net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include <net/inet_connection_sock.h>
  23 #include "core.h"
  24 #include "nl80211.h"
  25 #include "reg.h"
  26 #include "rdev-ops.h"
  27
  28 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  29                                    struct genl_info *info,
  30                                    struct cfg80211_crypto_settings *settings,
  31                                    int cipher_limit);
  32
  33 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
  34                             struct genl_info *info);
  35 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
  36                               struct genl_info *info);
  37
  38 /* the netlink family */
  39 static struct genl_family nl80211_fam = {
  40         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  41         .name = "nl80211",      /* have users key off the name instead */
  42         .hdrsize = 0,           /* no private header */
  43         .version = 1,           /* no particular meaning now */
  44         .maxattr = NL80211_ATTR_MAX,
  45         .netnsok = true,
  46         .pre_doit = nl80211_pre_doit,
  47         .post_doit = nl80211_post_doit,
  48 };
  49
  50 /* returns ERR_PTR values */
  51 static struct wireless_dev *
  52 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  53 {
  54         struct cfg80211_registered_device *rdev;
  55         struct wireless_dev *result = NULL;
  56         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  57         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  58         u64 wdev_id;
  59         int wiphy_idx = -1;
  60         int ifidx = -1;
  61
  62         assert_cfg80211_lock();
  63
  64         if (!have_ifidx && !have_wdev_id)
  65                 return ERR_PTR(-EINVAL);
  66
  67         if (have_ifidx)
  68                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  69         if (have_wdev_id) {
  70                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  71                 wiphy_idx = wdev_id >> 32;
  72         }
  73
  74         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  75                 struct wireless_dev *wdev;
  76
  77                 if (wiphy_net(&rdev->wiphy) != netns)
  78                         continue;
  79
  80                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  81                         continue;
  82
  83                 mutex_lock(&rdev->devlist_mtx);
  84                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
  85                         if (have_ifidx && wdev->netdev &&
  86                             wdev->netdev->ifindex == ifidx) {
  87                                 result = wdev;
  88                                 break;
  89                         }
  90                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
  91                                 result = wdev;
  92                                 break;
  93                         }
  94                 }
  95                 mutex_unlock(&rdev->devlist_mtx);
  96
  97                 if (result)
  98                         break;
  99         }
 100
 101         if (result)
 102                 return result;
 103         return ERR_PTR(-ENODEV);
 104 }
 105
 106 static struct cfg80211_registered_device *
 107 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 108 {
 109         struct cfg80211_registered_device *rdev = NULL, *tmp;
 110         struct net_device *netdev;
 111
 112         assert_cfg80211_lock();
 113
 114         if (!attrs[NL80211_ATTR_WIPHY] &&
 115             !attrs[NL80211_ATTR_IFINDEX] &&
 116             !attrs[NL80211_ATTR_WDEV])
 117                 return ERR_PTR(-EINVAL);
 118
 119         if (attrs[NL80211_ATTR_WIPHY])
 120                 rdev = cfg80211_rdev_by_wiphy_idx(
 121                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 122
 123         if (attrs[NL80211_ATTR_WDEV]) {
 124                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 125                 struct wireless_dev *wdev;
 126                 bool found = false;
 127
 128                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 129                 if (tmp) {
 130                         /* make sure wdev exists */
 131                         mutex_lock(&tmp->devlist_mtx);
 132                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 133                                 if (wdev->identifier != (u32)wdev_id)
 134                                         continue;
 135                                 found = true;
 136                                 break;
 137                         }
 138                         mutex_unlock(&tmp->devlist_mtx);
 139
 140                         if (!found)
 141                                 tmp = NULL;
 142
 143                         if (rdev && tmp != rdev)
 144                                 return ERR_PTR(-EINVAL);
 145                         rdev = tmp;
 146                 }
 147         }
 148
 149         if (attrs[NL80211_ATTR_IFINDEX]) {
 150                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 151                 netdev = dev_get_by_index(netns, ifindex);
 152                 if (netdev) {
 153                         if (netdev->ieee80211_ptr)
 154                                 tmp = wiphy_to_dev(
 155                                                 netdev->ieee80211_ptr->wiphy);
 156                         else
 157                                 tmp = NULL;
 158
 159                         dev_put(netdev);
 160
 161                         /* not wireless device -- return error */
 162                         if (!tmp)
 163                                 return ERR_PTR(-EINVAL);
 164
 165                         /* mismatch -- return error */
 166                         if (rdev && tmp != rdev)
 167                                 return ERR_PTR(-EINVAL);
 168
 169                         rdev = tmp;
 170                 }
 171         }
 172
 173         if (!rdev)
 174                 return ERR_PTR(-ENODEV);
 175
 176         if (netns != wiphy_net(&rdev->wiphy))
 177                 return ERR_PTR(-ENODEV);
 178
 179         return rdev;
 180 }
 181
 182 /*
 183  * This function returns a pointer to the driver
 184  * that the genl_info item that is passed refers to.
 185  * If successful, it returns non-NULL and also locks
 186  * the driver's mutex!
 187  *
 188  * This means that you need to call cfg80211_unlock_rdev()
 189  * before being allowed to acquire &cfg80211_mutex!
 190  *
 191  * This is necessary because we need to lock the global
 192  * mutex to get an item off the list safely, and then
 193  * we lock the rdev mutex so it doesn't go away under us.
 194  *
 195  * We don't want to keep cfg80211_mutex locked
 196  * for all the time in order to allow requests on
 197  * other interfaces to go through at the same time.
 198  *
 199  * The result of this can be a PTR_ERR and hence must
 200  * be checked with IS_ERR() for errors.
 201  */
 202 static struct cfg80211_registered_device *
 203 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 204 {
 205         struct cfg80211_registered_device *rdev;
 206
 207         mutex_lock(&cfg80211_mutex);
 208         rdev = __cfg80211_rdev_from_attrs(netns, info->attrs);
 209
 210         /* if it is not an error we grab the lock on
 211          * it to assure it won't be going away while
 212          * we operate on it */
 213         if (!IS_ERR(rdev))
 214                 mutex_lock(&rdev->mtx);
 215
 216         mutex_unlock(&cfg80211_mutex);
 217
 218         return rdev;
 219 }
 220
 221 /* policy for the attributes */
 222 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
 223         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 224         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 225                                       .len = 20-1 },
 226         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 227
 228         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 229         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 230         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 231         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 232         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 233
 234         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 235         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 236         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 237         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 238         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 239
 240         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 241         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 242         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 243
 244         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 245         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 246
 247         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 248         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 249                                     .len = WLAN_MAX_KEY_LEN },
 250         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 251         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 252         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 253         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 254         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 255
 256         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 257         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 258         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 259                                        .len = IEEE80211_MAX_DATA_LEN },
 260         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 261                                        .len = IEEE80211_MAX_DATA_LEN },
 262         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 263         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 264         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 265         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 266                                                .len = NL80211_MAX_SUPP_RATES },
 267         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 268         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 269         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 270         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 271                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 272         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 273
 274         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 275         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 276
 277         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 278         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 279         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 280         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 281                                            .len = NL80211_MAX_SUPP_RATES },
 282         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 283
 284         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 285         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 286
 287         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 288
 289         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 290         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 291                               .len = IEEE80211_MAX_DATA_LEN },
 292         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 293         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 294
 295         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 296                                 .len = IEEE80211_MAX_SSID_LEN },
 297         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 298         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 299         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 300         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 301         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 302         [NL80211_ATTR_STA_FLAGS2] = {
 303                 .len = sizeof(struct nl80211_sta_flag_update),
 304         },
 305         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 306         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 307         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 308         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 309         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 310         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 311         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 312         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 313         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 314                                  .len = WLAN_PMKID_LEN },
 315         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 316         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 317         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 318         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 319                                  .len = IEEE80211_MAX_DATA_LEN },
 320         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 321         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 322         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 323         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 324         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 325         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 326         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 327         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 328         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 329         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 330         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 331         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 332         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 333         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 334         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 335         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 336         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 337         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 338         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 339         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 340                                          .len = IEEE80211_MAX_DATA_LEN },
 341         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 342                                          .len = IEEE80211_MAX_DATA_LEN },
 343         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 344         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 345         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 346         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 347         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 348         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 349         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 350         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 351         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 352         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 353                                       .len = IEEE80211_MAX_DATA_LEN },
 354         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 355         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 356         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 357                 .len = NL80211_HT_CAPABILITY_LEN
 358         },
 359         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 360         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 361         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 362         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 363         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 364         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 365         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 366         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 367         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 368         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 369         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 370         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 371         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 372         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 373         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 374         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 375         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 376                 .len = NL80211_VHT_CAPABILITY_LEN,
 377         },
 378         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 379         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 380                                   .len = IEEE80211_MAX_DATA_LEN },
 381 };
 382
 383 /* policy for the key attributes */
 384 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 385         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 386         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 387         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 388         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 389         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 390         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 391         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 392         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 393 };
 394
 395 /* policy for the key default flags */
 396 static const struct nla_policy
 397 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 398         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 399         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 400 };
 401
 402 /* policy for WoWLAN attributes */
 403 static const struct nla_policy
 404 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 405         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 406         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 407         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 408         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 409         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 410         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 411         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 412         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 413         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 414 };
 415
 416 static const struct nla_policy
 417 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 418         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 419         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 420         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 421         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 422         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 423         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 424         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 425                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 426         },
 427         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 428                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 429         },
 430         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 431         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 432         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 433 };
 434
 435 /* policy for GTK rekey offload attributes */
 436 static const struct nla_policy
 437 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 438         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 439         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 440         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 441 };
 442
 443 static const struct nla_policy
 444 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 445         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 446                                                  .len = IEEE80211_MAX_SSID_LEN },
 447         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 448 };
 449
 450 /* ifidx get helper */
 451 static int nl80211_get_ifidx(struct netlink_callback *cb)
 452 {
 453         int res;
 454
 455         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 456                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 457                           nl80211_policy);
 458         if (res)
 459                 return res;
 460
 461         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 462                 return -EINVAL;
 463
 464         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 465         if (!res)
 466                 return -EINVAL;
 467         return res;
 468 }
 469
 470 static int nl80211_prepare_netdev_dump(struct sk_buff *skb,
 471                                        struct netlink_callback *cb,
 472                                        struct cfg80211_registered_device **rdev,
 473                                        struct net_device **dev)
 474 {
 475         int ifidx = cb->args[0];
 476         int err;
 477
 478         if (!ifidx)
 479                 ifidx = nl80211_get_ifidx(cb);
 480         if (ifidx < 0)
 481                 return ifidx;
 482
 483         cb->args[0] = ifidx;
 484
 485         rtnl_lock();
 486
 487         *dev = __dev_get_by_index(sock_net(skb->sk), ifidx);
 488         if (!*dev) {
 489                 err = -ENODEV;
 490                 goto out_rtnl;
 491         }
 492
 493         *rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
 494         if (IS_ERR(*rdev)) {
 495                 err = PTR_ERR(*rdev);
 496                 goto out_rtnl;
 497         }
 498
 499         return 0;
 500  out_rtnl:
 501         rtnl_unlock();
 502         return err;
 503 }
 504
 505 static void nl80211_finish_netdev_dump(struct cfg80211_registered_device *rdev)
 506 {
 507         cfg80211_unlock_rdev(rdev);
 508         rtnl_unlock();
 509 }
 510
 511 /* IE validation */
 512 static bool is_valid_ie_attr(const struct nlattr *attr)
 513 {
 514         const u8 *pos;
 515         int len;
 516
 517         if (!attr)
 518                 return true;
 519
 520         pos = nla_data(attr);
 521         len = nla_len(attr);
 522
 523         while (len) {
 524                 u8 elemlen;
 525
 526                 if (len < 2)
 527                         return false;
 528                 len -= 2;
 529
 530                 elemlen = pos[1];
 531                 if (elemlen > len)
 532                         return false;
 533
 534                 len -= elemlen;
 535                 pos += 2 + elemlen;
 536         }
 537
 538         return true;
 539 }
 540
 541 /* message building helper */
 542 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 543                                    int flags, u8 cmd)
