device *dev = info->user_ptr[1];
9218         u8 *pos, len, num_des, des_len, des;
9219         int ret;
9220
9221         if (!rdev->ops->set_qos_map)
9222                 return -EOPNOTSUPP;
9223
9224         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
9225                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
9226                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
9227
9228                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
9229                     len > IEEE80211_QOS_MAP_LEN_MAX)
9230                         return -EINVAL;
9231
9232                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
9233                 if (!qos_map)
9234                         return -ENOMEM;
9235
9236                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
9237                 if (num_des) {
9238                         des_len = num_des *
9239                                 sizeof(struct cfg80211_dscp_exception);
9240                         memcpy(qos_map->dscp_exception, pos, des_len);
9241                         qos_map->num_des = num_des;
9242                         for (des = 0; des < num_des; des++) {
9243                                 if (qos_map->dscp_exception[des].up > 7) {
9244                                         kfree(qos_map);
9245                                         return -EINVAL;
9246                                 }
9247                         }
9248                         pos += des_len;
9249                 }
9250                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
9251         }
9252
9253         wdev_lock(dev->ieee80211_ptr);
9254         ret = nl80211_key_allowed(dev->ieee80211_ptr);
9255         if (!ret)
9256                 ret = rdev_set_qos_map(rdev, dev, qos_map);
9257         wdev_unlock(dev->ieee80211_ptr);
9258
9259         kfree(qos_map);
9260         return ret;
9261 }
9262
9263 #define NL80211_FLAG_NEED_WIPHY         0x01
9264 #define NL80211_FLAG_NEED_NETDEV        0x02
9265 #define NL80211_FLAG_NEED_RTNL          0x04
9266 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
9267 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
9268                                          NL80211_FLAG_CHECK_NETDEV_UP)
9269 #define NL80211_FLAG_NEED_WDEV          0x10
9270 /* If a netdev is associated, it must be UP, P2P must be started */
9271 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
9272                                          NL80211_FLAG_CHECK_NETDEV_UP)
9273
9274 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
9275                             struct genl_info *info)
9276 {
9277         struct cfg80211_registered_device *rdev;
9278         struct wireless_dev *wdev;
9279         struct net_device *dev;
9280         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
9281
9282         if (rtnl)
9283                 rtnl_lock();
9284
9285         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
9286                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
9287                 if (IS_ERR(rdev)) {
9288                         if (rtnl)
9289                                 rtnl_unlock();
9290                         return PTR_ERR(rdev);
9291                 }
9292                 info->user_ptr[0] = rdev;
9293         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
9294                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
9295                 ASSERT_RTNL();
9296
9297                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
9298                                                   info->attrs);
9299                 if (IS_ERR(wdev)) {
9300                         if (rtnl)
9301                                 rtnl_unlock();
9302                         return PTR_ERR(wdev);
9303                 }
9304
9305                 dev = wdev->netdev;
9306                 rdev = wiphy_to_rdev(wdev->wiphy);
9307
9308                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
9309                         if (!dev) {
9310                                 if (rtnl)
9311                                         rtnl_unlock();
9312                                 return -EINVAL;
9313                         }
9314
9315                         info->user_ptr[1] = dev;
9316                 } else {
9317                         info->user_ptr[1] = wdev;
9318                 }
9319
9320                 if (dev) {
9321                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
9322                             !netif_running(dev)) {
9323                                 if (rtnl)
9324                                         rtnl_unlock();
9325                                 return -ENETDOWN;
9326                         }
9327
9328                         dev_hold(dev);
9329                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
9330                         if (!wdev->p2p_started) {
9331                                 if (rtnl)
9332                                         rtnl_unlock();
9333                                 return -ENETDOWN;
9334                         }
9335                 }
9336
9337                 info->user_ptr[0] = rdev;
9338         }
9339
9340         return 0;
9341 }
9342
9343 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
9344                               struct genl_info *info)
9345 {
9346         if (info->user_ptr[1]) {
9347                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
9348                         struct wireless_dev *wdev = info->user_ptr[1];
9349
9350                         if (wdev->netdev)
9351                                 dev_put(wdev->netdev);
9352                 } else {
9353                         dev_put(info->user_ptr[1]);
9354                 }
9355         }
9356         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
9357                 rtnl_unlock();
9358 }
9359
9360 static const struct genl_ops nl80211_ops[] = {
9361         {
9362                 .cmd = NL80211_CMD_GET_WIPHY,
9363                 .doit = nl80211_get_wiphy,
9364                 .dumpit = nl80211_dump_wiphy,
9365                 .done = nl80211_dump_wiphy_done,
9366                 .policy = nl80211_policy,
9367                 /* can be retrieved by unprivileged users */
9368                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9369                                   NL80211_FLAG_NEED_RTNL,
9370         },
9371         {
9372                 .cmd = NL80211_CMD_SET_WIPHY,
9373                 .doit = nl80211_set_wiphy,
9374                 .policy = nl80211_policy,
9375                 .flags = GENL_ADMIN_PERM,
9376                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9377         },
9378         {
9379                 .cmd = NL80211_CMD_GET_INTERFACE,
9380                 .doit = nl80211_get_interface,
9381                 .dumpit = nl80211_dump_interface,
9382                 .policy = nl80211_policy,
9383                 /* can be retrieved by unprivileged users */
9384                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9385                                   NL80211_FLAG_NEED_RTNL,
9386         },
9387         {
9388                 .cmd = NL80211_CMD_SET_INTERFACE,
9389                 .doit = nl80211_set_interface,
9390                 .policy = nl80211_policy,
9391                 .flags = GENL_ADMIN_PERM,
9392                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9393                                   NL80211_FLAG_NEED_RTNL,
9394         },
9395         {
9396                 .cmd = NL80211_CMD_NEW_INTERFACE,
9397                 .doit = nl80211_new_interface,
9398                 .policy = nl80211_policy,
9399                 .flags = GENL_ADMIN_PERM,
9400                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9401                                   NL80211_FLAG_NEED_RTNL,
9402         },
9403         {
9404                 .cmd = NL80211_CMD_DEL_INTERFACE,
9405                 .doit = nl80211_del_interface,
9406                 .policy = nl80211_policy,
9407                 .flags = GENL_ADMIN_PERM,
9408                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9409                                   NL80211_FLAG_NEED_RTNL,
9410         },
9411         {
9412                 .cmd = NL80211_CMD_GET_KEY,
9413                 .doit = nl80211_get_key,
9414                 .policy = nl80211_policy,
9415                 .flags = GENL_ADMIN_PERM,
9416                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9417                                   NL80211_FLAG_NEED_RTNL,
9418         },
9419         {
9420                 .cmd = NL80211_CMD_SET_KEY,
9421                 .doit = nl80211_set_key,
9422                 .policy = nl80211_policy,
9423                 .flags = GENL_ADMIN_PERM,
9424                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9425                                   NL80211_FLAG_NEED_RTNL,
9426         },
9427         {
9428                 .cmd = NL80211_CMD_NEW_KEY,
9429                 .doit = nl80211_new_key,
9430                 .policy = nl80211_policy,
9431                 .flags = GENL_ADMIN_PERM,
9432                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9433                                   NL80211_FLAG_NEED_RTNL,
9434         },
9435         {
9436                 .cmd = NL80211_CMD_DEL_KEY,
9437                 .doit = nl80211_del_key,
9438                 .policy = nl80211_policy,
9439                 .flags = GENL_ADMIN_PERM,
9440                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9441                                   NL80211_FLAG_NEED_RTNL,
9442         },
9443         {
9444                 .cmd = NL80211_CMD_SET_BEACON,
9445                 .policy = nl80211_policy,
9446                 .flags = GENL_ADMIN_PERM,
9447                 .doit = nl80211_set_beacon,
9448                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9449                                   NL80211_FLAG_NEED_RTNL,
9450         },
9451         {
9452                 .cmd = NL80211_CMD_START_AP,
9453                 .policy = nl80211_policy,
9454                 .flags = GENL_ADMIN_PERM,
9455                 .doit = nl80211_start_ap,
9456                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9457                                   NL80211_FLAG_NEED_RTNL,
9458         },
9459         {
9460                 .cmd = NL80211_CMD_STOP_AP,
9461                 .policy = nl80211_policy,
9462                 .flags = GENL_ADMIN_PERM,
9463                 .doit = nl80211_stop_ap,
9464                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9465                                   NL80211_FLAG_NEED_RTNL,
9466         },
9467         {
9468                 .cmd = NL80211_CMD_GET_STATION,
9469                 .doit = nl80211_get_station,
9470                 .dumpit = nl80211_dump_station,
9471                 .policy = nl80211_policy,
9472                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9473                                   NL80211_FLAG_NEED_RTNL,
9474         },
9475         {
9476                 .cmd = NL80211_CMD_SET_STATION,
9477                 .doit = nl80211_set_station,
9478                 .policy = nl80211_policy,
9479                 .flags = GENL_ADMIN_PERM,
9480                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9481                                   NL80211_FLAG_NEED_RTNL,
9482         },
9483         {
9484                 .cmd = NL80211_CMD_NEW_STATION,
9485                 .doit = nl80211_new_station,
9486                 .policy = nl80211_policy,
9487                 .flags = GENL_ADMIN_PERM,
9488                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9489                                   NL80211_FLAG_NEED_RTNL,
9490         },
9491         {
9492                 .cmd = NL80211_CMD_DEL_STATION,
9493                 .doit = nl80211_del_station,
9494                 .policy = nl80211_policy,
9495                 .flags = GENL_ADMIN_PERM,
9496                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9497                                   NL80211_FLAG_NEED_RTNL,
9498         },
9499         {
9500                 .cmd = NL80211_CMD_GET_MPATH,
9501                 .doit = nl80211_get_mpath,
9502                 .dumpit = nl80211_dump_mpath,
9503                 .policy = nl80211_policy,
9504                 .flags = GENL_ADMIN_PERM,
9505                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9506                                   NL80211_FLAG_NEED_RTNL,
9507         },
9508         {
9509                 .cmd = NL80211_CMD_SET_MPATH,
9510                 .doit = nl80211_set_mpath,
9511                 .policy = nl80211_policy,
9512                 .flags = GENL_ADMIN_PERM,
9513                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9514                                   NL80211_FLAG_NEED_RTNL,
9515         },
9516         {
9517                 .cmd = NL80211_CMD_NEW_MPATH,
9518                 .doit = nl80211_new_mpath,
9519                 .policy = nl80211_policy,
9520                 .flags = GENL_ADMIN_PERM,
9521                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9522                                   NL80211_FLAG_NEED_RTNL,
9523         },
9524         {
9525                 .cmd = NL80211_CMD_DEL_MPATH,
9526                 .doit = nl80211_del_mpath,
9527                 .policy = nl80211_policy,
9528                 .flags = GENL_ADMIN_PERM,
9529                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9530                                   NL80211_FLAG_NEED_RTNL,
9531         },
9532         {
9533                 .cmd = NL80211_CMD_SET_BSS,
9534                 .doit = nl80211_set_bss,
9535                 .policy = nl80211_policy,
9536                 .flags = GENL_ADMIN_PERM,
9537                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9538                                   NL80211_FLAG_NEED_RTNL,
9539         },
9540         {
9541                 .cmd = NL80211_CMD_GET_REG,
9542                 .doit = nl80211_get_reg,
9543                 .policy = nl80211_policy,
9544                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9545                 /* can be retrieved by unprivileged users */
9546         },
9547         {
9548                 .cmd = NL80211_CMD_SET_REG,
9549                 .doit = nl80211_set_reg,
9550                 .policy = nl80211_policy,
9551                 .flags = GENL_ADMIN_PERM,
9552                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9553         },
9554         {
9555                 .cmd = NL80211_CMD_REQ_SET_REG,
9556                 .doit = nl80211_req_set_reg,
9557                 .policy = nl80211_policy,
9558                 .flags = GENL_ADMIN_PERM,
9559         },
9560         {
9561                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
9562                 .doit = nl80211_get_mesh_config,
9563                 .policy = nl80211_policy,
9564                 /* can be retrieved by unprivileged users */
9565                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9566                                   NL80211_FLAG_NEED_RTNL,
9567         },
9568         {
9569                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
9570                 .doit = nl80211_update_mesh_config,
9571                 .policy = nl80211_policy,
9572                 .flags = GENL_ADMIN_PERM,
9573                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9574                                   NL80211_FLAG_NEED_RTNL,
9575         },
9576         {
9577                 .cmd = NL80211_CMD_TRIGGER_SCAN,
9578                 .doit = nl80211_trigger_scan,
9579                 .policy = nl80211_policy,
9580                 .flags = GENL_ADMIN_PERM,
9581                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9582                                   NL80211_FLAG_NEED_RTNL,
9583         },
9584         {
9585                 .cmd = NL80211_CMD_GET_SCAN,
9586                 .policy = nl80211_policy,
9587                 .dumpit = nl80211_dump_scan,
9588         },
9589         {
9590                 .cmd = NL80211_CMD_START_SCHED_SCAN,
9591                 .doit = nl80211_start_sched_scan,
9592                 .policy = nl80211_policy,
9593                 .flags = GENL_ADMIN_PERM,
9594                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9595                                   NL80211_FLAG_NEED_RTNL,
9596         },
9597         {
9598                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
9599                 .doit = nl80211_stop_sched_scan,
9600                 .policy = nl80211_policy,
9601                 .flags = GENL_ADMIN_PERM,
9602                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9603                                   NL80211_FLAG_NEED_RTNL,
9604         },
9605         {
9606                 .cmd = NL80211_CMD_AUTHENTICATE,
9607                 .doit = nl80211_authenticate,
9608                 .policy = nl80211_policy,
9609                 .flags = GENL_ADMIN_PERM,
9610                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9611                                   NL80211_FLAG_NEED_RTNL,
9612         },
9613         {
9614                 .cmd = NL80211_CMD_ASSOCIATE,
9615                 .doit = nl80211_associate,
9616                 .policy = nl80211_policy,
9617                 .flags = GENL_ADMIN_PERM,
9618                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9619                                   NL80211_FLAG_NEED_RTNL,
9620         },
9621         {
9622                 .cmd = NL80211_CMD_DEAUTHENTICATE,
9623                 .doit = nl80211_deauthenticate,
9624                 .policy = nl80211_policy,
9625                 .flags = GENL_ADMIN_PERM,
9626                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9627                                   NL80211_FLAG_NEED_RTNL,
9628         },
9629         {
9630                 .cmd = NL80211_CMD_DISASSOCIATE,
9631                 .doit = nl80211_disassociate,
9632                 .policy = nl80211_policy,
9633                 .flags = GENL_ADMIN_PERM,
9634                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9635                                   NL80211_FLAG_NEED_RTNL,
9636         },
9637         {
9638                 .cmd = NL80211_CMD_JOIN_IBSS,
9639                 .doit = nl80211_join_ibss,
9640                 .policy = nl80211_policy,
9641                 .flags = GENL_ADMIN_PERM,
9642                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9643                                   NL80211_FLAG_NEED_RTNL,
9644         },
9645         {
9646                 .cmd = NL80211_CMD_LEAVE_IBSS,
9647                 .doit = nl80211_leave_ibss,
9648                 .policy = nl80211_policy,
9649                 .flags = GENL_ADMIN_PERM,
9650                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9651                                   NL80211_FLAG_NEED_RTNL,
9652         },
9653 #ifdef CONFIG_NL80211_TESTMODE
9654         {
9655                 .cmd = NL80211_CMD_TESTMODE,
9656                 .doit = nl80211_testmode_do,
9657                 .dumpit = nl80211_testmode_dump,
9658                 .policy = nl80211_policy,
9659                 .flags = GENL_ADMIN_PERM,
9660                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9661                                   NL80211_FLAG_NEED_RTNL,
9662         },
9663 #endif
9664         {
9665                 .cmd = NL80211_CMD_CONNECT,
9666                 .doit = nl80211_connect,
9667                 .policy = nl80211_policy,
9668                 .flags = GENL_ADMIN_PERM,
9669                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9670                                   NL80211_FLAG_NEED_RTNL,
9671         },
9672         {
9673                 .cmd = NL80211_CMD_DISCONNECT,
9674                 .doit = nl80211_disconnect,
9675                 .policy = nl80211_policy,
9676                 .flags = GENL_ADMIN_PERM,
9677                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9678                                   NL80211_FLAG_NEED_RTNL,
9679         },
9680         {
9681                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
9682                 .doit = nl80211_wiphy_netns,
9683                 .policy = nl80211_policy,
9684                 .flags = GENL_ADMIN_PERM,
9685                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9686                                   NL80211_FLAG_NEED_RTNL,
9687         },
9688         {
9689                 .cmd = NL80211_CMD_GET_SURVEY,
9690                 .policy = nl80211_policy,
9691                 .dumpit = nl80211_dump_survey,
9692         },
9693         {
9694                 .cmd = NL80211_CMD_SET_PMKSA,
9695                 .doit = nl80211_setdel_pmksa,
9696                 .policy = nl80211_policy,
9697                 .flags = GENL_ADMIN_PERM,
9698                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9699                                   NL80211_FLAG_NEED_RTNL,
9700         },
9701         {
9702                 .cmd = NL80211_CMD_DEL_PMKSA,
9703                 .doit = nl80211_setdel_pmksa,
9704                 .policy = nl80211_policy,
9705                 .flags = GENL_ADMIN_PERM,
9706                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9707                                   NL80211_FLAG_NEED_RTNL,
9708         },
9709         {
9710                 .cmd = NL80211_CMD_FLUSH_PMKSA,
9711                 .doit = nl80211_flush_pmksa,
9712                 .policy = nl80211_policy,
9713                 .flags = GENL_ADMIN_PERM,
9714                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9715                                   NL80211_FLAG_NEED_RTNL,
9716         },
9717         {
9718                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
9719                 .doit = nl80211_remain_on_channel,
9720                 .policy = nl80211_policy,
9721                 .flags = GENL_ADMIN_PERM,
9722                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9723                                   NL80211_FLAG_NEED_RTNL,
9724         },
9725         {
9726                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
9727                 .doit = nl80211_cancel_remain_on_channel,
9728                 .policy = nl80211_policy,
9729                 .flags = GENL_ADMIN_PERM,
9730                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9731                                   NL80211_FLAG_NEED_RTNL,
9732         },
9733         {
9734                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
9735                 .doit = nl80211_set_tx_bitrate_mask,
9736                 .policy = nl80211_policy,
9737                 .flags = GENL_ADMIN_PERM,
9738                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9739                                   NL80211_FLAG_NEED_RTNL,
9740         },
9741         {
9742                 .cmd = NL80211_CMD_REGISTER_FRAME,
9743                 .doit = nl80211_register_mgmt,
9744                 .policy = nl80211_policy,
9745                 .flags = GENL_ADMIN_PERM,
9746                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9747                                   NL80211_FLAG_NEED_RTNL,
9748         },
9749         {
9750                 .cmd = NL80211_CMD_FRAME,
9751                 .doit = nl80211_tx_mgmt,
9752                 .policy = nl80211_policy,
9753                 .flags = GENL_ADMIN_PERM,
9754                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9755                                   NL80211_FLAG_NEED_RTNL,
9756         },
9757         {
9758                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
9759                 .doit = nl80211_tx_mgmt_cancel_wait,
9760                 .policy = nl80211_policy,
9761                 .flags = GENL_ADMIN_PERM,
9762                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9763                                   NL80211_FLAG_NEED_RTNL,
9764         },
9765         {
9766                 .cmd = NL80211_CMD_SET_POWER_SAVE,
9767                 .doit = nl80211_set_power_save,
9768                 .policy = nl80211_policy,
9769                 .flags = GENL_ADMIN_PERM,
9770                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9771                                   NL80211_FLAG_NEED_RTNL,
9772         },
9773         {
9774                 .cmd = NL80211_CMD_GET_POWER_SAVE,
9775                 .doit = nl80211_get_power_save,
9776                 .policy = nl80211_policy,
9777                 /* can be retrieved by unprivileged users */
9778                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9779                                   NL80211_FLAG_NEED_RTNL,
9780         },
9781         {
9782                 .cmd = NL80211_CMD_SET_CQM,
9783                 .doit = nl80211_set_cqm,
9784                 .policy = nl80211_policy,
9785                 .flags = GENL_ADMIN_PERM,
9786                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9787                                   NL80211_FLAG_NEED_RTNL,
9788         },
9789         {
9790                 .cmd = NL80211_CMD_SET_CHANNEL,
9791                 .doit = nl80211_set_channel,
9792                 .policy = nl80211_policy,
9793                 .flags = GENL_ADMIN_PERM,
9794                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9795                                   NL80211_FLAG_NEED_RTNL,
9796         },
9797         {
9798                 .cmd = NL80211_CMD_SET_WDS_PEER,
9799                 .doit = nl80211_set_wds_peer,
9800                 .policy = nl80211_policy,
9801                 .flags = GENL_ADMIN_PERM,