 544 {
 545         /* since there is no private header just add the generic one */
 546         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 547 }
 548
 549 static int nl80211_msg_put_channel(struct sk_buff *msg,
 550                                    struct ieee80211_channel *chan,
 551                                    bool large)
 552 {
 553         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 554                         chan->center_freq))
 555                 goto nla_put_failure;
 556
 557         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 558             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 559                 goto nla_put_failure;
 560         if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
 561             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN))
 562                 goto nla_put_failure;
 563         if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
 564             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IBSS))
 565                 goto nla_put_failure;
 566         if (chan->flags & IEEE80211_CHAN_RADAR) {
 567                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 568                         goto nla_put_failure;
 569                 if (large) {
 570                         u32 time;
 571
 572                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 573
 574                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 575                                         chan->dfs_state))
 576                                 goto nla_put_failure;
 577                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 578                                         time))
 579                                 goto nla_put_failure;
 580                 }
 581         }
 582
 583         if (large) {
 584                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 585                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 586                         goto nla_put_failure;
 587                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 588                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 589                         goto nla_put_failure;
 590                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 591                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 592                         goto nla_put_failure;
 593                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 594                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 595                         goto nla_put_failure;
 596         }
 597
 598         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 599                         DBM_TO_MBM(chan->max_power)))
 600                 goto nla_put_failure;
 601
 602         return 0;
 603
 604  nla_put_failure:
 605         return -ENOBUFS;
 606 }
 607
 608 /* netlink command implementations */
 609
 610 struct key_parse {
 611         struct key_params p;
 612         int idx;
 613         int type;
 614         bool def, defmgmt;
 615         bool def_uni, def_multi;
 616 };
 617
 618 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 619 {
 620         struct nlattr *tb[NL80211_KEY_MAX + 1];
 621         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 622                                    nl80211_key_policy);
 623         if (err)
 624                 return err;
 625
 626         k->def = !!tb[NL80211_KEY_DEFAULT];
 627         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 628
 629         if (k->def) {
 630                 k->def_uni = true;
 631                 k->def_multi = true;
 632         }
 633         if (k->defmgmt)
 634                 k->def_multi = true;
 635
 636         if (tb[NL80211_KEY_IDX])
 637                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 638
 639         if (tb[NL80211_KEY_DATA]) {
 640                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 641                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 642         }
 643
 644         if (tb[NL80211_KEY_SEQ]) {
 645                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 646                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 647         }
 648
 649         if (tb[NL80211_KEY_CIPHER])
 650                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 651
 652         if (tb[NL80211_KEY_TYPE]) {
 653                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 654                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 655                         return -EINVAL;
 656         }
 657
 658         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 659                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 660                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 661                                        tb[NL80211_KEY_DEFAULT_TYPES],
 662                                        nl80211_key_default_policy);
 663                 if (err)
 664                         return err;
 665
 666                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 667                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 668         }
 669
 670         return 0;
 671 }
 672
 673 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 674 {
 675         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 676                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 677                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 678         }
 679
 680         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 681                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 682                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 683         }
 684
 685         if (info->attrs[NL80211_ATTR_KEY_IDX])
 686                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 687
 688         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 689                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 690
 691         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 692         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 693
 694         if (k->def) {
 695                 k->def_uni = true;
 696                 k->def_multi = true;
 697         }
 698         if (k->defmgmt)
 699                 k->def_multi = true;
 700
 701         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 702                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 703                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 704                         return -EINVAL;
 705         }
 706
 707         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 708                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 709                 int err = nla_parse_nested(
 710                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 711                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 712                                 nl80211_key_default_policy);
 713                 if (err)
 714                         return err;
 715
 716                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 717                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 718         }
 719
 720         return 0;
 721 }
 722
 723 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 724 {
 725         int err;
 726
 727         memset(k, 0, sizeof(*k));
 728         k->idx = -1;
 729         k->type = -1;
 730
 731         if (info->attrs[NL80211_ATTR_KEY])
 732                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 733         else
 734                 err = nl80211_parse_key_old(info, k);
 735
 736         if (err)
 737                 return err;
 738
 739         if (k->def && k->defmgmt)
 740                 return -EINVAL;
 741
 742         if (k->defmgmt) {
 743                 if (k->def_uni || !k->def_multi)
 744                         return -EINVAL;
 745         }
 746
 747         if (k->idx != -1) {
 748                 if (k->defmgmt) {
 749                         if (k->idx < 4 || k->idx > 5)
 750                                 return -EINVAL;
 751                 } else if (k->def) {
 752                         if (k->idx < 0 || k->idx > 3)
 753                                 return -EINVAL;
 754                 } else {
 755                         if (k->idx < 0 || k->idx > 5)
 756                                 return -EINVAL;
 757                 }
 758         }
 759
 760         return 0;
 761 }
 762
 763 static struct cfg80211_cached_keys *
 764 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 765                        struct nlattr *keys, bool *no_ht)
 766 {
 767         struct key_parse parse;
 768         struct nlattr *key;
 769         struct cfg80211_cached_keys *result;
 770         int rem, err, def = 0;
 771
 772         result = kzalloc(sizeof(*result), GFP_KERNEL);
 773         if (!result)
 774                 return ERR_PTR(-ENOMEM);
 775
 776         result->def = -1;
 777         result->defmgmt = -1;
 778
 779         nla_for_each_nested(key, keys, rem) {
 780                 memset(&parse, 0, sizeof(parse));
 781                 parse.idx = -1;
 782
 783                 err = nl80211_parse_key_new(key, &parse);
 784                 if (err)
 785                         goto error;
 786                 err = -EINVAL;
 787                 if (!parse.p.key)
 788                         goto error;
 789                 if (parse.idx < 0 || parse.idx > 4)
 790                         goto error;
 791                 if (parse.def) {
 792                         if (def)
 793                                 goto error;
 794                         def = 1;
 795                         result->def = parse.idx;
 796                         if (!parse.def_uni || !parse.def_multi)
 797                                 goto error;
 798                 } else if (parse.defmgmt)
 799                         goto error;
 800                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 801                                                      parse.idx, false, NULL);
 802                 if (err)
 803                         goto error;
 804                 result->params[parse.idx].cipher = parse.p.cipher;
 805                 result->params[parse.idx].key_len = parse.p.key_len;
 806                 result->params[parse.idx].key = result->data[parse.idx];
 807                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 808
 809                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 810                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 811                         if (no_ht)
 812                                 *no_ht = true;
 813                 }
 814         }
 815
 816         return result;
 817  error:
 818         kfree(result);
 819         return ERR_PTR(err);
 820 }
 821
 822 static int nl80211_key_allowed(struct wireless_dev *wdev)
 823 {
 824         ASSERT_WDEV_LOCK(wdev);
 825
 826         switch (wdev->iftype) {
 827         case NL80211_IFTYPE_AP:
 828         case NL80211_IFTYPE_AP_VLAN:
 829         case NL80211_IFTYPE_P2P_GO:
 830         case NL80211_IFTYPE_MESH_POINT:
 831                 break;
 832         case NL80211_IFTYPE_ADHOC:
 833                 if (!wdev->current_bss)
 834                         return -ENOLINK;
 835                 break;
 836         case NL80211_IFTYPE_STATION:
 837         case NL80211_IFTYPE_P2P_CLIENT:
 838                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 839                         return -ENOLINK;
 840                 break;
 841         default:
 842                 return -EINVAL;
 843         }
 844
 845         return 0;
 846 }
 847
 848 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 849 {
 850         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 851         int i;
 852
 853         if (!nl_modes)
 854                 goto nla_put_failure;
 855
 856         i = 0;
 857         while (ifmodes) {
 858                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 859                         goto nla_put_failure;
 860                 ifmodes >>= 1;
 861                 i++;
 862         }
 863
 864         nla_nest_end(msg, nl_modes);
 865         return 0;
 866
 867 nla_put_failure:
 868         return -ENOBUFS;
 869 }
 870
 871 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 872                                           struct sk_buff *msg,
 873                                           bool large)
 874 {
 875         struct nlattr *nl_combis;
 876         int i, j;
 877
 878         nl_combis = nla_nest_start(msg,
 879                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 880         if (!nl_combis)
 881                 goto nla_put_failure;
 882
 883         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 884                 const struct ieee80211_iface_combination *c;
 885                 struct nlattr *nl_combi, *nl_limits;
 886
 887                 c = &wiphy->iface_combinations[i];
 888
 889                 nl_combi = nla_nest_start(msg, i + 1);
 890                 if (!nl_combi)
 891                         goto nla_put_failure;
 892
 893                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 894                 if (!nl_limits)
 895                         goto nla_put_failure;
 896
 897                 for (j = 0; j < c->n_limits; j++) {
 898                         struct nlattr *nl_limit;
 899
 900                         nl_limit = nla_nest_start(msg, j + 1);
 901                         if (!nl_limit)
 902                                 goto nla_put_failure;
 903                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 904                                         c->limits[j].max))
 905                                 goto nla_put_failure;
 906                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 907                                                 c->limits[j].types))
 908                                 goto nla_put_failure;
 909                         nla_nest_end(msg, nl_limit);
 910                 }
 911
 912                 nla_nest_end(msg, nl_limits);
 913
 914                 if (c->beacon_int_infra_match &&
 915                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 916                         goto nla_put_failure;
 917                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 918                                 c->num_different_channels) ||
 919                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 920                                 c->max_interfaces))
 921                         goto nla_put_failure;
 922                 if (large &&
 923                     nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
 924                                 c->radar_detect_widths))
 925                         goto nla_put_failure;
 926
 927                 nla_nest_end(msg, nl_combi);
 928         }
 929
 930         nla_nest_end(msg, nl_combis);
 931
 932         return 0;
 933 nla_put_failure:
 934         return -ENOBUFS;
 935 }
 936
 937 #ifdef CONFIG_PM
 938 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
 939                                         struct sk_buff *msg)
 940 {
 941         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan.tcp;
 942         struct nlattr *nl_tcp;
 943
 944         if (!tcp)
 945                 return 0;
 946
 947         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
 948         if (!nl_tcp)
 949                 return -ENOBUFS;
 950
 951         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 952                         tcp->data_payload_max))
 953                 return -ENOBUFS;
 954
 955         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 956                         tcp->data_payload_max))
 957                 return -ENOBUFS;
 958
 959         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
 960                 return -ENOBUFS;
 961
 962         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
 963                                 sizeof(*tcp->tok), tcp->tok))
 964                 return -ENOBUFS;
 965
 966         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
 967                         tcp->data_interval_max))
 968                 return -ENOBUFS;
 969
 970         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
 971                         tcp->wake_payload_max))
 972                 return -ENOBUFS;
 973
 974         nla_nest_end(msg, nl_tcp);
 975         return 0;
 976 }
 977
 978 static int nl80211_send_wowlan(struct sk_buff *msg,
 979                                struct cfg80211_registered_device *dev,
 980                                bool large)
 981 {
 982         struct nlattr *nl_wowlan;
 983
 984         if (!dev->wiphy.wowlan.flags && !dev->wiphy.wowlan.n_patterns)
 985                 return 0;
 986
 987         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
 988         if (!nl_wowlan)
 989                 return -ENOBUFS;
 990
 991         if (((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY) &&
 992              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
 993             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT) &&
 994              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
 995             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT) &&
 996              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
 997             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
 998              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
 999             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1000              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1001             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1002              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1003             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1004              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1005             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1006              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1007                 return -ENOBUFS;
1008
1009         if (dev->wiphy.wowlan.n_patterns) {
1010                 struct nl80211_wowlan_pattern_support pat = {
1011                         .max_patterns = dev->wiphy.wowlan.n_patterns,
1012                         .min_pattern_len = dev->wiphy.wowlan.pattern_min_len,
1013                         .max_pattern_len = dev->wiphy.wowlan.pattern_max_len,
1014                         .max_pkt_offset = dev->wiphy.wowlan.max_pkt_offset,
1015                 };
1016
1017                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1018                             sizeof(pat), &pat))
1019                         return -ENOBUFS;
1020         }
1021
1022         if (large && nl80211_send_wowlan_tcp_caps(dev, msg))
1023                 return -ENOBUFS;
1024
1025         nla_nest_end(msg, nl_wowlan);
1026
1027         return 0;
1028 }
1029 #endif
1030
1031 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1032                                       struct ieee80211_supported_band *sband)
1033 {
1034         struct nlattr *nl_rates, *nl_rate;
1035         struct ieee80211_rate *rate;
1036         int i;
1037
1038         /* add HT info */
1039         if (sband->ht_cap.ht_supported &&
1040             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1041                      sizeof(sband->ht_cap.mcs),
1042                      &sband->ht_cap.mcs) ||
1043              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1044                          sband->ht_cap.cap) ||
1045              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1046                         sband->ht_cap.ampdu_factor) ||
1047              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1048                         sband->ht_cap.ampdu_density)))
1049                 return -ENOBUFS;
1050
1051         /* add VHT info */
1052         if (sband->vht_cap.vht_supported &&
1053             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1054                      sizeof(sband->vht_cap.vht_mcs),
1055                      &sband->vht_cap.vht_mcs) ||
1056              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1057                          sband->vht_cap.cap)))
1058                 return -ENOBUFS;
1059
1060         /* add bitrates */
1061         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1062         if (!nl_rates)
1063                 return -ENOBUFS;
1064
1065         for (i = 0; i < sband->n_bitrates; i++) {
1066                 nl_rate = nla_nest_start(msg, i);
1067                 if (!nl_rate)
1068                         return -ENOBUFS;
1069
1070                 rate = &sband->bitrates[i];
1071                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1072                                 rate->bitrate))
1073                         return -ENOBUFS;
1074                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1075                     nla_put_flag(msg,
1076                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1077                         return -ENOBUFS;
1078
1079                 nla_nest_end(msg, nl_rate);
1080         }
1081
1082         nla_nest_end(msg, nl_rates);
1083
1084         return 0;
1085 }
1086
1087 static int
1088 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1089                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1090 {
1091         u16 stypes;
1092         struct nlattr *nl_ftypes, *nl_ifs;
1093         enum nl80211_iftype ift;
1094         int i;
1095
1096         if (!mgmt_stypes)
1097                 return 0;
1098
1099         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1100         if (!nl_ifs)
1101                 return -ENOBUFS;
1102
1103         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1104                 nl_ftypes = nla_nest_start(msg, ift);
1105                 if (!nl_ftypes)
1106                         return -ENOBUFS;
1107                 i = 0;
1108                 stypes = mgmt_stypes[ift].tx;
1109                 while (stypes) {
1110                         if ((stypes & 1) &&
1111                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1112                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1113                                 return -ENOBUFS;
1114                         stypes >>= 1;
1115                         i++;
1116                 }
1117                 nla_nest_end(msg, nl_ftypes);
1118         }
1119
1120         nla_nest_end(msg, nl_ifs);
1121
1122         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1123         if (!nl_ifs)
1124                 return -ENOBUFS;
1125
1126         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1127                 nl_ftypes = nla_nest_start(msg, ift);
1128                 if (!nl_ftypes)
1129                         return -ENOBUFS;
1130                 i = 0;
1131                 stypes = mgmt_stypes[ift].rx;
1132                 while (stypes) {
1133                         if ((stypes & 1) &&
1134                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1135                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1136                                 return -ENOBUFS;
1137                         stypes >>= 1;
1138                         i++;
1139                 }
1140                 nla_nest_end(msg, nl_ftypes);
1141         }
1142         nla_nest_end(msg, nl_ifs);
1143
1144         return 0;
1145 }
1146
1147 static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
1148                               struct sk_buff *msg, u32 portid, u32 seq,
1149                               int flags, bool split, long *split_start,
1150                               long *band_start, long *chan_start)
1151 {
1152         void *hdr;
1153         struct nlattr *nl_bands, *nl_band;
1154         struct nlattr *nl_freqs, *nl_freq;
1155         struct nlattr *nl_cmds;
1156         enum ieee80211_band band;
1157         struct ieee80211_channel *chan;
1158         int i;
1159         const struct ieee80211_txrx_stypes *mgmt_stypes =
1160                                 dev->wiphy.mgmt_stypes;
1161         long start = 0, start_chan = 0, start_band = 0;
1162         u32 features;
1163
1164         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
1165         if (!hdr)
1166                 return -ENOBUFS;
1167
1168         /* allow always using the variables */
1169         if (!split) {
1170                 split_start = &start;
1171                 band_start = &start_band;
1172                 chan_start = &start_chan;
1173         }
1174
1175         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
1176             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1177                            wiphy_name(&dev->wiphy)) ||
1178             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1179                         cfg80211_rdev_list_generation))
1180                 goto nla_put_failure;
1181
1182         switch (*split_start) {
1183         case 0:
1184                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1185                                dev->wiphy.retry_short) ||
1186                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1187                                dev->wiphy.retry_long) ||
1188                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1189                                 dev->wiphy.frag_threshold) ||
1190                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1191                                 dev->wiphy.rts_threshold) ||
1192                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1193                                dev->wiphy.coverage_class) ||
1194                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1195                                dev->wiphy.max_scan_ssids) ||
1196                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1197                                dev->wiphy.max_sched_scan_ssids) ||
1198                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1199                                 dev->wiphy.max_scan_ie_len) ||
1200                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1201                                 dev->wiphy.max_sched_scan_ie_len) ||
1202                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1203                                dev->wiphy.max_match_sets))
1204                         goto nla_put_failure;
1205
1206                 if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1207                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1208                         goto nla_put_failure;
1209                 if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1210                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1211                         goto nla_put_failure;
1212                 if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1213                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1214                         goto nla_put_failure;
1215                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1216                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1217                         goto nla_put_failure;
1218                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1219                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1220                         goto nla_put_failure;
1221                 if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1222                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1223                         goto nla_put_failure;
1224
1225                 (*split_start)++;
1226                 if (split)
1227                         break;
1228         case 1:
1229                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1230                             sizeof(u32) * dev->wiphy.n_cipher_suites,
1231                             dev->wiphy.cipher_suites))
1232                         goto nla_put_failure;
1233
1234                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1235                                dev->wiphy.max_num_pmkids))
1236                         goto nla_put_failure;
1237
1238                 if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1239                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1240                         goto nla_put_failure;
1241
1242                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1243                                 dev->wiphy.available_antennas_tx) ||
1244                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1245                                 dev->wiphy.available_antennas_rx))
1246                         goto nla_put_failure;
1247
1248                 if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1249                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1250                                 dev->wiphy.probe_resp_offload))
1251                         goto nla_put_failure;
1252
1253                 if ((dev->wiphy.available_antennas_tx ||
1254                      dev->wiphy.available_antennas_rx) &&
1255                     dev->ops->get_antenna) {
1256                         u32 tx_ant = 0, rx_ant = 0;
1257                         int res;
1258                         res = rdev_get_antenna(dev, &tx_ant, &rx_ant);
1259                         if (!res) {
1260                                 if (nla_put_u32(msg,
1261                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1262                                                 tx_ant) ||
1263                                     nla_put_u32(msg,
1264                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1265                                                 rx_ant))
1266                                         goto nla_put_failure;
1267                         }
1268                 }
1269
1270                 (*split_start)++;
1271                 if (split)
1272                         break;
1273         case 2:
1274                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1275                                         dev->wiphy.interface_modes))
1276                                 goto nla_put_failure;
1277                 (*split_start)++;
1278                 if (split)
1279                         break;
1280         case 3:
1281                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1282                 if (!nl_bands)
1283                         goto nla_put_failure;
1284
1285                 for (band = *band_start; band < IEEE80211_NUM_BANDS; band++) {
1286                         struct ieee80211_supported_band *sband;
1287
1288                         sband = dev->wiphy.bands[band];
1289
1290                         if (!sband)
1291                                 continue;
1292
1293                         nl_band = nla_nest_start(msg, band);
1294                         if (!nl_band)
1295                                 goto nla_put_failure;
1296
1297                         switch (*chan_start) {
1298                         case 0:
1299                                 if (nl80211_send_band_rateinfo(msg, sband))
1300                                         goto nla_put_failure;
1301                                 (*chan_start)++;
1302                                 if (split)
1303                                         break;
1304                         default:
1305                                 /* add frequencies */
1306                                 nl_freqs = nla_nest_start(
1307                                         msg, NL80211_BAND_ATTR_FREQS);
1308                                 if (!nl_freqs)
1309                                         goto nla_put_failure;
1310
1311                                 for (i = *chan_start - 1;
1312                                      i < sband->n_channels;
1313                                      i++) {
1314                                         nl_freq = nla_nest_start(msg, i);
1315                                         if (!nl_freq)
1316                                                 goto nla_put_failure;
1317
1318                                         chan = &sband->channels[i];
1319
1320                                         if (nl80211_msg_put_channel(msg, chan,
1321                                                                     split))
1322                                                 goto nla_put_failure;
1323
1324                                         nla_nest_end(msg, nl_freq);
1325                                         if (split)
1326                                                 break;
1327                                 }
1328                                 if (i < sband->n_channels)
1329                                         *chan_start = i + 2;
1330                                 else
1331                                         *chan_start = 0;
1332                                 nla_nest_end(msg, nl_freqs);
1333                         }
1334
1335                         nla_nest_end(msg, nl_band);
1336
1337                         if (split) {
1338                                 /* start again here */
1339                                 if (*chan_start)
1340                                         band--;
1341                                 break;
1342                         }
1343                 }
1344                 nla_nest_end(msg, nl_bands);
1345
1346                 if (band < IEEE80211_NUM_BANDS)
1347                         *band_start = band + 1;
1348                 else
1349                         *band_start = 0;
1350
1351                 /* if bands & channels are done, continue outside */
1352                 if (*band_start == 0 && *chan_start == 0)
1353                         (*split_start)++;
1354                 if (split)
1355                         break;
1356         case 4:
1357                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1358                 if (!nl_cmds)
1359                         goto nla_put_failure;
1360
1361                 i = 0;
1362 #define CMD(op, n)                                                      \
1363                  do {                                                   \
1364                         if (dev->ops->op) {                             \
1365                                 i++;                                    \
1366                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1367                                         goto nla_put_failure;           \
1368                         }                                               \
1369                 } while (0)
1370
1371                 CMD(add_virtual_intf, NEW_INTERFACE);
1372                 CMD(change_virtual_intf, SET_INTERFACE);
1373                 CMD(add_key, NEW_KEY);
1374                 CMD(start_ap, START_AP);
1375                 CMD(add_station, NEW_STATION);
1376                 CMD(add_mpath, NEW_MPATH);
1377                 CMD(update_mesh_config, SET_MESH_CONFIG);
1378                 CMD(change_bss, SET_BSS);
1379                 CMD(auth, AUTHENTICATE);
1380                 CMD(assoc, ASSOCIATE);
1381                 CMD(deauth, DEAUTHENTICATE);
1382                 CMD(disassoc, DISASSOCIATE);
1383                 CMD(join_ibss, JOIN_IBSS);
1384                 CMD(join_mesh, JOIN_MESH);
1385                 CMD(set_pmksa, SET_PMKSA);
1386                 CMD(del_pmksa, DEL_PMKSA);
1387                 CMD(flush_pmksa, FLUSH_PMKSA);
1388                 if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1389                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1390                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1391                 CMD(mgmt_tx, FRAME);
1392                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1393                 if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1394                         i++;
1395                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1396                                 goto nla_put_failure;
1397                 }
1398                 if (dev->ops->set_monitor_channel || dev->ops->start_ap ||
1399                     dev->ops->join_mesh) {
1400                         i++;
1401                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1402                                 goto nla_put_failure;
1403                 }
1404                 CMD(set_wds_peer, SET_WDS_PEER);
1405                 if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1406                         CMD(tdls_mgmt, TDLS_MGMT);
1407                         CMD(tdls_oper, TDLS_OPER);
1408                 }
1409                 if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1410                         CMD(sched_scan_start, START_SCHED_SCAN);
1411                 CMD(probe_client, PROBE_CLIENT);
1412                 CMD(set_noack_map, SET_NOACK_MAP);
1413                 if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1414                         i++;
1415                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1416                                 goto nla_put_failure;
1417                 }
1418                 CMD(start_p2p_device, START_P2P_DEVICE);
1419                 CMD(set_mcast_rate, SET_MCAST_RATE);
1420
1421 #ifdef CONFIG_NL80211_TESTMODE
1422                 CMD(testmode_cmd, TESTMODE);
1423 #endif
1424
1425 #undef CMD
1426
1427                 if (dev->ops->connect || dev->ops->auth) {
1428                         i++;
1429                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1430                                 goto nla_put_failure;
1431                 }
1432
1433                 if (dev->ops->disconnect || dev->ops->deauth) {
1434                         i++;
1435                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1436                                 goto nla_put_failure;
1437                 }
1438
1439                 nla_nest_end(msg, nl_cmds);
1440                 (*split_start)++;
1441                 if (split)
1442                         break;
1443         case 5:
1444                 if (dev->ops->remain_on_channel &&
1445                     (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1446                     nla_put_u32(msg,
1447                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1448                                 dev->wiphy.max_remain_on_channel_duration))
1449                         goto nla_put_failure;
1450
1451                 if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1452                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1453                         goto nla_put_failure;
1454
1455                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1456                         goto nla_put_failure;
1457                 (*split_start)++;
1458                 if (split)
1459                         break;
1460         case 6:
1461 #ifdef CONFIG_PM
1462                 if (nl80211_send_wowlan(msg, dev, split))
1463                         goto nla_put_failure;
1464                 (*split_start)++;
1465                 if (split)
1466                         break;
1467 #else
1468                 (*split_start)++;
1469 #endif
1470         case 7:
1471                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1472                                         dev->wiphy.software_iftypes))
1473                         goto nla_put_failure;
1474
1475                 if (nl80211_put_iface_combinations(&dev->wiphy, msg, split))
1476                         goto nla_put_failure;
1477
1478                 (*split_start)++;
1479                 if (split)
1480                         break;
1481         case 8:
1482                 if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1483                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1484                                 dev->wiphy.ap_sme_capa))
1485                         goto nla_put_failure;
1486
1487                 features = dev->wiphy.features;
1488                 /*
1489                  * We can only add the per-channel limit information if the
1490                  * dump is split, otherwise it makes it too big. Therefore
1491                  * only advertise it in that case.
1492                  */
1493                 if (split)
1494                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1495                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1496                         goto nla_put_failure;
1497
1498                 if (dev->wiphy.ht_capa_mod_mask &&
1499                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1500                             sizeof(*dev->wiphy.ht_capa_mod_mask),
1501                             dev->wiphy.ht_capa_mod_mask))
1502                         goto nla_put_failure;
1503
1504                 if (dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1505                     dev->wiphy.max_acl_mac_addrs &&
1506                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1507                                 dev->wiphy.max_acl_mac_addrs))
1508                         goto nla_put_failure;
1509
1510                 /*
1511                  * Any information below this point is only available to
1512                  * applications that can deal with it being split. This
1513                  * helps ensure that newly added capabilities don't break
1514                  * older tools by overrunning their buffers.
1515                  *
1516                  * We still increment split_start so that in the split
1517                  * case we'll continue with more data in the next round,
1518                  * but break unconditionally so unsplit data stops here.
1519                  */
1520                 (*split_start)++;
1521                 break;
1522         case 9:
1523                 if (dev->wiphy.extended_capabilities &&
1524                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1525                              dev->wiphy.extended_capabilities_len,
1526                              dev->wiphy.extended_capabilities) ||
1527                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1528                              dev->wiphy.extended_capabilities_len,
1529                              dev->wiphy.extended_capabilities_mask)))
1530                         goto nla_put_failure;
1531
1532                 if (dev->wiphy.vht_capa_mod_mask &&
1533                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1534                             sizeof(*dev->wiphy.vht_capa_mod_mask),
1535                             dev->wiphy.vht_capa_mod_mask))
1536                         goto nla_put_failure;
1537
1538                 /* done */
1539                 *split_start = 0;
1540                 break;
1541         }
1542         return genlmsg_end(msg, hdr);
1543
1544  nla_put_failure:
1545         genlmsg_cancel(msg, hdr);
1546         return -EMSGSIZE;
1547 }
1548
1549 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1550 {
1551         int idx = 0, ret;
1552         int start = cb->args[0];
1553         struct cfg80211_registered_device *dev;
1554         s64 filter_wiphy = -1;
1555         bool split = false;
1556         struct nlattr **tb = nl80211_fam.attrbuf;
1557         int res;
1558
1559         mutex_lock(&cfg80211_mutex);
1560         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1561                           tb, nl80211_fam.maxattr, nl80211_policy);
1562         if (res == 0) {
1563                 split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1564                 if (tb[NL80211_ATTR_WIPHY])
1565                         filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1566                 if (tb[NL80211_ATTR_WDEV])
1567                         filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1568                 if (tb[NL80211_ATTR_IFINDEX]) {
1569                         struct net_device *netdev;
1570                         int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1571
1572                         netdev = dev_get_by_index(sock_net(skb->sk), ifidx);
1573                         if (!netdev) {
1574                                 mutex_unlock(&cfg80211_mutex);
1575                                 return -ENODEV;
1576                         }
1577                         if (netdev->ieee80211_ptr) {
1578                                 dev = wiphy_to_dev(
1579                                         netdev->ieee80211_ptr->wiphy);
1580                                 filter_wiphy = dev->wiphy_idx;
1581                         }
1582                         dev_put(netdev);
1583                 }
1584         }
1585
1586         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1587                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1588                         continue;
1589                 if (++idx <= start)
1590                         continue;
1591                 if (filter_wiphy != -1 && dev->wiphy_idx != filter_wiphy)
1592                         continue;
1593                 /* attempt to fit multiple wiphy data chunks into the skb */
1594                 do {
1595                         ret = nl80211_send_wiphy(dev, skb,
1596                                                  NETLINK_CB(cb->skb).portid,
1597                                                  cb->nlh->nlmsg_seq,
1598                                                  NLM_F_MULTI,
1599                                                  split, &cb->args[1],
1600                                                  &cb->args[2],
1601                                                  &cb->args[3]);
1602                         if (ret < 0) {
1603                                 /*
1604                                  * If sending the wiphy data didn't fit (ENOBUFS
1605                                  * or EMSGSIZE returned), this SKB is still
1606                                  * empty (so it's not too big because another
1607                                  * wiphy dataset is already in the skb) and
1608                                  * we've not tried to adjust the dump allocation
1609                                  * yet ... then adjust the alloc size to be
1610                                  * bigger, and return 1 but with the empty skb.