9802                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9803                                   NL80211_FLAG_NEED_RTNL,
9804         },
9805         {
9806                 .cmd = NL80211_CMD_JOIN_MESH,
9807                 .doit = nl80211_join_mesh,
9808                 .policy = nl80211_policy,
9809                 .flags = GENL_ADMIN_PERM,
9810                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9811                                   NL80211_FLAG_NEED_RTNL,
9812         },
9813         {
9814                 .cmd = NL80211_CMD_LEAVE_MESH,
9815                 .doit = nl80211_leave_mesh,
9816                 .policy = nl80211_policy,
9817                 .flags = GENL_ADMIN_PERM,
9818                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9819                                   NL80211_FLAG_NEED_RTNL,
9820         },
9821 #ifdef CONFIG_PM
9822         {
9823                 .cmd = NL80211_CMD_GET_WOWLAN,
9824                 .doit = nl80211_get_wowlan,
9825                 .policy = nl80211_policy,
9826                 /* can be retrieved by unprivileged users */
9827                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9828                                   NL80211_FLAG_NEED_RTNL,
9829         },
9830         {
9831                 .cmd = NL80211_CMD_SET_WOWLAN,
9832                 .doit = nl80211_set_wowlan,
9833                 .policy = nl80211_policy,
9834                 .flags = GENL_ADMIN_PERM,
9835                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9836                                   NL80211_FLAG_NEED_RTNL,
9837         },
9838 #endif
9839         {
9840                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
9841                 .doit = nl80211_set_rekey_data,
9842                 .policy = nl80211_policy,
9843                 .flags = GENL_ADMIN_PERM,
9844                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9845                                   NL80211_FLAG_NEED_RTNL,
9846         },
9847         {
9848                 .cmd = NL80211_CMD_TDLS_MGMT,
9849                 .doit = nl80211_tdls_mgmt,
9850                 .policy = nl80211_policy,
9851                 .flags = GENL_ADMIN_PERM,
9852                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9853                                   NL80211_FLAG_NEED_RTNL,
9854         },
9855         {
9856                 .cmd = NL80211_CMD_TDLS_OPER,
9857                 .doit = nl80211_tdls_oper,
9858                 .policy = nl80211_policy,
9859                 .flags = GENL_ADMIN_PERM,
9860                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9861                                   NL80211_FLAG_NEED_RTNL,
9862         },
9863         {
9864                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
9865                 .doit = nl80211_register_unexpected_frame,
9866                 .policy = nl80211_policy,
9867                 .flags = GENL_ADMIN_PERM,
9868                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9869                                   NL80211_FLAG_NEED_RTNL,
9870         },
9871         {
9872                 .cmd = NL80211_CMD_PROBE_CLIENT,
9873                 .doit = nl80211_probe_client,
9874                 .policy = nl80211_policy,
9875                 .flags = GENL_ADMIN_PERM,
9876                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9877                                   NL80211_FLAG_NEED_RTNL,
9878         },
9879         {
9880                 .cmd = NL80211_CMD_REGISTER_BEACONS,
9881                 .doit = nl80211_register_beacons,
9882                 .policy = nl80211_policy,
9883                 .flags = GENL_ADMIN_PERM,
9884                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9885                                   NL80211_FLAG_NEED_RTNL,
9886         },
9887         {
9888                 .cmd = NL80211_CMD_SET_NOACK_MAP,
9889                 .doit = nl80211_set_noack_map,
9890                 .policy = nl80211_policy,
9891                 .flags = GENL_ADMIN_PERM,
9892                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9893                                   NL80211_FLAG_NEED_RTNL,
9894         },
9895         {
9896                 .cmd = NL80211_CMD_START_P2P_DEVICE,
9897                 .doit = nl80211_start_p2p_device,
9898                 .policy = nl80211_policy,
9899                 .flags = GENL_ADMIN_PERM,
9900                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9901                                   NL80211_FLAG_NEED_RTNL,
9902         },
9903         {
9904                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
9905                 .doit = nl80211_stop_p2p_device,
9906                 .policy = nl80211_policy,
9907                 .flags = GENL_ADMIN_PERM,
9908                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9909                                   NL80211_FLAG_NEED_RTNL,
9910         },
9911         {
9912                 .cmd = NL80211_CMD_SET_MCAST_RATE,
9913                 .doit = nl80211_set_mcast_rate,
9914                 .policy = nl80211_policy,
9915                 .flags = GENL_ADMIN_PERM,
9916                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9917                                   NL80211_FLAG_NEED_RTNL,
9918         },
9919         {
9920                 .cmd = NL80211_CMD_SET_MAC_ACL,
9921                 .doit = nl80211_set_mac_acl,
9922                 .policy = nl80211_policy,
9923                 .flags = GENL_ADMIN_PERM,
9924                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9925                                   NL80211_FLAG_NEED_RTNL,
9926         },
9927         {
9928                 .cmd = NL80211_CMD_RADAR_DETECT,
9929                 .doit = nl80211_start_radar_detection,
9930                 .policy = nl80211_policy,
9931                 .flags = GENL_ADMIN_PERM,
9932                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9933                                   NL80211_FLAG_NEED_RTNL,
9934         },
9935         {
9936                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
9937                 .doit = nl80211_get_protocol_features,
9938                 .policy = nl80211_policy,
9939         },
9940         {
9941                 .cmd = NL80211_CMD_UPDATE_FT_IES,
9942                 .doit = nl80211_update_ft_ies,
9943                 .policy = nl80211_policy,
9944                 .flags = GENL_ADMIN_PERM,
9945                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9946                                   NL80211_FLAG_NEED_RTNL,
9947         },
9948         {
9949                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
9950                 .doit = nl80211_crit_protocol_start,
9951                 .policy = nl80211_policy,
9952                 .flags = GENL_ADMIN_PERM,
9953                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9954                                   NL80211_FLAG_NEED_RTNL,
9955         },
9956         {
9957                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
9958                 .doit = nl80211_crit_protocol_stop,
9959                 .policy = nl80211_policy,
9960                 .flags = GENL_ADMIN_PERM,
9961                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9962                                   NL80211_FLAG_NEED_RTNL,
9963         },
9964         {
9965                 .cmd = NL80211_CMD_GET_COALESCE,
9966                 .doit = nl80211_get_coalesce,
9967                 .policy = nl80211_policy,
9968                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9969                                   NL80211_FLAG_NEED_RTNL,
9970         },
9971         {
9972                 .cmd = NL80211_CMD_SET_COALESCE,
9973                 .doit = nl80211_set_coalesce,
9974                 .policy = nl80211_policy,
9975                 .flags = GENL_ADMIN_PERM,
9976                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9977                                   NL80211_FLAG_NEED_RTNL,
9978         },
9979         {
9980                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
9981                 .doit = nl80211_channel_switch,
9982                 .policy = nl80211_policy,
9983                 .flags = GENL_ADMIN_PERM,
9984                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9985                                   NL80211_FLAG_NEED_RTNL,
9986         },
9987         {
9988                 .cmd = NL80211_CMD_VENDOR,
9989                 .doit = nl80211_vendor_cmd,
9990                 .policy = nl80211_policy,
9991                 .flags = GENL_ADMIN_PERM,
9992                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9993                                   NL80211_FLAG_NEED_RTNL,
9994         },
9995         {
9996                 .cmd = NL80211_CMD_SET_QOS_MAP,
9997                 .doit = nl80211_set_qos_map,
9998                 .policy = nl80211_policy,
9999                 .flags = GENL_ADMIN_PERM,
10000                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10001                                   NL80211_FLAG_NEED_RTNL,
10002         },
10003 };
10004
10005 /* notification functions */
10006
10007 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
10008 {
10009         struct sk_buff *msg;
10010         struct nl80211_dump_wiphy_state state = {};
10011
10012         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10013         if (!msg)
10014                 return;
10015
10016         if (nl80211_send_wiphy(rdev, msg, 0, 0, 0, &state) < 0) {
10017                 nlmsg_free(msg);
10018                 return;
10019         }
10020
10021         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10022                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
10023 }
10024
10025 static int nl80211_add_scan_req(struct sk_buff *msg,
10026                                 struct cfg80211_registered_device *rdev)
10027 {
10028         struct cfg80211_scan_request *req = rdev->scan_req;
10029         struct nlattr *nest;
10030         int i;
10031
10032         if (WARN_ON(!req))
10033                 return 0;
10034
10035         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
10036         if (!nest)
10037                 goto nla_put_failure;
10038         for (i = 0; i < req->n_ssids; i++) {
10039                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
10040                         goto nla_put_failure;
10041         }
10042         nla_nest_end(msg, nest);
10043
10044         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
10045         if (!nest)
10046                 goto nla_put_failure;
10047         for (i = 0; i < req->n_channels; i++) {
10048                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
10049                         goto nla_put_failure;
10050         }
10051         nla_nest_end(msg, nest);
10052
10053         if (req->ie &&
10054             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
10055                 goto nla_put_failure;
10056
10057         if (req->flags &&
10058             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
10059                 goto nla_put_failure;
10060
10061         return 0;
10062  nla_put_failure:
10063         return -ENOBUFS;
10064 }
10065
10066 static int nl80211_send_scan_msg(struct sk_buff *msg,
10067                                  struct cfg80211_registered_device *rdev,
10068                                  struct wireless_dev *wdev,
10069                                  u32 portid, u32 seq, int flags,
10070                                  u32 cmd)
10071 {
10072         void *hdr;
10073
10074         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
10075         if (!hdr)
10076                 return -1;
10077
10078         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10079             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10080                                          wdev->netdev->ifindex)) ||
10081             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10082                 goto nla_put_failure;
10083
10084         /* ignore errors and send incomplete event anyway */
10085         nl80211_add_scan_req(msg, rdev);
10086
10087         return genlmsg_end(msg, hdr);
10088
10089  nla_put_failure:
10090         genlmsg_cancel(msg, hdr);
10091         return -EMSGSIZE;
10092 }
10093
10094 static int
10095 nl80211_send_sched_scan_msg(struct sk_buff *msg,
10096                             struct cfg80211_registered_device *rdev,
10097                             struct net_device *netdev,
10098                             u32 portid, u32 seq, int flags, u32 cmd)
10099 {
10100         void *hdr;
10101
10102         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
10103         if (!hdr)
10104                 return -1;
10105
10106         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10107             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