1611                                  * This results in an empty message being RX'ed
1612                                  * in userspace, but that is ignored.
1613                                  *
1614                                  * We can then retry with the larger buffer.
1615                                  */
1616                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1617                                     !skb->len &&
1618                                     cb->min_dump_alloc < 4096) {
1619                                         cb->min_dump_alloc = 4096;
1620                                         mutex_unlock(&cfg80211_mutex);
1621                                         return 1;
1622                                 }
1623                                 idx--;
1624                                 break;
1625                         }
1626                 } while (cb->args[1] > 0);
1627                 break;
1628         }
1629         mutex_unlock(&cfg80211_mutex);
1630
1631         cb->args[0] = idx;
1632
1633         return skb->len;
1634 }
1635
1636 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1637 {
1638         struct sk_buff *msg;
1639         struct cfg80211_registered_device *dev = info->user_ptr[0];
1640
1641         msg = nlmsg_new(4096, GFP_KERNEL);
1642         if (!msg)
1643                 return -ENOMEM;
1644
1645         if (nl80211_send_wiphy(dev, msg, info->snd_portid, info->snd_seq, 0,
1646                                false, NULL, NULL, NULL) < 0) {
1647                 nlmsg_free(msg);
1648                 return -ENOBUFS;
1649         }
1650
1651         return genlmsg_reply(msg, info);
1652 }
1653
1654 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1655         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1656         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1657         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1658         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1659         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1660 };
1661
1662 static int parse_txq_params(struct nlattr *tb[],
1663                             struct ieee80211_txq_params *txq_params)
1664 {
1665         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1666             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1667             !tb[NL80211_TXQ_ATTR_AIFS])
1668                 return -EINVAL;
1669
1670         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1671         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1672         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1673         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1674         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1675
1676         if (txq_params->ac >= NL80211_NUM_ACS)
1677                 return -EINVAL;
1678
1679         return 0;
1680 }
1681
1682 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1683 {
1684         /*
1685          * You can only set the channel explicitly for WDS interfaces,
1686          * all others have their channel managed via their respective
1687          * "establish a connection" command (connect, join, ...)
1688          *
1689          * For AP/GO and mesh mode, the channel can be set with the
1690          * channel userspace API, but is only stored and passed to the
1691          * low-level driver when the AP starts or the mesh is joined.
1692          * This is for backward compatibility, userspace can also give
1693          * the channel in the start-ap or join-mesh commands instead.
1694          *
1695          * Monitors are special as they are normally slaved to
1696          * whatever else is going on, so they have their own special
1697          * operation to set the monitor channel if possible.
1698          */
1699         return !wdev ||
1700                 wdev->iftype == NL80211_IFTYPE_AP ||
1701                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1702                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1703                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1704 }
1705
1706 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1707                                  struct genl_info *info,
1708                                  struct cfg80211_chan_def *chandef)
1709 {
1710         u32 control_freq;
1711
1712         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1713                 return -EINVAL;
1714
1715         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1716
1717         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1718         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1719         chandef->center_freq1 = control_freq;
1720         chandef->center_freq2 = 0;
1721
1722         /* Primary channel not allowed */
1723         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1724                 return -EINVAL;
1725
1726         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1727                 enum nl80211_channel_type chantype;
1728
1729                 chantype = nla_get_u32(
1730                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1731
1732                 switch (chantype) {
1733                 case NL80211_CHAN_NO_HT:
1734                 case NL80211_CHAN_HT20:
1735                 case NL80211_CHAN_HT40PLUS:
1736                 case NL80211_CHAN_HT40MINUS:
1737                         cfg80211_chandef_create(chandef, chandef->chan,
1738                                                 chantype);
1739                         break;
1740                 default:
1741                         return -EINVAL;
1742                 }
1743         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1744                 chandef->width =
1745                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1746                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1747                         chandef->center_freq1 =
1748                                 nla_get_u32(
1749                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1750                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1751                         chandef->center_freq2 =
1752                                 nla_get_u32(
1753                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1754         }
1755
1756         if (!cfg80211_chandef_valid(chandef))
1757                 return -EINVAL;
1758
1759         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1760                                      IEEE80211_CHAN_DISABLED))
1761                 return -EINVAL;
1762
1763         return 0;
1764 }
1765
1766 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1767                                  struct wireless_dev *wdev,
1768                                  struct genl_info *info)
1769 {
1770         struct cfg80211_chan_def chandef;
1771         int result;
1772         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1773
1774         if (wdev)
1775                 iftype = wdev->iftype;
1776
1777         if (!nl80211_can_set_dev_channel(wdev))
1778                 return -EOPNOTSUPP;
1779
1780         result = nl80211_parse_chandef(rdev, info, &chandef);
1781         if (result)
1782                 return result;
1783
1784         mutex_lock(&rdev->devlist_mtx);
1785         switch (iftype) {
1786         case NL80211_IFTYPE_AP:
1787         case NL80211_IFTYPE_P2P_GO:
1788                 if (wdev->beacon_interval) {
1789                         result = -EBUSY;
1790                         break;
1791                 }
1792                 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef)) {
1793                         result = -EINVAL;
1794                         break;
1795                 }
1796                 wdev->preset_chandef = chandef;
1797                 result = 0;
1798                 break;
1799         case NL80211_IFTYPE_MESH_POINT:
1800                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
1801                 break;
1802         case NL80211_IFTYPE_MONITOR:
1803                 result = cfg80211_set_monitor_channel(rdev, &chandef);
1804                 break;
1805         default:
1806                 result = -EINVAL;
1807         }
1808         mutex_unlock(&rdev->devlist_mtx);
1809
1810         return result;
1811 }
1812
1813 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1814 {
1815         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1816         struct net_device *netdev = info->user_ptr[1];
1817
1818         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1819 }
1820
1821 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1822 {
1823         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1824         struct net_device *dev = info->user_ptr[1];
1825         struct wireless_dev *wdev = dev->ieee80211_ptr;
1826         const u8 *bssid;
1827
1828         if (!info->attrs[NL80211_ATTR_MAC])
1829                 return -EINVAL;
1830
1831         if (netif_running(dev))
1832                 return -EBUSY;
1833
1834         if (!rdev->ops->set_wds_peer)
1835                 return -EOPNOTSUPP;
1836
1837         if (wdev->iftype != NL80211_IFTYPE_WDS)
1838                 return -EOPNOTSUPP;
1839
1840         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1841         return rdev_set_wds_peer(rdev, dev, bssid);
1842 }
1843
1844
1845 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1846 {
1847         struct cfg80211_registered_device *rdev;
1848         struct net_device *netdev = NULL;
1849         struct wireless_dev *wdev;
1850         int result = 0, rem_txq_params = 0;
1851         struct nlattr *nl_txq_params;
1852         u32 changed;
1853         u8 retry_short = 0, retry_long = 0;
1854         u32 frag_threshold = 0, rts_threshold = 0;
1855         u8 coverage_class = 0;
1856
1857         /*
1858          * Try to find the wiphy and netdev. Normally this
1859          * function shouldn't need the netdev, but this is
1860          * done for backward compatibility -- previously
1861          * setting the channel was done per wiphy, but now
1862          * it is per netdev. Previous userland like hostapd
1863          * also passed a netdev to set_wiphy, so that it is
1864          * possible to let that go to the right netdev!
1865          */
1866         mutex_lock(&cfg80211_mutex);
1867
1868         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1869                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1870
1871                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1872                 if (netdev && netdev->ieee80211_ptr) {
1873                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1874                         mutex_lock(&rdev->mtx);
1875                 } else
1876                         netdev = NULL;
1877         }
1878
1879         if (!netdev) {
1880                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
1881                                                   info->attrs);
1882                 if (IS_ERR(rdev)) {
1883                         mutex_unlock(&cfg80211_mutex);
1884                         return PTR_ERR(rdev);
1885                 }
1886                 wdev = NULL;
1887                 netdev = NULL;
1888                 result = 0;
1889
1890                 mutex_lock(&rdev->mtx);
1891         } else
1892                 wdev = netdev->ieee80211_ptr;
1893
1894         /*
1895          * end workaround code, by now the rdev is available
1896          * and locked, and wdev may or may not be NULL.
1897          */
1898
1899         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1900                 result = cfg80211_dev_rename(
1901                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1902
1903         mutex_unlock(&cfg80211_mutex);
1904
1905         if (result)
1906                 goto bad_res;
1907
1908         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1909                 struct ieee80211_txq_params txq_params;
1910                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1911
1912                 if (!rdev->ops->set_txq_params) {
1913                         result = -EOPNOTSUPP;
1914                         goto bad_res;
1915                 }
1916
1917                 if (!netdev) {
1918                         result = -EINVAL;
1919                         goto bad_res;
1920                 }
1921
1922                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1923                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
1924                         result = -EINVAL;
1925                         goto bad_res;
1926                 }
1927
1928                 if (!netif_running(netdev)) {
1929                         result = -ENETDOWN;
1930                         goto bad_res;
1931                 }
1932
1933                 nla_for_each_nested(nl_txq_params,
1934                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1935                                     rem_txq_params) {
1936                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1937                                   nla_data(nl_txq_params),
1938                                   nla_len(nl_txq_params),
1939                                   txq_params_policy);
1940                         result = parse_txq_params(tb, &txq_params);
1941                         if (result)
1942                                 goto bad_res;
1943
1944                         result = rdev_set_txq_params(rdev, netdev,
1945                                                      &txq_params);
1946                         if (result)
1947                                 goto bad_res;
1948                 }
1949         }
1950
1951         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1952                 result = __nl80211_set_channel(rdev,
1953                                 nl80211_can_set_dev_channel(wdev) ? wdev : NULL,
1954                                 info);
1955                 if (result)
1956                         goto bad_res;
1957         }
1958
1959         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1960                 struct wireless_dev *txp_wdev = wdev;
1961                 enum nl80211_tx_power_setting type;
1962                 int idx, mbm = 0;
1963
1964                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
1965                         txp_wdev = NULL;
1966
1967                 if (!rdev->ops->set_tx_power) {
1968                         result = -EOPNOTSUPP;
1969                         goto bad_res;
1970                 }
1971
1972                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1973                 type = nla_get_u32(info->attrs[idx]);
1974
1975                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1976                     (type != NL80211_TX_POWER_AUTOMATIC)) {
1977                         result = -EINVAL;
1978                         goto bad_res;
1979                 }
1980
1981                 if (type != NL80211_TX_POWER_AUTOMATIC) {
1982                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1983                         mbm = nla_get_u32(info->attrs[idx]);
1984                 }
1985
1986                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
1987                 if (result)
1988                         goto bad_res;
1989         }
1990
1991         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
1992             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
1993                 u32 tx_ant, rx_ant;
1994                 if ((!rdev->wiphy.available_antennas_tx &&
1995                      !rdev->wiphy.available_antennas_rx) ||
1996                     !rdev->ops->set_antenna) {
1997                         result = -EOPNOTSUPP;
1998                         goto bad_res;
1999                 }
2000
2001                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2002                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2003
2004                 /* reject antenna configurations which don't match the
2005                  * available antenna masks, except for the "all" mask */
2006                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2007                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
2008                         result = -EINVAL;
2009                         goto bad_res;
2010                 }
2011
2012                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2013                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2014
2015                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2016                 if (result)
2017                         goto bad_res;
2018         }
2019
2020         changed = 0;
2021
2022         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2023                 retry_short = nla_get_u8(
2024                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2025                 if (retry_short == 0) {
2026                         result = -EINVAL;
2027                         goto bad_res;
2028                 }
2029                 changed |= WIPHY_PARAM_RETRY_SHORT;
2030         }
2031
2032         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2033                 retry_long = nla_get_u8(
2034                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2035                 if (retry_long == 0) {
2036                         result = -EINVAL;
2037                         goto bad_res;
2038                 }
2039                 changed |= WIPHY_PARAM_RETRY_LONG;
2040         }
2041
2042         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2043                 frag_threshold = nla_get_u32(
2044                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2045                 if (frag_threshold < 256) {
2046                         result = -EINVAL;
2047                         goto bad_res;
2048                 }
2049                 if (frag_threshold != (u32) -1) {
2050                         /*
2051                          * Fragments (apart from the last one) are required to
2052                          * have even length. Make the fragmentation code
2053                          * simpler by stripping LSB should someone try to use
2054                          * odd threshold value.