10108                 goto nla_put_failure;
10109
10110         return genlmsg_end(msg, hdr);
10111
10112  nla_put_failure:
10113         genlmsg_cancel(msg, hdr);
10114         return -EMSGSIZE;
10115 }
10116
10117 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
10118                              struct wireless_dev *wdev)
10119 {
10120         struct sk_buff *msg;
10121
10122         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10123         if (!msg)
10124                 return;
10125
10126         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
10127                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
10128                 nlmsg_free(msg);
10129                 return;
10130         }
10131
10132         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10133                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10134 }
10135
10136 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
10137                                        struct wireless_dev *wdev, bool aborted)
10138 {
10139         struct sk_buff *msg;
10140
10141         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10142         if (!msg)
10143                 return NULL;
10144
10145         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
10146                                   aborted ? NL80211_CMD_SCAN_ABORTED :
10147                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
10148                 nlmsg_free(msg);
10149                 return NULL;
10150         }
10151
10152         return msg;
10153 }
10154
10155 void nl80211_send_scan_result(struct cfg80211_registered_device *rdev,
10156                               struct sk_buff *msg)
10157 {
10158         if (!msg)
10159                 return;
10160
10161         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10162                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10163 }
10164
10165 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
10166                                      struct net_device *netdev)
10167 {
10168         struct sk_buff *msg;
10169
10170         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10171         if (!msg)
10172                 return;
10173
10174         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
10175                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
10176                 nlmsg_free(msg);
10177                 return;
10178         }
10179
10180         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10181                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10182 }
10183
10184 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
10185                              struct net_device *netdev, u32 cmd)
10186 {
10187         struct sk_buff *msg;
10188
10189         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10190         if (!msg)
10191                 return;
10192
10193         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
10194                 nlmsg_free(msg);
10195                 return;
10196         }
10197
10198         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10199                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10200 }
10201
10202 /*
10203  * This can happen on global regulatory changes or device specific settings
10204  * based on custom world regulatory domains.
10205  */
10206 void nl80211_send_reg_change_event(struct regulatory_request *request)
10207 {
10208         struct sk_buff *msg;
10209         void *hdr;
10210
10211         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10212         if (!msg)
10213                 return;
10214
10215         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
10216         if (!hdr) {
10217                 nlmsg_free(msg);
10218                 return;
10219         }
10220
10221         /* Userspace can always count this one always being set */
10222         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
10223                 goto nla_put_failure;
10224
10225         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
10226                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10227                                NL80211_REGDOM_TYPE_WORLD))
10228                         goto nla_put_failure;
10229         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
10230                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10231                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
10232                         goto nla_put_failure;
10233         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
10234                    request->intersect) {
10235                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10236                                NL80211_REGDOM_TYPE_INTERSECTION))
10237                         goto nla_put_failure;
10238         } else {
10239                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10240                                NL80211_REGDOM_TYPE_COUNTRY) ||
10241                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
10242                                    request->alpha2))
10243                         goto nla_put_failure;
10244         }
10245
10246         if (request->wiphy_idx != WIPHY_IDX_INVALID &&
10247             nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
10248                 goto nla_put_failure;
10249
10250         genlmsg_end(msg, hdr);
10251
10252         rcu_read_lock();
10253         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
10254                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
10255         rcu_read_unlock();
10256
10257         return;
10258
10259 nla_put_failure:
10260         genlmsg_cancel(msg, hdr);
10261         nlmsg_free(msg);
10262 }
10263
10264 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
10265                                     struct net_device *netdev,
10266                                     const u8 *buf, size_t len,
10267                                     enum nl80211_commands cmd, gfp_t gfp)
10268 {
10269         struct sk_buff *msg;
10270         void *hdr;
10271
10272         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10273         if (!msg)
10274                 return;
10275
10276         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10277         if (!hdr) {
10278                 nlmsg_free(msg);
10279                 return;
10280         }
10281
10282         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10283             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10284             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
10285                 goto nla_put_failure;
10286
10287         genlmsg_end(msg, hdr);
10288
10289         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10290                                 NL80211_MCGRP_MLME, gfp);
10291         return;
10292
10293  nla_put_failure:
10294         genlmsg_cancel(msg, hdr);
10295         nlmsg_free(msg);
10296 }
10297
10298 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
10299                           struct net_device *netdev, const u8 *buf,
10300                           size_t len, gfp_t gfp)
10301 {
10302         nl80211_send_mlme_event(rdev, netdev, buf, len,
10303                                 NL80211_CMD_AUTHENTICATE, gfp);
10304 }
10305
10306 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
10307                            struct net_device *netdev, const u8 *buf,
10308                            size_t len, gfp_t gfp)
10309 {
10310         nl80211_send_mlme_event(rdev, netdev, buf, len,
10311                                 NL80211_CMD_ASSOCIATE, gfp);
10312 }
10313
10314 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
10315                          struct net_device *netdev, const u8 *buf,
10316                          size_t len, gfp_t gfp)
10317 {
10318         nl80211_send_mlme_event(rdev, netdev, buf, len,
10319                                 NL80211_CMD_DEAUTHENTICATE, gfp);
10320 }
10321
10322 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
10323                            struct net_device *netdev, const u8 *buf,
10324                            size_t len, gfp_t gfp)
10325 {
10326         nl80211_send_mlme_event(rdev, netdev, buf, len,
10327                                 NL80211_CMD_DISASSOCIATE, gfp);
10328 }
10329
10330 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
10331                                   size_t len)
10332 {
10333         struct wireless_dev *wdev = dev->ieee80211_ptr;
10334         struct wiphy *wiphy = wdev->wiphy;
10335         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10336         const struct ieee80211_mgmt *mgmt = (void *)buf;
10337         u32 cmd;
10338
10339         if (WARN_ON(len < 2))
10340                 return;
10341
10342         if (ieee80211_is_deauth(mgmt->frame_control))
10343                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
10344         else
10345                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
10346
10347         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
10348         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC);
10349 }
10350 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
10351
10352 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
10353                                       struct net_device *netdev, int cmd,
10354                                       const u8 *addr, gfp_t gfp)
10355 {
10356         struct sk_buff *msg;
10357         void *hdr;
10358
10359         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10360         if (!msg)
10361                 return;
10362
10363         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10364         if (!hdr) {
10365                 nlmsg_free(msg);
10366                 return;
10367         }
10368
10369         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10370             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10371             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
10372             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
10373                 goto nla_put_failure;
10374
10375         genlmsg_end(msg, hdr);
10376
10377         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10378                                 NL80211_MCGRP_MLME, gfp);
10379         return;
10380
10381  nla_put_failure:
10382         genlmsg_cancel(msg, hdr);
10383         nlmsg_free(msg);
10384 }
10385
10386 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
10387                                struct net_device *netdev, const u8 *addr,
10388                                gfp_t gfp)
10389 {
10390         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
10391                                   addr, gfp);
10392 }
10393
10394 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
10395                                 struct net_device *netdev, const u8 *addr,
10396                                 gfp_t gfp)
10397 {
10398         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
10399                                   addr, gfp);
10400 }
10401
10402 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
10403                                  struct net_device *netdev, const u8 *bssid,
10404                                  const u8 *req_ie, size_t req_ie_len,
10405                                  const u8 *resp_ie, size_t resp_ie_len,
10406                                  u16 status, gfp_t gfp)
10407 {
10408         struct sk_buff *msg;
10409         void *hdr;
10410
10411         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10412         if (!msg)
10413                 return;
10414
10415         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
10416         if (!hdr) {
10417                 nlmsg_free(msg);
10418                 return;
10419         }
10420
10421         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10422             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10423             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
10424             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
10425             (req_ie &&
10426              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
10427             (resp_ie &&
10428              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
10429                 goto nla_put_failure;
10430
10431         genlmsg_end(msg, hdr);
10432
10433         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10434                                 NL80211_MCGRP_MLME, gfp);
10435         return;
10436
10437  nla_put_failure:
10438         genlmsg_cancel(msg, hdr);
10439         nlmsg_free(msg);
10440
10441 }
10442
10443 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
10444                          struct net_device *netdev, const u8 *bssid,
10445                          const u8 *req_ie, size_t req_ie_len,
10446                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
10447 {
10448         struct sk_buff *msg;
10449         void *hdr;
10450
10451         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10452         if (!msg)
10453                 return;
10454
10455         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
10456         if (!hdr) {
10457                 nlmsg_free(msg);
10458                 return;
10459         }
10460
10461         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10462             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10463             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
10464             (req_ie &&
10465              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
10466             (resp_ie &&
10467              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
10468                 goto nla_put_failure;
10469
10470         genlmsg_end(msg, hdr);
10471
10472         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10473                                 NL80211_MCGRP_MLME, gfp);
10474         return;
10475
10476  nla_put_failure:
10477         genlmsg_cancel(msg, hdr);
10478         nlmsg_free(msg);
10479
10480 }
10481
10482 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
10483                                struct net_device *netdev, u16 reason,
10484                                const u8 *ie, size_t ie_len, bool from_ap)
10485 {
10486         struct sk_buff *msg;
10487         void *hdr;
10488
10489         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10490         if (!msg)
10491                 return;
10492
10493         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
10494         if (!hdr) {
10495                 nlmsg_free(msg);
10496                 return;
10497         }
10498
10499         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10500             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10501             (from_ap && reason &&
10502              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
10503             (from_ap &&
10504              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
10505             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
10506                 goto nla_put_failure;
10507
10508         genlmsg_end(msg, hdr);
10509
10510         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10511                                 NL80211_MCGRP_MLME, GFP_KERNEL);
10512         return;
10513
10514  nla_put_failure:
10515         genlmsg_cancel(msg, hdr);
10516         nlmsg_free(msg);
10517
10518 }
10519
10520 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
10521                              struct net_device *netdev, const u8 *bssid,
10522                              gfp_t gfp)
10523 {
10524         struct sk_buff *msg;
10525         void *hdr;
10526
10527         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10528         if (!msg)
10529                 return;
10530
10531         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
10532         if (!hdr) {
10533                 nlmsg_free(msg);
10534                 return;
10535         }
10536
10537         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10538             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10539             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
10540                 goto nla_put_failure;
10541
10542         genlmsg_end(msg, hdr);
10543
10544         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10545                                 NL80211_MCGRP_MLME, gfp);
10546         return;
10547
10548  nla_put_failure:
10549         genlmsg_cancel(msg, hdr);
10550         nlmsg_free(msg);
10551 }
10552
10553 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
10554                                         const u8* ie, u8 ie_len, gfp_t gfp)
10555 {
10556         struct wireless_dev *wdev = dev->ieee80211_ptr;
10557         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
10558         struct sk_buff *msg;
10559         void *hdr;
10560
10561         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
10562                 return;
10563
10564         trace_cfg80211_notify_new_peer_candidate(dev, addr);
10565
10566         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10567         if (!msg)
10568                 return;
10569
10570         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
10571         if (!hdr) {
10572                 nlmsg_free(msg);
10573                 return;
10574         }
10575
10576         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10577             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10578             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
10579             (ie_len && ie &&
10580              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
10581                 goto nla_put_failure;
10582
10583         genlmsg_end(msg, hdr);
10584
10585         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10586                                 NL80211_MCGRP_MLME, gfp);
10587         return;
10588
10589  nla_put_failure:
10590         genlmsg_cancel(msg, hdr);
10591         nlmsg_free(msg);
10592 }
10593 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
10594
10595 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
10596                                  struct net_device *netdev, const u8 *addr,
10597                                  enum nl80211_key_type key_type, int key_id,
10598                                  const u8 *tsc, gfp_t gfp)
10599 {
10600         struct sk_buff *msg;
10601         void *hdr;
10602
10603         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10604         if (!msg)
10605                 return;
10606
10607         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
10608         if (!hdr) {
10609                 nlmsg_free(msg);
10610                 return;
10611         }
10612
10613         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10614             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10615             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
10616             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
10617             (key_id != -1 &&
10618              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
10619             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
10620                 goto nla_put_failure;
10621
10622         genlmsg_end(msg, hdr);
10623
10624         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10625                                 NL80211_MCGRP_MLME, gfp);
10626         return;
10627
10628  nla_put_failure:
10629         genlmsg_cancel(msg, hdr);
10630         nlmsg_free(msg);
10631 }
10632
10633 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
10634                                     struct ieee80211_channel *channel_before,
10635                                     struct ieee80211_channel *channel_after)
10636 {
10637         struct sk_buff *msg;
10638         void *hdr;
10639         struct nlattr *nl_freq;
10640
10641         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
10642         if (!msg)
10643                 return;
10644
10645         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
10646         if (!hdr) {
10647                 nlmsg_free(msg);
10648                 return;
10649         }
10650
10651         /*
10652          * Since we are applying the beacon hint to a wiphy we know its
10653          * wiphy_idx is valid
10654          */
10655         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
10656                 goto nla_put_failure;
10657
10658         /* Before */
10659         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
10660         if (!nl_freq)
10661                 goto nla_put_failure;
10662         if (nl80211_msg_put_channel(msg, channel_before, false))
10663                 goto nla_put_failure;
10664         nla_nest_end(msg, nl_freq);
10665
10666         /* After */
10667         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
10668         if (!nl_freq)
10669                 goto nla_put_failure;
10670         if (nl80211_msg_put_channel(msg, channel_after, false))
10671                 goto nla_put_failure;
10672         nla_nest_end(msg, nl_freq);
10673
10674         genlmsg_end(msg, hdr);
10675
10676         rcu_read_lock();
10677         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
10678                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
10679         rcu_read_unlock();
10680
10681         return;
10682
10683 nla_put_failure:
10684         genlmsg_cancel(msg, hdr);
10685         nlmsg_free(msg);
10686 }
10687
10688 static void nl80211_send_remain_on_chan_event(
10689         int cmd, struct cfg80211_registered_device *rdev,
10690         struct wireless_dev *wdev, u64 cookie,
10691         struct ieee80211_channel *chan,
10692         unsigned int duration, gfp_t gfp)
10693 {
10694         struct sk_buff *msg;
10695         void *hdr;
10696
10697         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10698         if (!msg)
10699                 return;
10700
10701         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10702         if (!hdr) {
10703                 nlmsg_free(msg);
10704                 return;
10705         }
10706
10707         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10708             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10709                                          wdev->netdev->ifindex)) ||
10710             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10711             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
10712             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
10713                         NL80211_CHAN_NO_HT) ||
10714             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
10715                 goto nla_put_failure;
10716
10717         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
10718             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
10719                 goto nla_put_failure;
10720
10721         genlmsg_end(msg, hdr);
10722
10723         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10724                                 NL80211_MCGRP_MLME, gfp);
10725         return;
10726
10727  nla_put_failure:
10728         genlmsg_cancel(msg, hdr);
10729         nlmsg_free(msg);
10730 }
10731
10732 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
10733                                struct ieee80211_channel *chan,
10734                                unsigned int duration, gfp_t gfp)
10735 {
10736         struct wiphy *wiphy = wdev->wiphy;
10737         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10738
10739         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
10740         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
10741                                           rdev, wdev, cookie, chan,
10742                                           duration, gfp);
10743 }
10744 EXPORT_SYMBOL(cfg80211_ready_on_channel);
10745
10746 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
10747                                         struct ieee80211_channel *chan,
10748                                         gfp_t gfp)
10749 {
10750         struct wiphy *wiphy = wdev->wiphy;
10751         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10752
10753         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
10754         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
10755                                           rdev, wdev, cookie, chan, 0, gfp);
10756 }
10757 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
10758
10759 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
10760                       struct station_info *sinfo, gfp_t gfp)
10761 {
10762         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
10763         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10764         struct sk_buff *msg;
10765
10766         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
10767
10768         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10769         if (!msg)
10770                 return;
10771
10772         if (nl80211_send_station(msg, 0, 0, 0,
10773                                  rdev, dev, mac_addr, sinfo) < 0) {
10774                 nlmsg_free(msg);
10775                 return;
10776         }
10777
10778         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10779                                 NL80211_MCGRP_MLME, gfp);
10780 }
10781 EXPORT_SYMBOL(cfg80211_new_sta);
10782
10783 void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
10784 {
10785         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
10786         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10787         struct sk_buff *msg;
10788         void *hdr;