2055                          */
2056                         frag_threshold &= ~0x1;
2057                 }
2058                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2059         }
2060
2061         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2062                 rts_threshold = nla_get_u32(
2063                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2064                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2065         }
2066
2067         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2068                 coverage_class = nla_get_u8(
2069                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2070                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2071         }
2072
2073         if (changed) {
2074                 u8 old_retry_short, old_retry_long;
2075                 u32 old_frag_threshold, old_rts_threshold;
2076                 u8 old_coverage_class;
2077
2078                 if (!rdev->ops->set_wiphy_params) {
2079                         result = -EOPNOTSUPP;
2080                         goto bad_res;
2081                 }
2082
2083                 old_retry_short = rdev->wiphy.retry_short;
2084                 old_retry_long = rdev->wiphy.retry_long;
2085                 old_frag_threshold = rdev->wiphy.frag_threshold;
2086                 old_rts_threshold = rdev->wiphy.rts_threshold;
2087                 old_coverage_class = rdev->wiphy.coverage_class;
2088
2089                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2090                         rdev->wiphy.retry_short = retry_short;
2091                 if (changed & WIPHY_PARAM_RETRY_LONG)
2092                         rdev->wiphy.retry_long = retry_long;
2093                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2094                         rdev->wiphy.frag_threshold = frag_threshold;
2095                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2096                         rdev->wiphy.rts_threshold = rts_threshold;
2097                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2098                         rdev->wiphy.coverage_class = coverage_class;
2099
2100                 result = rdev_set_wiphy_params(rdev, changed);
2101                 if (result) {
2102                         rdev->wiphy.retry_short = old_retry_short;
2103                         rdev->wiphy.retry_long = old_retry_long;
2104                         rdev->wiphy.frag_threshold = old_frag_threshold;
2105                         rdev->wiphy.rts_threshold = old_rts_threshold;
2106                         rdev->wiphy.coverage_class = old_coverage_class;
2107                 }
2108         }
2109
2110  bad_res:
2111         mutex_unlock(&rdev->mtx);
2112         if (netdev)
2113                 dev_put(netdev);
2114         return result;
2115 }
2116
2117 static inline u64 wdev_id(struct wireless_dev *wdev)
2118 {
2119         return (u64)wdev->identifier |
2120                ((u64)wiphy_to_dev(wdev->wiphy)->wiphy_idx << 32);
2121 }
2122
2123 static int nl80211_send_chandef(struct sk_buff *msg,
2124                                  struct cfg80211_chan_def *chandef)
2125 {
2126         WARN_ON(!cfg80211_chandef_valid(chandef));
2127
2128         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2129                         chandef->chan->center_freq))
2130                 return -ENOBUFS;
2131         switch (chandef->width) {
2132         case NL80211_CHAN_WIDTH_20_NOHT:
2133         case NL80211_CHAN_WIDTH_20:
2134         case NL80211_CHAN_WIDTH_40:
2135                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2136                                 cfg80211_get_chandef_type(chandef)))
2137                         return -ENOBUFS;
2138                 break;
2139         default:
2140                 break;
2141         }
2142         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2143                 return -ENOBUFS;
2144         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2145                 return -ENOBUFS;
2146         if (chandef->center_freq2 &&
2147             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2148                 return -ENOBUFS;
2149         return 0;
2150 }
2151
2152 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2153                               struct cfg80211_registered_device *rdev,
2154                               struct wireless_dev *wdev)
2155 {
2156         struct net_device *dev = wdev->netdev;
2157         void *hdr;
2158
2159         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
2160         if (!hdr)
2161                 return -1;
2162
2163         if (dev &&
2164             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2165              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2166                 goto nla_put_failure;
2167
2168         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2169             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2170             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2171             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2172             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2173                         rdev->devlist_generation ^
2174                         (cfg80211_rdev_list_generation << 2)))
2175                 goto nla_put_failure;
2176
2177         if (rdev->ops->get_channel) {
2178                 int ret;
2179                 struct cfg80211_chan_def chandef;
2180
2181                 ret = rdev_get_channel(rdev, wdev, &chandef);
2182                 if (ret == 0) {
2183                         if (nl80211_send_chandef(msg, &chandef))
2184                                 goto nla_put_failure;
2185                 }
2186         }
2187
2188         if (wdev->ssid_len) {
2189                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2190                         goto nla_put_failure;
2191         }
2192
2193         return genlmsg_end(msg, hdr);
2194
2195  nla_put_failure:
2196         genlmsg_cancel(msg, hdr);
2197         return -EMSGSIZE;
2198 }
2199
2200 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2201 {
2202         int wp_idx = 0;
2203         int if_idx = 0;
2204         int wp_start = cb->args[0];
2205         int if_start = cb->args[1];
2206         struct cfg80211_registered_device *rdev;
2207         struct wireless_dev *wdev;
2208
2209         mutex_lock(&cfg80211_mutex);
2210         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2211                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2212                         continue;
2213                 if (wp_idx < wp_start) {
2214                         wp_idx++;
2215                         continue;
2216                 }
2217                 if_idx = 0;
2218
2219                 mutex_lock(&rdev->devlist_mtx);
2220                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
2221                         if (if_idx < if_start) {
2222                                 if_idx++;
2223                                 continue;
2224                         }
2225                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2226                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2227                                                rdev, wdev) < 0) {
2228                                 mutex_unlock(&rdev->devlist_mtx);
2229                                 goto out;
2230                         }
2231                         if_idx++;
2232                 }
2233                 mutex_unlock(&rdev->devlist_mtx);
2234
2235                 wp_idx++;
2236         }
2237  out:
2238         mutex_unlock(&cfg80211_mutex);
2239
2240         cb->args[0] = wp_idx;
2241         cb->args[1] = if_idx;
2242
2243         return skb->len;
2244 }
2245
2246 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2247 {
2248         struct sk_buff *msg;
2249         struct cfg80211_registered_device *dev = info->user_ptr[0];
2250         struct wireless_dev *wdev = info->user_ptr[1];
2251
2252         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2253         if (!msg)
2254                 return -ENOMEM;
2255
2256         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2257                                dev, wdev) < 0) {
2258                 nlmsg_free(msg);
2259                 return -ENOBUFS;
2260         }
2261
2262         return genlmsg_reply(msg, info);
2263 }
2264
2265 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2266         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2267         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2268         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2269         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2270         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2271 };
2272
2273 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2274 {
2275         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2276         int flag;
2277
2278         *mntrflags = 0;
2279
2280         if (!nla)
2281                 return -EINVAL;
2282
2283         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2284                              nla, mntr_flags_policy))
2285                 return -EINVAL;
2286
2287         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2288                 if (flags[flag])
2289                         *mntrflags |= (1<<flag);
2290
2291         return 0;
2292 }
2293
2294 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2295                                struct net_device *netdev, u8 use_4addr,
2296                                enum nl80211_iftype iftype)
2297 {
2298         if (!use_4addr) {
2299                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2300                         return -EBUSY;
2301                 return 0;
2302         }
2303
2304         switch (iftype) {
2305         case NL80211_IFTYPE_AP_VLAN:
2306                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2307                         return 0;
2308                 break;
2309         case NL80211_IFTYPE_STATION:
2310                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2311                         return 0;
2312                 break;
2313         default:
2314                 break;
2315         }
2316
2317         return -EOPNOTSUPP;
2318 }
2319
2320 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2321 {
2322         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2323         struct vif_params params;
2324         int err;
2325         enum nl80211_iftype otype, ntype;
2326         struct net_device *dev = info->user_ptr[1];
2327         u32 _flags, *flags = NULL;
2328         bool change = false;
2329
2330         memset(&params, 0, sizeof(params));
2331
2332         otype = ntype = dev->ieee80211_ptr->iftype;
2333
2334         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2335                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2336                 if (otype != ntype)
2337                         change = true;
2338                 if (ntype > NL80211_IFTYPE_MAX)
2339                         return -EINVAL;
2340         }
2341
2342         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2343                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2344
2345                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2346                         return -EINVAL;
2347                 if (netif_running(dev))
2348                         return -EBUSY;
2349
2350                 wdev_lock(wdev);
2351                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2352                              IEEE80211_MAX_MESH_ID_LEN);
2353                 wdev->mesh_id_up_len =
2354                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2355                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2356                        wdev->mesh_id_up_len);
2357                 wdev_unlock(wdev);
2358         }
2359
2360         if (info->attrs[NL80211_ATTR_4ADDR]) {
2361                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2362                 change = true;
2363                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2364                 if (err)
2365                         return err;
2366         } else {
2367                 params.use_4addr = -1;
2368         }
2369
2370         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2371                 if (ntype != NL80211_IFTYPE_MONITOR)
2372                         return -EINVAL;
2373                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2374                                           &_flags);
2375                 if (err)
2376                         return err;
2377
2378                 flags = &_flags;
2379                 change = true;
2380         }
2381
2382         if (change)
2383                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2384         else
2385                 err = 0;
2386
2387         if (!err && params.use_4addr != -1)
2388                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2389
2390         return err;
2391 }
2392
2393 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2394 {
2395         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2396         struct vif_params params;
2397         struct wireless_dev *wdev;
2398         struct sk_buff *msg;
2399         int err;
2400         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2401         u32 flags;
2402
2403         memset(&params, 0, sizeof(params));
2404
2405         if (!info->attrs[NL80211_ATTR_IFNAME])
2406                 return -EINVAL;
2407
2408         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2409                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2410                 if (type > NL80211_IFTYPE_MAX)
2411                         return -EINVAL;
2412         }
2413
2414         if (!rdev->ops->add_virtual_intf ||
2415             !(rdev->wiphy.interface_modes & (1 << type)))
2416                 return -EOPNOTSUPP;
2417
2418         if (type == NL80211_IFTYPE_P2P_DEVICE && info->attrs[NL80211_ATTR_MAC]) {
2419                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2420                            ETH_ALEN);
2421                 if (!is_valid_ether_addr(params.macaddr))
2422                         return -EADDRNOTAVAIL;
2423         }
2424
2425         if (info->attrs[NL80211_ATTR_4ADDR]) {
2426                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2427                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2428                 if (err)
2429                         return err;
2430         }
2431
2432         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2433         if (!msg)
2434                 return -ENOMEM;
2435
2436         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2437                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2438                                   &flags);
2439         wdev = rdev_add_virtual_intf(rdev,
2440                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2441                                 type, err ? NULL : &flags, &params);
2442         if (IS_ERR(wdev)) {
2443                 nlmsg_free(msg);
2444                 return PTR_ERR(wdev);
2445         }
2446
2447         switch (type) {
2448         case NL80211_IFTYPE_MESH_POINT:
2449                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2450                         break;
2451                 wdev_lock(wdev);
2452                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2453                              IEEE80211_MAX_MESH_ID_LEN);
2454                 wdev->mesh_id_up_len =
2455                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2456                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2457                        wdev->mesh_id_up_len);
2458                 wdev_unlock(wdev);
2459                 break;
2460         case NL80211_IFTYPE_P2P_DEVICE:
2461                 /*
2462                  * P2P Device doesn't have a netdev, so doesn't go
2463                  * through the netdev notifier and must be added here
2464                  */
2465                 mutex_init(&wdev->mtx);
2466                 INIT_LIST_HEAD(&wdev->event_list);
2467                 spin_lock_init(&wdev->event_lock);
2468                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2469                 spin_lock_init(&wdev->mgmt_registrations_lock);
2470
2471                 mutex_lock(&rdev->devlist_mtx);
2472                 wdev->identifier = ++rdev->wdev_id;
2473                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2474                 rdev->devlist_generation++;
2475                 mutex_unlock(&rdev->devlist_mtx);
2476                 break;
2477         default:
2478                 break;
2479         }
2480
2481         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2482                                rdev, wdev) < 0) {
2483                 nlmsg_free(msg);
2484                 return -ENOBUFS;
2485         }
2486
2487         return genlmsg_reply(msg, info);
2488 }
2489
2490 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2491 {
2492         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2493         struct wireless_dev *wdev = info->user_ptr[1];
2494
2495         if (!rdev->ops->del_virtual_intf)
2496                 return -EOPNOTSUPP;
2497
2498         /*
2499          * If we remove a wireless device without a netdev then clear
2500          * user_ptr[1] so that nl80211_post_doit won't dereference it
2501          * to check if it needs to do dev_put(). Otherwise it crashes
2502          * since the wdev has been freed, unlike with a netdev where
2503          * we need the dev_put() for the netdev to really be freed.
2504          */
2505         if (!wdev->netdev)
2506                 info->user_ptr[1] = NULL;
2507
2508         return rdev_del_virtual_intf(rdev, wdev);
2509 }
2510
2511 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2512 {
2513         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2514         struct net_device *dev = info->user_ptr[1];
2515         u16 noack_map;
2516
2517         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2518                 return -EINVAL;
2519
2520         if (!rdev->ops->set_noack_map)
2521                 return -EOPNOTSUPP;
2522
2523         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2524
2525         return rdev_set_noack_map(rdev, dev, noack_map);
2526 }
2527
2528 struct get_key_cookie {
2529         struct sk_buff *msg;
2530         int error;
2531         int idx;
2532 };
2533
2534 static void get_key_callback(void *c, struct key_params *params)
2535 {
2536         struct nlattr *key;
2537         struct get_key_cookie *cookie = c;
2538
2539         if ((params->key &&
2540              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2541                      params->key_len, params->key)) ||
2542             (params->seq &&
2543              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2544                      params->seq_len, params->seq)) ||
2545             (params->cipher &&
2546              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2547                          params->cipher)))
2548                 goto nla_put_failure;
2549
2550         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2551         if (!key)
2552                 goto nla_put_failure;
2553
2554         if ((params->key &&
2555              nla_put(cookie->msg, NL80211_KEY_DATA,
2556                      params->key_len, params->key)) ||
2557             (params->seq &&
2558              nla_put(cookie->msg, NL80211_KEY_SEQ,
2559                      params->seq_len, params->seq)) ||
2560             (params->cipher &&
2561              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2562                          params->cipher)))
2563                 goto nla_put_failure;
2564
2565         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2566                 goto nla_put_failure;
2567
2568         nla_nest_end(cookie->msg, key);
2569
2570         return;
2571  nla_put_failure:
2572         cookie->error = 1;
2573 }
2574
2575 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2576 {
2577         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2578         int err;
2579         struct net_device *dev = info->user_ptr[1];
2580         u8 key_idx = 0;
2581         const u8 *mac_addr = NULL;
2582         bool pairwise;
2583         struct get_key_cookie cookie = {
2584                 .error = 0,
2585         };
2586         void *hdr;
2587         struct sk_buff *msg;
2588
2589         if (info->attrs[NL80211_ATTR_KEY_IDX])
2590                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2591
2592         if (key_idx > 5)
2593                 return -EINVAL;
2594
2595         if (info->attrs[NL80211_ATTR_MAC])
2596                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2597
2598         pairwise = !!mac_addr;
2599         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2600                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2601                 if (kt >= NUM_NL80211_KEYTYPES)
2602                         return -EINVAL;
2603                 if (kt != NL80211_KEYTYPE_GROUP &&
2604                     kt != NL80211_KEYTYPE_PAIRWISE)
2605                         return -EINVAL;
2606                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2607         }
2608
2609         if (!rdev->ops->get_key)
2610                 return -EOPNOTSUPP;
2611
2612         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2613         if (!msg)
2614                 return -ENOMEM;
2615
2616         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2617                              NL80211_CMD_NEW_KEY);
2618         if (IS_ERR(hdr))
2619                 return PTR_ERR(hdr);
2620
2621         cookie.msg = msg;
2622         cookie.idx = key_idx;
2623
2624         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2625             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2626                 goto nla_put_failure;
2627         if (mac_addr &&
2628             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2629                 goto nla_put_failure;
2630
2631         if (pairwise && mac_addr &&
2632             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2633                 return -ENOENT;
2634
2635         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2636                            get_key_callback);
2637
2638         if (err)
2639                 goto free_msg;
2640
2641         if (cookie.error)
2642                 goto nla_put_failure;
2643
2644         genlmsg_end(msg, hdr);
2645         return genlmsg_reply(msg, info);
2646
2647  nla_put_failure:
2648         err = -ENOBUFS;
2649  free_msg:
2650         nlmsg_free(msg);
2651         return err;
2652 }
2653
2654 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2655 {
2656         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2657         struct key_parse key;
2658         int err;
2659         struct net_device *dev = info->user_ptr[1];
2660
2661         err = nl80211_parse_key(info, &key);
2662         if (err)
2663                 return err;
2664
2665         if (key.idx < 0)
2666                 return -EINVAL;
2667
2668         /* only support setting default key */
2669         if (!key.def && !key.defmgmt)
2670                 return -EINVAL;
2671
2672         wdev_lock(dev->ieee80211_ptr);
2673
2674         if (key.def) {
2675                 if (!rdev->ops->set_default_key) {
2676                         err = -EOPNOTSUPP;
2677                         goto out;
2678                 }
2679
2680                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2681                 if (err)
2682                         goto out;
2683
2684                 err = rdev_set_default_key(rdev, dev, key.idx,
2685                                                  key.def_uni, key.def_multi);
2686
2687                 if (err)
2688                         goto out;
2689
2690 #ifdef CONFIG_CFG80211_WEXT
2691                 dev->ieee80211_ptr->wext.default_key = key.idx;
2692 #endif
2693         } else {
2694                 if (key.def_uni || !key.def_multi) {
2695                         err = -EINVAL;
2696                         goto out;
2697                 }
2698
2699                 if (!rdev->ops->set_default_mgmt_key) {
2700                         err = -EOPNOTSUPP;
2701                         goto out;
2702                 }
2703
2704                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2705                 if (err)
2706                         goto out;
2707
2708                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2709                 if (err)
2710                         goto out;
2711
2712 #ifdef CONFIG_CFG80211_WEXT
2713                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2714 #endif
2715         }
2716
2717  out:
2718         wdev_unlock(dev->ieee80211_ptr);
2719
2720         return err;
2721 }
2722
2723 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2724 {
2725         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2726         int err;
2727         struct net_device *dev = info->user_ptr[1];
2728         struct key_parse key;
2729         const u8 *mac_addr = NULL;
2730
2731         err = nl80211_parse_key(info, &key);
2732         if (err)
2733                 return err;
2734
2735         if (!key.p.key)
2736                 return -EINVAL;
2737
2738         if (info->attrs[NL80211_ATTR_MAC])
2739                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2740
2741         if (key.type == -1) {
2742                 if (mac_addr)
2743                         key.type = NL80211_KEYTYPE_PAIRWISE;
2744                 else
2745                         key.type = NL80211_KEYTYPE_GROUP;
2746         }
2747
2748         /* for now */
2749         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2750             key.type != NL80211_KEYTYPE_GROUP)
2751                 return -EINVAL;
2752
2753         if (!rdev->ops->add_key)
2754                 return -EOPNOTSUPP;
2755
2756         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2757                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2758                                            mac_addr))
2759                 return -EINVAL;
2760
2761         wdev_lock(dev->ieee80211_ptr);
2762         err = nl80211_key_allowed(dev->ieee80211_ptr);
2763         if (!err)
2764                 err = rdev_add_key(rdev, dev, key.idx,
2765                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2766                                     mac_addr, &key.p);
2767         wdev_unlock(dev->ieee80211_ptr);
2768
2769         return err;
2770 }
2771
2772 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2773 {
2774         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2775         int err;
2776         struct net_device *dev = info->user_ptr[1];
2777         u8 *mac_addr = NULL;
2778         struct key_parse key;
2779
2780         err = nl80211_parse_key(info, &key);
2781         if (err)
2782                 return err;
2783
2784         if (info->attrs[NL80211_ATTR_MAC])
2785                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2786
2787         if (key.type == -1) {
2788                 if (mac_addr)
2789                         key.type = NL80211_KEYTYPE_PAIRWISE;
2790                 else
2791                         key.type = NL80211_KEYTYPE_GROUP;
2792         }
2793
2794         /* for now */
2795         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2796             key.type != NL80211_KEYTYPE_GROUP)
2797                 return -EINVAL;
2798
2799         if (!rdev->ops->del_key)
2800                 return -EOPNOTSUPP;
2801
2802         wdev_lock(dev->ieee80211_ptr);
2803         err = nl80211_key_allowed(dev->ieee80211_ptr);
2804
2805         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2806             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2807                 err = -ENOENT;
2808
2809         if (!err)
2810                 err = rdev_del_key(rdev, dev, key.idx,
2811                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2812                                    mac_addr);
2813
2814 #ifdef CONFIG_CFG80211_WEXT
2815         if (!err) {
2816                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
2817                         dev->ieee80211_ptr->wext.default_key = -1;
2818                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2819                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2820         }
2821 #endif
2822         wdev_unlock(dev->ieee80211_ptr);
2823
2824         return err;
2825 }
2826
2827 /* This function returns an error or the number of nested attributes */
2828 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
2829 {
2830         struct nlattr *attr;
2831         int n_entries = 0, tmp;
2832
2833         nla_for_each_nested(attr, nl_attr, tmp) {
2834                 if (nla_len(attr) != ETH_ALEN)
2835                         return -EINVAL;
2836
2837                 n_entries++;
2838         }
2839
2840         return n_entries;
2841 }
2842
2843 /*
2844  * This function parses ACL information and allocates memory for ACL data.
2845  * On successful return, the calling function is responsible to free the
2846  * ACL buffer returned by this function.
2847  */
2848 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
2849                                                 struct genl_info *info)
2850 {
2851         enum nl80211_acl_policy acl_policy;
2852         struct nlattr *attr;
2853         struct cfg80211_acl_data *acl;
2854         int i = 0, n_entries, tmp;
2855
2856         if (!wiphy->max_acl_mac_addrs)
2857                 return ERR_PTR(-EOPNOTSUPP);
2858
2859         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
2860                 return ERR_PTR(-EINVAL);
2861
2862         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
2863         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
2864             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
2865                 return ERR_PTR(-EINVAL);
2866
2867         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
2868                 return ERR_PTR(-EINVAL);
2869
2870         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
2871         if (n_entries < 0)
2872                 return ERR_PTR(n_entries);
2873
2874         if (n_entries > wiphy->max_acl_mac_addrs)
2875                 return ERR_PTR(-ENOTSUPP);
2876
2877         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
2878                       GFP_KERNEL);
2879         if (!acl)
2880                 return ERR_PTR(-ENOMEM);
2881
2882         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
2883                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
2884                 i++;
2885         }
2886
2887         acl->n_acl_entries = n_entries;
2888         acl->acl_policy = acl_policy;
2889
2890         return acl;
2891 }
2892
2893 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
2894 {
2895         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2896         struct net_device *dev = info->user_ptr[1];
2897         struct cfg80211_acl_data *acl;
2898         int err;
2899
2900         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2901             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2902                 return -EOPNOTSUPP;
2903
2904         if (!dev->ieee80211_ptr->beacon_interval)
2905                 return -EINVAL;
2906
2907         acl = parse_acl_data(&rdev->wiphy, info);
2908         if (IS_ERR(acl))
2909                 return PTR_ERR(acl);
2910
2911         err = rdev_set_mac_acl(rdev, dev, acl);
2912
2913         kfree(acl);
2914
2915         return err;
2916 }
2917
2918 static int nl80211_parse_beacon(struct genl_info *info,
2919                                 struct cfg80211_beacon_data *bcn)
2920 {
2921         bool haveinfo = false;
2922
2923         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]) ||
2924             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]) ||
2925             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
2926             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2927                 return -EINVAL;
2928
2929         memset(bcn, 0, sizeof(*bcn));
2930
2931         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
2932                 bcn->head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2933                 bcn->head_len = nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2934                 if (!bcn->head_len)
2935                         return -EINVAL;
2936                 haveinfo = true;
2937         }
2938
2939         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
2940                 bcn->tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2941                 bcn->tail_len =
2942                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2943                 haveinfo = true;
2944         }
2945
2946         if (!haveinfo)
2947                 return -EINVAL;
2948
2949         if (info->attrs[NL80211_ATTR_IE]) {
2950                 bcn->beacon_ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2951                 bcn->beacon_ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2952         }
2953
2954         if (info->attrs[NL80211_ATTR_IE_PROBE_RESP]) {
2955                 bcn->proberesp_ies =
2956                         nla_data(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2957                 bcn->proberesp_ies_len =
2958                         nla_len(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2959         }
2960
2961         if (info->attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
2962                 bcn->assocresp_ies =
2963                         nla_data(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2964                 bcn->assocresp_ies_len =
2965                         nla_len(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2966         }
2967
2968         if (info->attrs[NL80211_ATTR_PROBE_RESP]) {
2969                 bcn->probe_resp =
2970                         nla_data(info->attrs[NL80211_ATTR_PROBE_RESP]);
2971                 bcn->probe_resp_len =
2972                         nla_len(info->attrs[NL80211_ATTR_PROBE_RESP]);
2973         }
2974
2975         return 0;
2976 }
2977
2978 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
2979                                    struct cfg80211_ap_settings *params)
2980 {
2981         struct wireless_dev *wdev;
2982         bool ret = false;
2983
2984         mutex_lock(&rdev->devlist_mtx);
2985
2986         list_for_each_entry(wdev, &rdev->wdev_list, list) {
2987                 if (wdev->iftype != NL80211_IFTYPE_AP &&
2988                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
2989                         continue;
2990
2991                 if (!wdev->preset_chandef.chan)
2992                         continue;
2993
2994                 params->chandef = wdev->preset_chandef;
2995                 ret = true;
2996                 break;
2997         }
2998
2999         mutex_unlock(&rdev->devlist_mtx);
3000
3001         return ret;
3002 }
3003
3004 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3005                                     enum nl80211_auth_type auth_type,
3006                                     enum nl80211_commands cmd)
3007 {
3008         if (auth_type > NL80211_AUTHTYPE_MAX)
3009                 return false;
3010
3011         switch (cmd) {
3012         case NL80211_CMD_AUTHENTICATE:
3013                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3014                     auth_type == NL80211_AUTHTYPE_SAE)
3015                         return false;
3016                 return true;
3017         case NL80211_CMD_CONNECT:
3018         case NL80211_CMD_START_AP:
3019                 /* SAE not supported yet */
3020                 if (auth_type == NL80211_AUTHTYPE_SAE)
3021                         return false;
3022                 return true;
3023         default:
3024                 return false;
3025         }
3026 }
3027
3028 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3029 {
3030         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3031         struct net_device *dev = info->user_ptr[1];
3032         struct wireless_dev *wdev = dev->ieee80211_ptr;
3033         struct cfg80211_ap_settings params;
3034         int err;
3035         u8 radar_detect_width = 0;
3036
3037         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3038             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3039                 return -EOPNOTSUPP;
3040
3041         if (!rdev->ops->start_ap)
3042                 return -EOPNOTSUPP;
3043
3044         if (wdev->beacon_interval)
3045                 return -EALREADY;
3046
3047         memset(&params, 0, sizeof(params));
3048
3049         /* these are required for START_AP */
3050         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3051             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3052             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3053                 return -EINVAL;
3054
3055         err = nl80211_parse_beacon(info, &params.beacon);
3056         if (err)
3057                 return err;
3058
3059         params.beacon_interval =
3060                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3061         params.dtim_period =
3062                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3063
3064         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
3065         if (err)
3066                 return err;
3067
3068         /*
3069          * In theory, some of these attributes should be required here
3070          * but since they were not used when the command was originally
3071          * added, keep them optional for old user space programs to let
3072          * them continue to work with drivers that do not need the
3073          * additional information -- drivers must check!