10789
10790         trace_cfg80211_del_sta(dev, mac_addr);
10791
10792         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10793         if (!msg)
10794                 return;
10795
10796         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
10797         if (!hdr) {
10798                 nlmsg_free(msg);
10799                 return;
10800         }
10801
10802         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10803             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
10804                 goto nla_put_failure;
10805
10806         genlmsg_end(msg, hdr);
10807
10808         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10809                                 NL80211_MCGRP_MLME, gfp);
10810         return;
10811
10812  nla_put_failure:
10813         genlmsg_cancel(msg, hdr);
10814         nlmsg_free(msg);
10815 }
10816 EXPORT_SYMBOL(cfg80211_del_sta);
10817
10818 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
10819                           enum nl80211_connect_failed_reason reason,
10820                           gfp_t gfp)
10821 {
10822         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
10823         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10824         struct sk_buff *msg;
10825         void *hdr;
10826
10827         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
10828         if (!msg)
10829                 return;
10830
10831         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
10832         if (!hdr) {
10833                 nlmsg_free(msg);
10834                 return;
10835         }
10836
10837         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10838             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
10839             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
10840                 goto nla_put_failure;
10841
10842         genlmsg_end(msg, hdr);
10843
10844         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10845                                 NL80211_MCGRP_MLME, gfp);
10846         return;
10847
10848  nla_put_failure:
10849         genlmsg_cancel(msg, hdr);
10850         nlmsg_free(msg);
10851 }
10852 EXPORT_SYMBOL(cfg80211_conn_failed);
10853
10854 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
10855                                        const u8 *addr, gfp_t gfp)
10856 {
10857         struct wireless_dev *wdev = dev->ieee80211_ptr;
10858         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
10859         struct sk_buff *msg;
10860         void *hdr;
10861         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
10862
10863         if (!nlportid)
10864                 return false;
10865
10866         msg = nlmsg_new(100, gfp);
10867         if (!msg)
10868                 return true;
10869
10870         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10871         if (!hdr) {
10872                 nlmsg_free(msg);
10873                 return true;
10874         }
10875
10876         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10877             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10878             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
10879                 goto nla_put_failure;
10880
10881         genlmsg_end(msg, hdr);
10882         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
10883         return true;
10884
10885  nla_put_failure:
10886         genlmsg_cancel(msg, hdr);
10887         nlmsg_free(msg);
10888         return true;
10889 }
10890
10891 bool cfg80211_rx_spurious_frame(struct net_device *dev,
10892                                 const u8 *addr, gfp_t gfp)
10893 {
10894         struct wireless_dev *wdev = dev->ieee80211_ptr;
10895         bool ret;
10896
10897         trace_cfg80211_rx_spurious_frame(dev, addr);
10898
10899         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
10900                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
10901                 trace_cfg80211_return_bool(false);
10902                 return false;
10903         }
10904         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
10905                                          addr, gfp);
10906         trace_cfg80211_return_bool(ret);
10907         return ret;
10908 }
10909 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
10910
10911 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
10912                                         const u8 *addr, gfp_t gfp)
10913 {
10914         struct wireless_dev *wdev = dev->ieee80211_ptr;
10915         bool ret;
10916
10917         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
10918
10919         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
10920                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
10921                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
10922                 trace_cfg80211_return_bool(false);
10923                 return false;
10924         }
10925         ret = __nl80211_unexpected_frame(dev,
10926                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
10927                                          addr, gfp);
10928         trace_cfg80211_return_bool(ret);
10929         return ret;
10930 }
10931 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
10932
10933 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
10934                       struct wireless_dev *wdev, u32 nlportid,
10935                       int freq, int sig_dbm,
10936                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
10937 {
10938         struct net_device *netdev = wdev->netdev;
10939         struct sk_buff *msg;
10940         void *hdr;
10941
10942         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10943         if (!msg)
10944                 return -ENOMEM;
10945
10946         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
10947         if (!hdr) {
10948                 nlmsg_free(msg);
10949                 return -ENOMEM;
10950         }
10951
10952         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10953             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10954                                         netdev->ifindex)) ||
10955             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10956             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
10957             (sig_dbm &&
10958              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
10959             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
10960             (flags &&
10961              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
10962                 goto nla_put_failure;
10963
10964         genlmsg_end(msg, hdr);
10965
10966         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
10967
10968  nla_put_failure:
10969         genlmsg_cancel(msg, hdr);
10970         nlmsg_free(msg);
10971         return -ENOBUFS;
10972 }
10973
10974 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
10975                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
10976 {
10977         struct wiphy *wiphy = wdev->wiphy;
10978         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10979         struct net_device *netdev = wdev->netdev;
10980         struct sk_buff *msg;
10981         void *hdr;
10982
10983         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
10984
10985         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10986         if (!msg)
10987                 return;
10988
10989         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
10990         if (!hdr) {
10991                 nlmsg_free(msg);
10992                 return;
10993         }
10994
10995         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10996             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10997                                    netdev->ifindex)) ||
10998             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10999             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
11000             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
11001             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
11002                 goto nla_put_failure;
11003
11004         genlmsg_end(msg, hdr);
11005
11006         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11007                                 NL80211_MCGRP_MLME, gfp);
11008         return;
11009
11010  nla_put_failure:
11011         genlmsg_cancel(msg, hdr);
11012         nlmsg_free(msg);
11013 }
11014 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
11015
11016 void cfg80211_cqm_rssi_notify(struct net_device *dev,
11017                               enum nl80211_cqm_rssi_threshold_event rssi_event,
11018                               gfp_t gfp)
11019 {
11020         struct wireless_dev *wdev = dev->ieee80211_ptr;
11021         struct wiphy *wiphy = wdev->wiphy;
11022         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11023         struct sk_buff *msg;
11024         struct nlattr *pinfoattr;
11025         void *hdr;
11026
11027         trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
11028
11029         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11030         if (!msg)
11031                 return;
11032
11033         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
11034         if (!hdr) {
11035                 nlmsg_free(msg);
11036                 return;
11037         }
11038
11039         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11040             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
11041                 goto nla_put_failure;
11042
11043         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
11044         if (!pinfoattr)
11045                 goto nla_put_failure;
11046
11047         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
11048                         rssi_event))
11049                 goto nla_put_failure;
11050
11051         nla_nest_end(msg, pinfoattr);
11052
11053         genlmsg_end(msg, hdr);
11054
11055         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11056                                 NL80211_MCGRP_MLME, gfp);
11057         return;
11058
11059  nla_put_failure:
11060         genlmsg_cancel(msg, hdr);
11061         nlmsg_free(msg);
11062 }
11063 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
11064
11065 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
11066                                      struct net_device *netdev, const u8 *bssid,
11067                                      const u8 *replay_ctr, gfp_t gfp)
11068 {
11069         struct sk_buff *msg;
11070         struct nlattr *rekey_attr;
11071         void *hdr;
11072
11073         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11074         if (!msg)
11075                 return;
11076
11077         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
11078         if (!hdr) {
11079                 nlmsg_free(msg);
11080                 return;
11081         }
11082
11083         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11084             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11085             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
11086                 goto nla_put_failure;
11087
11088         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
11089         if (!rekey_attr)
11090                 goto nla_put_failure;
11091
11092         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
11093                     NL80211_REPLAY_CTR_LEN, replay_ctr))
11094                 goto nla_put_failure;
11095
11096         nla_nest_end(msg, rekey_attr);
11097
11098         genlmsg_end(msg, hdr);
11099
11100         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11101                                 NL80211_MCGRP_MLME, gfp);
11102         return;
11103
11104  nla_put_failure:
11105         genlmsg_cancel(msg, hdr);
11106         nlmsg_free(msg);
11107 }
11108
11109 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
11110                                const u8 *replay_ctr, gfp_t gfp)
11111 {
11112         struct wireless_dev *wdev = dev->ieee80211_ptr;
11113         struct wiphy *wiphy = wdev->wiphy;
11114         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11115
11116         trace_cfg80211_gtk_rekey_notify(dev, bssid);
11117         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
11118 }
11119 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
11120
11121 static void
11122 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
11123                                struct net_device *netdev, int index,
11124                                const u8 *bssid, bool preauth, gfp_t gfp)
11125 {
11126         struct sk_buff *msg;
11127         struct nlattr *attr;
11128         void *hdr;
11129
11130         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11131         if (!msg)
11132                 return;
11133
11134         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
11135         if (!hdr) {
11136                 nlmsg_free(msg);
11137                 return;
11138         }
11139
11140         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11141             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
11142                 goto nla_put_failure;
11143
11144         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
11145         if (!attr)
11146                 goto nla_put_failure;
11147
11148         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
11149             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
11150             (preauth &&
11151              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
11152                 goto nla_put_failure;
11153
11154         nla_nest_end(msg, attr);
11155
11156         genlmsg_end(msg, hdr);
11157
11158         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11159                                 NL80211_MCGRP_MLME, gfp);
11160         return;
11161
11162  nla_put_failure:
11163         genlmsg_cancel(msg, hdr);
11164         nlmsg_free(msg);
11165 }
11166
11167 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
11168                                      const u8 *bssid, bool preauth, gfp_t gfp)
11169 {
11170         struct wireless_dev *wdev = dev->ieee80211_ptr;
11171         struct wiphy *wiphy = wdev->wiphy;
11172         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11173
11174         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
11175         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
11176 }
11177 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
11178
11179 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
11180                                      struct net_device *netdev,
11181                                      struct cfg80211_chan_def *chandef,
11182                                      gfp_t gfp)
11183 {
11184         struct sk_buff *msg;
11185         void *hdr;
11186
11187         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11188         if (!msg)
11189                 return;
11190
11191         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
11192         if (!hdr) {
11193                 nlmsg_free(msg);
11194                 return;
11195         }
11196
11197         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
11198                 goto nla_put_failure;
11199
11200         if (nl80211_send_chandef(msg, chandef))
11201                 goto nla_put_failure;
11202
11203         genlmsg_end(msg, hdr);
11204
11205         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11206                                 NL80211_MCGRP_MLME, gfp);
11207         return;
11208
11209  nla_put_failure:
11210         genlmsg_cancel(msg, hdr);
11211         nlmsg_free(msg);
11212 }
11213
11214 void cfg80211_ch_switch_notify(struct net_device *dev,
11215                                struct cfg80211_chan_def *chandef)
11216 {
11217         struct wireless_dev *wdev = dev->ieee80211_ptr;
11218         struct wiphy *wiphy = wdev->wiphy;
11219         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11220
11221         ASSERT_WDEV_LOCK(wdev);
11222
11223         trace_cfg80211_ch_switch_notify(dev, chandef);
11224
11225         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
11226                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
11227                     wdev->iftype != NL80211_IFTYPE_ADHOC &&
11228                     wdev->iftype != NL80211_IFTYPE_MESH_POINT))
11229                 return;
11230
11231         wdev->chandef = *chandef;
11232         wdev->preset_chandef = *chandef;
11233         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL);
11234 }
11235 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
11236
11237 void cfg80211_cqm_txe_notify(struct net_device *dev,
11238                              const u8 *peer, u32 num_packets,
11239                              u32 rate, u32 intvl, gfp_t gfp)
11240 {
11241         struct wireless_dev *wdev = dev->ieee80211_ptr;
11242         struct wiphy *wiphy = wdev->wiphy;
11243         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11244         struct sk_buff *msg;
11245         struct nlattr *pinfoattr;
11246         void *hdr;
11247
11248         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
11249         if (!msg)
11250                 return;
11251
11252         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
11253         if (!hdr) {
11254                 nlmsg_free(msg);
11255                 return;
11256         }
11257
11258         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11259             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11260             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
11261                 goto nla_put_failure;
11262
11263         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
11264         if (!pinfoattr)
11265                 goto nla_put_failure;
11266
11267         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
11268                 goto nla_put_failure;
11269
11270         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
11271                 goto nla_put_failure;
11272
11273         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
11274                 goto nla_put_failure;
11275
11276         nla_nest_end(msg, pinfoattr);
11277
11278         genlmsg_end(msg, hdr);
11279
11280         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11281                                 NL80211_MCGRP_MLME, gfp);
11282         return;
11283
11284  nla_put_failure:
11285         genlmsg_cancel(msg, hdr);
11286         nlmsg_free(msg);
11287 }
11288 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
11289
11290 void
11291 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
11292                      const struct cfg80211_chan_def *chandef,
11293                      enum nl80211_radar_event event,
11294                      struct net_device *netdev, gfp_t gfp)
11295 {
11296         struct sk_buff *msg;
11297         void *hdr;
11298
11299         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11300         if (!msg)
11301                 return;
11302
11303         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
11304         if (!hdr) {
11305                 nlmsg_free(msg);
11306                 return;
11307         }
11308
11309         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
11310                 goto nla_put_failure;
11311
11312         /* NOP and radar events don't need a netdev parameter */
11313         if (netdev) {
11314                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
11315
11316                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11317                     nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11318                         goto nla_put_failure;
11319         }
11320
11321         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
11322                 goto nla_put_failure;
11323
11324         if (nl80211_send_chandef(msg, chandef))
11325                 goto nla_put_failure;
11326
11327         genlmsg_end(msg, hdr);
11328
11329         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11330                                 NL80211_MCGRP_MLME, gfp);
11331         return;
11332
11333  nla_put_failure:
11334         genlmsg_cancel(msg, hdr);
11335         nlmsg_free(msg);
11336 }
11337
11338 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
11339                                  const u8 *peer, u32 num_packets, gfp_t gfp)
11340 {
11341         struct wireless_dev *wdev = dev->ieee80211_ptr;
11342         struct wiphy *wiphy = wdev->wiphy;
11343         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11344         struct sk_buff *msg;
11345         struct nlattr *pinfoattr;
11346         void *hdr;
11347
11348         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
11349
11350         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11351         if (!msg)
11352                 return;
11353
11354         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
11355         if (!hdr) {
11356                 nlmsg_free(msg);
11357                 return;
11358         }
11359
11360         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11361             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11362             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
11363                 goto nla_put_failure;
11364
11365         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
11366         if (!pinfoattr)
11367                 goto nla_put_failure;
11368
11369         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
11370                 goto nla_put_failure;
11371
11372         nla_nest_end(msg, pinfoattr);
11373
11374         genlmsg_end(msg, hdr);
11375
11376         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11377                                 NL80211_MCGRP_MLME, gfp);
11378         return;
11379
11380  nla_put_failure:
11381         genlmsg_cancel(msg, hdr);
11382         nlmsg_free(msg);
11383 }
11384 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
11385
11386 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
11387                            u64 cookie, bool acked, gfp_t gfp)
11388 {
11389         struct wireless_dev *wdev = dev->ieee80211_ptr;
11390         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
11391         struct sk_buff *msg;
11392         void *hdr;
11393
11394         trace_cfg80211_probe_status(dev, addr, cookie, acked);
11395
11396         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11397
11398         if (!msg)
11399                 return;
11400
11401         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
11402         if (!hdr) {
11403                 nlmsg_free(msg);
11404                 return;
11405         }
11406
11407         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11408             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11409             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
11410             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
11411             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
11412                 goto nla_put_failure;
11413
11414         genlmsg_end(msg, hdr);
11415
11416         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11417                                 NL80211_MCGRP_MLME, gfp);
11418         return;
11419
11420  nla_put_failure:
11421         genlmsg_cancel(msg, hdr);
11422         nlmsg_free(msg);
11423 }
11424 EXPORT_SYMBOL(cfg80211_probe_status);
11425
11426 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
11427                                  const u8 *frame, size_t len,
11428                                  int freq, int sig_dbm)
11429 {
11430         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11431         struct sk_buff *msg;
11432         void *hdr;
11433         struct cfg80211_beacon_registration *reg;
11434
11435         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
11436
11437         spin_lock_bh(&rdev->beacon_registrations_lock);
11438         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
11439                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
11440                 if (!msg) {
11441                         spin_unlock_bh(&rdev->beacon_registrations_lock);
11442                         return;
11443                 }
11444
11445                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
11446                 if (!hdr)
11447                         goto nla_put_failure;
11448
11449                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11450                     (freq &&
11451                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
11452                     (sig_dbm &&
11453                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
11454                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
11455                         goto nla_put_failure;
11456
11457                 genlmsg_end(msg, hdr);
11458
11459                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
11460         }
11461         spin_unlock_bh(&rdev->beacon_registrations_lock);
11462         return;
11463
11464  nla_put_failure:
11465         spin_unlock_bh(&rdev->beacon_registrations_lock);
11466         if (hdr)
11467                 genlmsg_cancel(msg, hdr);
11468         nlmsg_free(msg);
11469 }
11470 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
11471
11472 #ifdef CONFIG_PM
11473 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
11474                                    struct cfg80211_wowlan_wakeup *wakeup,
11475                                    gfp_t gfp)
11476 {
11477         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
11478         struct sk_buff *msg;
11479         void *hdr;