3074          */
3075         if (info->attrs[NL80211_ATTR_SSID]) {
3076                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3077                 params.ssid_len =
3078                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3079                 if (params.ssid_len == 0 ||
3080                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3081                         return -EINVAL;
3082         }
3083
3084         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3085                 params.hidden_ssid = nla_get_u32(
3086                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3087                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3088                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3089                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3090                         return -EINVAL;
3091         }
3092
3093         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3094
3095         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3096                 params.auth_type = nla_get_u32(
3097                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3098                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3099                                              NL80211_CMD_START_AP))
3100                         return -EINVAL;
3101         } else
3102                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3103
3104         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3105                                       NL80211_MAX_NR_CIPHER_SUITES);
3106         if (err)
3107                 return err;
3108
3109         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3110                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3111                         return -EOPNOTSUPP;
3112                 params.inactivity_timeout = nla_get_u16(
3113                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3114         }
3115
3116         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3117                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3118                         return -EINVAL;
3119                 params.p2p_ctwindow =
3120                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3121                 if (params.p2p_ctwindow > 127)
3122                         return -EINVAL;
3123                 if (params.p2p_ctwindow != 0 &&
3124                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3125                         return -EINVAL;
3126         }
3127
3128         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3129                 u8 tmp;
3130
3131                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3132                         return -EINVAL;
3133                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3134                 if (tmp > 1)
3135                         return -EINVAL;
3136                 params.p2p_opp_ps = tmp;
3137                 if (params.p2p_opp_ps != 0 &&
3138                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3139                         return -EINVAL;
3140         }
3141
3142         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3143                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
3144                 if (err)
3145                         return err;
3146         } else if (wdev->preset_chandef.chan) {
3147                 params.chandef = wdev->preset_chandef;
3148         } else if (!nl80211_get_ap_channel(rdev, &params))
3149                 return -EINVAL;
3150
3151         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
3152                 return -EINVAL;
3153
3154         err = cfg80211_chandef_dfs_required(wdev->wiphy, &params.chandef);
3155         if (err < 0)
3156                 return err;
3157         if (err) {
3158                 radar_detect_width = BIT(params.chandef.width);
3159                 params.radar_required = true;
3160         }
3161
3162         mutex_lock(&rdev->devlist_mtx);
3163         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
3164                                            params.chandef.chan,
3165                                            CHAN_MODE_SHARED,
3166                                            radar_detect_width);
3167         mutex_unlock(&rdev->devlist_mtx);
3168
3169         if (err)
3170                 return err;
3171
3172         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3173                 params.acl = parse_acl_data(&rdev->wiphy, info);
3174                 if (IS_ERR(params.acl))
3175                         return PTR_ERR(params.acl);
3176         }
3177
3178         err = rdev_start_ap(rdev, dev, &params);
3179         if (!err) {
3180                 wdev->preset_chandef = params.chandef;
3181                 wdev->beacon_interval = params.beacon_interval;
3182                 wdev->channel = params.chandef.chan;
3183                 wdev->ssid_len = params.ssid_len;
3184                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3185         }
3186
3187         kfree(params.acl);
3188
3189         return err;
3190 }
3191
3192 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3193 {
3194         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3195         struct net_device *dev = info->user_ptr[1];
3196         struct wireless_dev *wdev = dev->ieee80211_ptr;
3197         struct cfg80211_beacon_data params;
3198         int err;
3199
3200         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3201             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3202                 return -EOPNOTSUPP;
3203
3204         if (!rdev->ops->change_beacon)
3205                 return -EOPNOTSUPP;
3206
3207         if (!wdev->beacon_interval)
3208                 return -EINVAL;
3209
3210         err = nl80211_parse_beacon(info, &params);
3211         if (err)
3212                 return err;
3213
3214         return rdev_change_beacon(rdev, dev, &params);
3215 }
3216
3217 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3218 {
3219         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3220         struct net_device *dev = info->user_ptr[1];
3221
3222         return cfg80211_stop_ap(rdev, dev);
3223 }
3224
3225 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3226         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3227         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3228         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3229         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3230         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3231         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3232 };
3233
3234 static int parse_station_flags(struct genl_info *info,
3235                                enum nl80211_iftype iftype,
3236                                struct station_parameters *params)
3237 {
3238         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3239         struct nlattr *nla;
3240         int flag;
3241
3242         /*
3243          * Try parsing the new attribute first so userspace
3244          * can specify both for older kernels.
3245          */
3246         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3247         if (nla) {
3248                 struct nl80211_sta_flag_update *sta_flags;
3249
3250                 sta_flags = nla_data(nla);
3251                 params->sta_flags_mask = sta_flags->mask;
3252                 params->sta_flags_set = sta_flags->set;
3253                 params->sta_flags_set &= params->sta_flags_mask;
3254                 if ((params->sta_flags_mask |
3255                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3256                         return -EINVAL;
3257                 return 0;
3258         }
3259
3260         /* if present, parse the old attribute */
3261
3262         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3263         if (!nla)
3264                 return 0;
3265
3266         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3267                              nla, sta_flags_policy))
3268                 return -EINVAL;
3269
3270         /*
3271          * Only allow certain flags for interface types so that
3272          * other attributes are silently ignored. Remember that
3273          * this is backward compatibility code with old userspace
3274          * and shouldn't be hit in other cases anyway.
3275          */
3276         switch (iftype) {
3277         case NL80211_IFTYPE_AP:
3278         case NL80211_IFTYPE_AP_VLAN:
3279         case NL80211_IFTYPE_P2P_GO:
3280                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3281                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3282                                          BIT(NL80211_STA_FLAG_WME) |
3283                                          BIT(NL80211_STA_FLAG_MFP);
3284                 break;
3285         case NL80211_IFTYPE_P2P_CLIENT:
3286         case NL80211_IFTYPE_STATION:
3287                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3288                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3289                 break;
3290         case NL80211_IFTYPE_MESH_POINT:
3291                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3292                                          BIT(NL80211_STA_FLAG_MFP) |
3293                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3294         default:
3295                 return -EINVAL;
3296         }
3297
3298         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3299                 if (flags[flag]) {
3300                         params->sta_flags_set |= (1<<flag);
3301
3302                         /* no longer support new API additions in old API */
3303                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3304                                 return -EINVAL;
3305                 }
3306         }
3307
3308         return 0;
3309 }
3310
3311 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3312                                  int attr)
3313 {
3314         struct nlattr *rate;
3315         u32 bitrate;
3316         u16 bitrate_compat;
3317
3318         rate = nla_nest_start(msg, attr);
3319         if (!rate)
3320                 return false;
3321
3322         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3323         bitrate = cfg80211_calculate_bitrate(info);
3324         /* report 16-bit bitrate only if we can */
3325         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3326         if (bitrate > 0 &&
3327             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3328                 return false;
3329         if (bitrate_compat > 0 &&
3330             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3331                 return false;
3332
3333         if (info->flags & RATE_INFO_FLAGS_MCS) {
3334                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3335                         return false;
3336                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3337                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3338                         return false;
3339                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3340                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3341                         return false;
3342         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3343                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3344                         return false;
3345                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3346                         return false;
3347                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3348                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3349                         return false;
3350                 if (info->flags & RATE_INFO_FLAGS_80_MHZ_WIDTH &&
3351                     nla_put_flag(msg, NL80211_RATE_INFO_80_MHZ_WIDTH))
3352                         return false;
3353                 if (info->flags & RATE_INFO_FLAGS_80P80_MHZ_WIDTH &&
3354                     nla_put_flag(msg, NL80211_RATE_INFO_80P80_MHZ_WIDTH))
3355                         return false;
3356                 if (info->flags & RATE_INFO_FLAGS_160_MHZ_WIDTH &&
3357                     nla_put_flag(msg, NL80211_RATE_INFO_160_MHZ_WIDTH))
3358                         return false;
3359                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3360                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3361                         return false;
3362         }
3363
3364         nla_nest_end(msg, rate);
3365         return true;
3366 }
3367
3368 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
3369                                 int flags,
3370                                 struct cfg80211_registered_device *rdev,
3371                                 struct net_device *dev,
3372                                 const u8 *mac_addr, struct station_info *sinfo)
3373 {
3374         void *hdr;
3375         struct nlattr *sinfoattr, *bss_param;
3376
3377         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3378         if (!hdr)
3379                 return -1;
3380
3381         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3382             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3383             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3384                 goto nla_put_failure;
3385
3386         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3387         if (!sinfoattr)
3388                 goto nla_put_failure;
3389         if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
3390             nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
3391                         sinfo->connected_time))
3392                 goto nla_put_failure;
3393         if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
3394             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
3395                         sinfo->inactive_time))
3396                 goto nla_put_failure;
3397         if ((sinfo->filled & (STATION_INFO_RX_BYTES |
3398                               STATION_INFO_RX_BYTES64)) &&
3399             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3400                         (u32)sinfo->rx_bytes))
3401                 goto nla_put_failure;
3402         if ((sinfo->filled & (STATION_INFO_TX_BYTES |
3403                               NL80211_STA_INFO_TX_BYTES64)) &&
3404             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3405                         (u32)sinfo->tx_bytes))
3406                 goto nla_put_failure;
3407         if ((sinfo->filled & STATION_INFO_RX_BYTES64) &&
3408             nla_put_u64(msg, NL80211_STA_INFO_RX_BYTES64,
3409                         sinfo->rx_bytes))
3410                 goto nla_put_failure;
3411         if ((sinfo->filled & STATION_INFO_TX_BYTES64) &&
3412             nla_put_u64(msg, NL80211_STA_INFO_TX_BYTES64,
3413                         sinfo->tx_bytes))
3414                 goto nla_put_failure;
3415         if ((sinfo->filled & STATION_INFO_LLID) &&
3416             nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
3417                 goto nla_put_failure;
3418         if ((sinfo->filled & STATION_INFO_PLID) &&
3419             nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
3420                 goto nla_put_failure;
3421         if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
3422             nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
3423                        sinfo->plink_state))
3424                 goto nla_put_failure;
3425         switch (rdev->wiphy.signal_type) {
3426         case CFG80211_SIGNAL_TYPE_MBM:
3427                 if ((sinfo->filled & STATION_INFO_SIGNAL) &&
3428                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
3429                                sinfo->signal))
3430                         goto nla_put_failure;
3431                 if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
3432                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
3433                                sinfo->signal_avg))
3434                         goto nla_put_failure;
3435                 break;
3436         default:
3437                 break;
3438         }
3439         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
3440                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3441                                           NL80211_STA_INFO_TX_BITRATE))
3442                         goto nla_put_failure;
3443         }
3444         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
3445                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3446                                           NL80211_STA_INFO_RX_BITRATE))
3447                         goto nla_put_failure;
3448         }
3449         if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
3450             nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
3451                         sinfo->rx_packets))
3452                 goto nla_put_failure;
3453         if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
3454             nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
3455                         sinfo->tx_packets))
3456                 goto nla_put_failure;
3457         if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
3458             nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
3459                         sinfo->tx_retries))
3460                 goto nla_put_failure;
3461         if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
3462             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
3463                         sinfo->tx_failed))
3464                 goto nla_put_failure;
3465         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
3466             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
3467                         sinfo->beacon_loss_count))
3468                 goto nla_put_failure;
3469         if ((sinfo->filled & STATION_INFO_LOCAL_PM) &&
3470             nla_put_u32(msg, NL80211_STA_INFO_LOCAL_PM,
3471                         sinfo->local_pm))
3472                 goto nla_put_failure;
3473         if ((sinfo->filled & STATION_INFO_PEER_PM) &&
3474             nla_put_u32(msg, NL80211_STA_INFO_PEER_PM,
3475                         sinfo->peer_pm))
3476                 goto nla_put_failure;
3477         if ((sinfo->filled & STATION_INFO_NONPEER_PM) &&
3478             nla_put_u32(msg, NL80211_STA_INFO_NONPEER_PM,
3479                         sinfo->nonpeer_pm))
3480                 goto nla_put_failure;
3481         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
3482                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3483                 if (!bss_param)
3484                         goto nla_put_failure;
3485
3486                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3487                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3488                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3489                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3490                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3491                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3492                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3493                                sinfo->bss_param.dtim_period) ||
3494                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3495                                 sinfo->bss_param.beacon_interval))
3496                         goto nla_put_failure;
3497
3498                 nla_nest_end(msg, bss_param);
3499         }
3500         if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
3501             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3502                     sizeof(struct nl80211_sta_flag_update),
3503                     &sinfo->sta_flags))
3504                 goto nla_put_failure;
3505         if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
3506                 nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
3507                             sinfo->t_offset))
3508                 goto nla_put_failure;
3509         nla_nest_end(msg, sinfoattr);
3510
3511         if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
3512             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3513                     sinfo->assoc_req_ies))
3514                 goto nla_put_failure;
3515
3516         return genlmsg_end(msg, hdr);
3517
3518  nla_put_failure:
3519         genlmsg_cancel(msg, hdr);
3520         return -EMSGSIZE;
3521 }
3522
3523 static int nl80211_dump_station(struct sk_buff *skb,
3524                                 struct netlink_callback *cb)
3525 {
3526         struct station_info sinfo;
3527         struct cfg80211_registered_device *dev;
3528         struct net_device *netdev;
3529         u8 mac_addr[ETH_ALEN];
3530         int sta_idx = cb->args[1];
3531         int err;
3532
3533         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
3534         if (err)
3535                 return err;
3536
3537         if (!dev->ops->dump_station) {
3538                 err = -EOPNOTSUPP;
3539                 goto out_err;
3540         }
3541
3542         while (1) {
3543                 memset(&sinfo, 0, sizeof(sinfo));
3544                 err = rdev_dump_station(dev, netdev, sta_idx,
3545                                         mac_addr, &sinfo);
3546                 if (err == -ENOENT)
3547                         break;
3548                 if (err)
3549                         goto out_err;
3550
3551                 if (nl80211_send_station(skb,
3552                                 NETLINK_CB(cb->skb).portid,
3553                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3554                                 dev, netdev, mac_addr,
3555                                 &sinfo) < 0)
3556                         goto out;
3557
3558                 sta_idx++;
3559         }
3560
3561
3562  out:
3563         cb->args[1] = sta_idx;
3564         err = skb->len;
3565  out_err:
3566         nl80211_finish_netdev_dump(dev);
3567
3568         return err;
3569 }
3570
3571 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3572 {
3573         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3574         struct net_device *dev = info->user_ptr[1];
3575         struct station_info sinfo;
3576         struct sk_buff *msg;
3577         u8 *mac_addr = NULL;
3578         int err;
3579
3580         memset(&sinfo, 0, sizeof(sinfo));
3581
3582         if (!info->attrs[NL80211_ATTR_MAC])
3583                 return -EINVAL;
3584
3585         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3586
3587         if (!rdev->ops->get_station)
3588                 return -EOPNOTSUPP;
3589
3590         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3591         if (err)
3592                 return err;
3593
3594         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3595         if (!msg)
3596                 return -ENOMEM;
3597
3598         if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3599                                  rdev, dev, mac_addr, &sinfo) < 0) {
3600                 nlmsg_free(msg);
3601                 return -ENOBUFS;
3602         }
3603
3604         return genlmsg_reply(msg, info);
3605 }
3606
3607 int cfg80211_check_station_change(struct wiphy *wiphy,
3608                                   struct station_parameters *params,
3609                                   enum cfg80211_station_type statype)
3610 {
3611         if (params->listen_interval != -1)
3612                 return -EINVAL;
3613         if (params->aid)
3614                 return -EINVAL;
3615
3616         /* When you run into this, adjust the code below for the new flag */
3617         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
3618
3619         switch (statype) {
3620         case CFG80211_STA_MESH_PEER_NONSEC:
3621         case CFG80211_STA_MESH_PEER_SECURE:
3622                 /*
3623                  * No ignoring the TDLS flag here -- the userspace mesh
3624                  * code doesn't have the bug of including TDLS in the
3625                  * mask everywhere.