11480         int size = 200;
11481
11482         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
11483
11484         if (wakeup)
11485                 size += wakeup->packet_present_len;
11486
11487         msg = nlmsg_new(size, gfp);
11488         if (!msg)
11489                 return;
11490
11491         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
11492         if (!hdr)
11493                 goto free_msg;
11494
11495         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11496             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11497                 goto free_msg;
11498
11499         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11500                                         wdev->netdev->ifindex))
11501                 goto free_msg;
11502
11503         if (wakeup) {
11504                 struct nlattr *reasons;
11505
11506                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
11507                 if (!reasons)
11508                         goto free_msg;
11509
11510                 if (wakeup->disconnect &&
11511                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
11512                         goto free_msg;
11513                 if (wakeup->magic_pkt &&
11514                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
11515                         goto free_msg;
11516                 if (wakeup->gtk_rekey_failure &&
11517                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
11518                         goto free_msg;
11519                 if (wakeup->eap_identity_req &&
11520                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
11521                         goto free_msg;
11522                 if (wakeup->four_way_handshake &&
11523                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
11524                         goto free_msg;
11525                 if (wakeup->rfkill_release &&
11526                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
11527                         goto free_msg;
11528
11529                 if (wakeup->pattern_idx >= 0 &&
11530                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
11531                                 wakeup->pattern_idx))
11532                         goto free_msg;
11533
11534                 if (wakeup->tcp_match &&
11535                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
11536                         goto free_msg;
11537
11538                 if (wakeup->tcp_connlost &&
11539                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
11540                         goto free_msg;
11541
11542                 if (wakeup->tcp_nomoretokens &&
11543                     nla_put_flag(msg,
11544                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
11545                         goto free_msg;
11546
11547                 if (wakeup->packet) {
11548                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
11549                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
11550
11551                         if (!wakeup->packet_80211) {
11552                                 pkt_attr =
11553                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
11554                                 len_attr =
11555                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
11556                         }
11557
11558                         if (wakeup->packet_len &&
11559                             nla_put_u32(msg, len_attr, wakeup->packet_len))
11560                                 goto free_msg;
11561
11562                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
11563                                     wakeup->packet))
11564                                 goto free_msg;
11565                 }
11566
11567                 nla_nest_end(msg, reasons);
11568         }
11569
11570         genlmsg_end(msg, hdr);
11571
11572         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11573                                 NL80211_MCGRP_MLME, gfp);
11574         return;
11575
11576  free_msg:
11577         nlmsg_free(msg);
11578 }
11579 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
11580 #endif
11581
11582 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
11583                                 enum nl80211_tdls_operation oper,
11584                                 u16 reason_code, gfp_t gfp)
11585 {
11586         struct wireless_dev *wdev = dev->ieee80211_ptr;
11587         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
11588         struct sk_buff *msg;
11589         void *hdr;
11590
11591         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
11592                                          reason_code);
11593
11594         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11595         if (!msg)
11596                 return;
11597
11598         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
11599         if (!hdr) {
11600                 nlmsg_free(msg);
11601                 return;
11602         }
11603
11604         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11605             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11606             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
11607             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
11608             (reason_code > 0 &&
11609              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
11610                 goto nla_put_failure;
11611
11612         genlmsg_end(msg, hdr);
11613
11614         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11615                                 NL80211_MCGRP_MLME, gfp);
11616         return;
11617
11618  nla_put_failure:
11619         genlmsg_cancel(msg, hdr);
11620         nlmsg_free(msg);
11621 }
11622 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
11623
11624 static int nl80211_netlink_notify(struct notifier_block * nb,
11625                                   unsigned long state,
11626                                   void *_notify)
11627 {
11628         struct netlink_notify *notify = _notify;
11629         struct cfg80211_registered_device *rdev;
11630         struct wireless_dev *wdev;
11631         struct cfg80211_beacon_registration *reg, *tmp;
11632
11633         if (state != NETLINK_URELEASE)
11634                 return NOTIFY_DONE;
11635
11636         rcu_read_lock();
11637
11638         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
11639                 bool schedule_destroy_work = false;
11640
11641                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list) {
11642                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
11643
11644                         if (wdev->owner_nlportid == notify->portid)
11645                                 schedule_destroy_work = true;
11646                 }
11647
11648                 spin_lock_bh(&rdev->beacon_registrations_lock);
11649                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
11650                                          list) {
11651                         if (reg->nlportid == notify->portid) {
11652                                 list_del(&reg->list);
11653                                 kfree(reg);
11654                                 break;
11655                         }
11656                 }
11657                 spin_unlock_bh(&rdev->beacon_registrations_lock);
11658
11659                 if (schedule_destroy_work) {
11660                         struct cfg80211_iface_destroy *destroy;
11661
11662                         destroy = kzalloc(sizeof(*destroy), GFP_ATOMIC);
11663                         if (destroy) {
11664                                 destroy->nlportid = notify->portid;
11665                                 spin_lock(&rdev->destroy_list_lock);
11666                                 list_add(&destroy->list, &rdev->destroy_list);
11667                                 spin_unlock(&rdev->destroy_list_lock);
11668                                 schedule_work(&rdev->destroy_work);
11669                         }
11670                 }
11671         }
11672
11673         rcu_read_unlock();
11674
11675         return NOTIFY_OK;
11676 }
11677
11678 static struct notifier_block nl80211_netlink_notifier = {
11679         .notifier_call = nl80211_netlink_notify,
11680 };
11681
11682 void cfg80211_ft_event(struct net_device *netdev,
11683                        struct cfg80211_ft_event_params *ft_event)
11684 {
11685         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
11686         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11687         struct sk_buff *msg;
11688         void *hdr;
11689
11690         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
11691
11692         if (!ft_event->target_ap)
11693                 return;
11694
11695         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11696         if (!msg)
11697                 return;
11698
11699         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
11700         if (!hdr)
11701                 goto out;
11702
11703         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11704             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11705             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
11706                 goto out;
11707
11708         if (ft_event->ies &&
11709             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
11710                 goto out;
11711         if (ft_event->ric_ies &&
11712             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
11713                     ft_event->ric_ies))
11714                 goto out;
11715
11716         genlmsg_end(msg, hdr);
11717
11718         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11719                                 NL80211_MCGRP_MLME, GFP_KERNEL);
11720         return;
11721  out:
11722         nlmsg_free(msg);
11723 }
11724 EXPORT_SYMBOL(cfg80211_ft_event);
11725
11726 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
11727 {
11728         struct cfg80211_registered_device *rdev;
11729         struct sk_buff *msg;
11730         void *hdr;
11731         u32 nlportid;
11732
11733         rdev = wiphy_to_rdev(wdev->wiphy);
11734         if (!rdev->crit_proto_nlportid)
11735                 return;
11736
11737         nlportid = rdev->crit_proto_nlportid;
11738         rdev->crit_proto_nlportid = 0;
11739
11740         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11741         if (!msg)
11742                 return;
11743
11744         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
11745         if (!hdr)
11746                 goto nla_put_failure;
11747
11748         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11749             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11750                 goto nla_put_failure;
11751
11752         genlmsg_end(msg, hdr);
11753
11754         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
11755         return;
11756
11757  nla_put_failure:
11758         if (hdr)
11759                 genlmsg_cancel(msg, hdr);
11760         nlmsg_free(msg);
11761
11762 }
11763 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
11764
11765 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
11766 {
11767         struct wiphy *wiphy = wdev->wiphy;
11768         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11769         struct sk_buff *msg;
11770         void *hdr;
11771
11772         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11773         if (!msg)
11774                 return;
11775
11776         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
11777         if (!hdr)
11778                 goto out;
11779
11780         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11781             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
11782             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11783                 goto out;
11784
11785         genlmsg_end(msg, hdr);
11786
11787         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
11788                                 NL80211_MCGRP_MLME, GFP_KERNEL);
11789         return;
11790  out:
11791         nlmsg_free(msg);
11792 }
11793
11794 /* initialisation/exit functions */
11795
11796 int nl80211_init(void)
11797 {
11798         int err;
11799
11800         err = genl_register_family_with_ops_groups(&nl80211_fam, nl80211_ops,
11801                                                    nl80211_mcgrps);
11802         if (err)
11803                 return err;
11804
11805         err = netlink_register_notifier(&nl80211_netlink_notifier);
11806         if (err)
11807                 goto err_out;
11808
11809         return 0;
11810  err_out:
11811         genl_unregister_family(&nl80211_fam);
11812         return err;
11813 }
11814
11815 void nl80211_exit(void)
11816 {
11817         netlink_unregister_notifier(&nl80211_netlink_notifier);
11818         genl_unregister_family(&nl80211_fam);
11819 }