3626                  */
3627                 if (params->sta_flags_mask &
3628                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3629                                   BIT(NL80211_STA_FLAG_MFP) |
3630                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3631                         return -EINVAL;
3632                 break;
3633         case CFG80211_STA_TDLS_PEER_SETUP:
3634         case CFG80211_STA_TDLS_PEER_ACTIVE:
3635                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3636                         return -EINVAL;
3637                 /* ignore since it can't change */
3638                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3639                 break;
3640         default:
3641                 /* disallow mesh-specific things */
3642                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3643                         return -EINVAL;
3644                 if (params->local_pm)
3645                         return -EINVAL;
3646                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3647                         return -EINVAL;
3648         }
3649
3650         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
3651             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
3652                 /* TDLS can't be set, ... */
3653                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3654                         return -EINVAL;
3655                 /*
3656                  * ... but don't bother the driver with it. This works around
3657                  * a hostapd/wpa_supplicant issue -- it always includes the
3658                  * TLDS_PEER flag in the mask even for AP mode.
3659                  */
3660                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3661         }
3662
3663         if (statype != CFG80211_STA_TDLS_PEER_SETUP) {
3664                 /* reject other things that can't change */
3665                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
3666                         return -EINVAL;
3667                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
3668                         return -EINVAL;
3669                 if (params->supported_rates)
3670                         return -EINVAL;
3671                 if (params->ext_capab || params->ht_capa || params->vht_capa)
3672                         return -EINVAL;
3673         }
3674
3675         if (statype != CFG80211_STA_AP_CLIENT) {
3676                 if (params->vlan)
3677                         return -EINVAL;
3678         }
3679
3680         switch (statype) {
3681         case CFG80211_STA_AP_MLME_CLIENT:
3682                 /* Use this only for authorizing/unauthorizing a station */
3683                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
3684                         return -EOPNOTSUPP;
3685                 break;
3686         case CFG80211_STA_AP_CLIENT:
3687                 /* accept only the listed bits */
3688                 if (params->sta_flags_mask &
3689                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3690                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3691                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
3692                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3693                                   BIT(NL80211_STA_FLAG_WME) |
3694                                   BIT(NL80211_STA_FLAG_MFP)))
3695                         return -EINVAL;
3696
3697                 /* but authenticated/associated only if driver handles it */
3698                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
3699                     params->sta_flags_mask &
3700                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3701                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
3702                         return -EINVAL;
3703                 break;
3704         case CFG80211_STA_IBSS:
3705         case CFG80211_STA_AP_STA:
3706                 /* reject any changes other than AUTHORIZED */
3707                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
3708                         return -EINVAL;
3709                 break;
3710         case CFG80211_STA_TDLS_PEER_SETUP:
3711                 /* reject any changes other than AUTHORIZED or WME */
3712                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3713                                                BIT(NL80211_STA_FLAG_WME)))
3714                         return -EINVAL;
3715                 /* force (at least) rates when authorizing */
3716                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
3717                     !params->supported_rates)
3718                         return -EINVAL;
3719                 break;
3720         case CFG80211_STA_TDLS_PEER_ACTIVE:
3721                 /* reject any changes */
3722                 return -EINVAL;
3723         case CFG80211_STA_MESH_PEER_NONSEC:
3724                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3725                         return -EINVAL;
3726                 break;
3727         case CFG80211_STA_MESH_PEER_SECURE:
3728                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3729                         return -EINVAL;
3730                 break;
3731         }
3732
3733         return 0;
3734 }
3735 EXPORT_SYMBOL(cfg80211_check_station_change);
3736
3737 /*
3738  * Get vlan interface making sure it is running and on the right wiphy.
3739  */
3740 static struct net_device *get_vlan(struct genl_info *info,
3741                                    struct cfg80211_registered_device *rdev)
3742 {
3743         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
3744         struct net_device *v;
3745         int ret;
3746
3747         if (!vlanattr)
3748                 return NULL;
3749
3750         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
3751         if (!v)
3752                 return ERR_PTR(-ENODEV);
3753
3754         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
3755                 ret = -EINVAL;
3756                 goto error;
3757         }
3758
3759         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
3760             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3761             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
3762                 ret = -EINVAL;
3763                 goto error;
3764         }
3765
3766         if (!netif_running(v)) {
3767                 ret = -ENETDOWN;
3768                 goto error;
3769         }
3770
3771         return v;
3772  error:
3773         dev_put(v);
3774         return ERR_PTR(ret);
3775 }
3776
3777 static struct nla_policy
3778 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
3779         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
3780         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
3781 };
3782
3783 static int nl80211_parse_sta_wme(struct genl_info *info,
3784                                  struct station_parameters *params)
3785 {
3786         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
3787         struct nlattr *nla;
3788         int err;
3789
3790         /* parse WME attributes if present */
3791         if (!info->attrs[NL80211_ATTR_STA_WME])
3792                 return 0;
3793
3794         nla = info->attrs[NL80211_ATTR_STA_WME];
3795         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
3796                                nl80211_sta_wme_policy);
3797         if (err)
3798                 return err;
3799
3800         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
3801                 params->uapsd_queues = nla_get_u8(
3802                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
3803         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
3804                 return -EINVAL;
3805
3806         if (tb[NL80211_STA_WME_MAX_SP])
3807                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
3808
3809         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
3810                 return -EINVAL;
3811
3812         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
3813
3814         return 0;
3815 }
3816
3817 static int nl80211_set_station_tdls(struct genl_info *info,
3818                                     struct station_parameters *params)
3819 {
3820         /* Dummy STA entry gets updated once the peer capabilities are known */
3821         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3822                 params->ht_capa =
3823                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3824         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
3825                 params->vht_capa =
3826                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
3827
3828         return nl80211_parse_sta_wme(info, params);
3829 }
3830
3831 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
3832 {
3833         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3834         struct net_device *dev = info->user_ptr[1];
3835         struct station_parameters params;
3836         u8 *mac_addr;
3837         int err;
3838
3839         memset(&params, 0, sizeof(params));
3840
3841         params.listen_interval = -1;
3842
3843         if (!rdev->ops->change_station)
3844                 return -EOPNOTSUPP;
3845
3846         if (info->attrs[NL80211_ATTR_STA_AID])
3847                 return -EINVAL;
3848
3849         if (!info->attrs[NL80211_ATTR_MAC])
3850                 return -EINVAL;
3851
3852         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3853
3854         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
3855                 params.supported_rates =
3856                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3857                 params.supported_rates_len =
3858                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3859         }
3860
3861         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
3862                 params.capability =
3863                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
3864                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
3865         }
3866
3867         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
3868                 params.ext_capab =
3869                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3870                 params.ext_capab_len =
3871                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3872         }
3873
3874         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3875                 return -EINVAL;
3876
3877         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3878                 return -EINVAL;
3879
3880         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
3881                 params.plink_action =
3882                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3883                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
3884                         return -EINVAL;
3885         }
3886
3887         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
3888                 params.plink_state =
3889                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
3890                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
3891                         return -EINVAL;
3892                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
3893         }
3894
3895         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
3896                 enum nl80211_mesh_power_mode pm = nla_get_u32(
3897                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
3898
3899                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
3900                     pm > NL80211_MESH_POWER_MAX)
3901                         return -EINVAL;
3902
3903                 params.local_pm = pm;
3904         }
3905
3906         /* Include parameters for TDLS peer (will check later) */
3907         err = nl80211_set_station_tdls(info, &params);
3908         if (err)
3909                 return err;
3910
3911         params.vlan = get_vlan(info, rdev);
3912         if (IS_ERR(params.vlan))
3913                 return PTR_ERR(params.vlan);
3914
3915         switch (dev->ieee80211_ptr->iftype) {
3916         case NL80211_IFTYPE_AP:
3917         case NL80211_IFTYPE_AP_VLAN:
3918         case NL80211_IFTYPE_P2P_GO:
3919         case NL80211_IFTYPE_P2P_CLIENT:
3920         case NL80211_IFTYPE_STATION:
3921         case NL80211_IFTYPE_ADHOC:
3922         case NL80211_IFTYPE_MESH_POINT:
3923                 break;
3924         default:
3925                 err = -EOPNOTSUPP;
3926                 goto out_put_vlan;
3927         }
3928
3929         /* driver will call cfg80211_check_station_change() */
3930         err = rdev_change_station(rdev, dev, mac_addr, &params);
3931
3932  out_put_vlan:
3933         if (params.vlan)
3934                 dev_put(params.vlan);
3935
3936         return err;
3937 }
3938
3939 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
3940 {
3941         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3942         int err;
3943         struct net_device *dev = info->user_ptr[1];
3944         struct station_parameters params;
3945         u8 *mac_addr = NULL;
3946
3947         memset(&params, 0, sizeof(params));
3948
3949         if (!rdev->ops->add_station)
3950                 return -EOPNOTSUPP;
3951
3952         if (!info->attrs[NL80211_ATTR_MAC])
3953                 return -EINVAL;
3954
3955         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3956                 return -EINVAL;
3957
3958         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
3959                 return -EINVAL;
3960
3961         if (!info->attrs[NL80211_ATTR_STA_AID])
3962                 return -EINVAL;
3963
3964         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3965         params.supported_rates =
3966                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3967         params.supported_rates_len =
3968                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3969         params.listen_interval =
3970                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
3971
3972         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
3973         if (!params.aid || params.aid > IEEE80211_MAX_AID)
3974                 return -EINVAL;
3975
3976         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
3977                 params.capability =
3978                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
3979                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
3980         }
3981
3982         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
3983                 params.ext_capab =
3984                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3985                 params.ext_capab_len =
3986                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3987         }
3988
3989         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3990                 params.ht_capa =
3991                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3992
3993         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
3994                 params.vht_capa =
3995                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
3996
3997         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
3998                 params.plink_action =
3999                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4000                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4001                         return -EINVAL;
4002         }
4003
4004         err = nl80211_parse_sta_wme(info, &params);
4005         if (err)
4006                 return err;
4007
4008         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4009                 return -EINVAL;
4010
4011         /* When you run into this, adjust the code below for the new flag */
4012         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4013
4014         switch (dev->ieee80211_ptr->iftype) {
4015         case NL80211_IFTYPE_AP:
4016         case NL80211_IFTYPE_AP_VLAN:
4017         case NL80211_IFTYPE_P2P_GO:
4018                 /* ignore WME attributes if iface/sta is not capable */
4019                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
4020                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
4021                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4022
4023                 /* TDLS peers cannot be added */
4024                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4025                         return -EINVAL;
4026                 /* but don't bother the driver with it */
4027                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4028
4029                 /* allow authenticated/associated only if driver handles it */
4030                 if (!(rdev->wiphy.features &
4031                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4032                     params.sta_flags_mask &
4033                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4034                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4035                         return -EINVAL;
4036
4037                 /* must be last in here for error handling */
4038                 params.vlan = get_vlan(info, rdev);
4039                 if (IS_ERR(params.vlan))
4040                         return PTR_ERR(params.vlan);
4041                 break;
4042         case NL80211_IFTYPE_MESH_POINT:
4043                 /* ignore uAPSD data */
4044                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4045
4046                 /* associated is disallowed */
4047                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
4048                         return -EINVAL;
4049                 /* TDLS peers cannot be added */
4050                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4051                         return -EINVAL;
4052                 break;
4053         case NL80211_IFTYPE_STATION:
4054                 /* ignore uAPSD data */
4055                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4056
4057                 /* these are disallowed */
4058                 if (params.sta_flags_mask &
4059                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
4060                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4061                         return -EINVAL;
4062                 /* Only TDLS peers can be added */
4063                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4064                         return -EINVAL;
4065                 /* Can only add if TDLS ... */
4066                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
4067                         return -EOPNOTSUPP;
4068                 /* ... with external setup is supported */
4069                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
4070                         return -EOPNOTSUPP;
4071                 /*
4072                  * Older wpa_supplicant versions always mark the TDLS peer
4073                  * as authorized, but it shouldn't yet be.
4074                  */
4075                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4076                 break;
4077         default:
4078                 return -EOPNOTSUPP;
4079         }
4080
4081         /* be aware of params.vlan when changing code here */
4082
4083         err = rdev_add_station(rdev, dev, mac_addr, &params);
4084
4085         if (params.vlan)
4086                 dev_put(params.vlan);
4087         return err;
4088 }
4089
4090 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
4091 {
4092         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4093         struct net_device *dev = info->user_ptr[1];
4094         u8 *mac_addr = NULL;
4095
4096         if (info->attrs[NL80211_ATTR_MAC])
4097                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4098
4099         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4100             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4101             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4102             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4103                 return -EINVAL;
4104
4105         if (!rdev->ops->del_station)
4106                 return -EOPNOTSUPP;
4107
4108         return rdev_del_station(rdev, dev, mac_addr);
4109 }
4110
4111 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4112                                 int flags, struct net_device *dev,
4113                                 u8 *dst, u8 *next_hop,
4114                                 struct mpath_info *pinfo)
4115 {
4116         void *hdr;
4117         struct nlattr *pinfoattr;
4118
4119         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
4120         if (!hdr)
4121                 return -1;
4122
4123         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4124             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
4125             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
4126             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
4127                 goto nla_put_failure;
4128
4129         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
4130         if (!pinfoattr)
4131                 goto nla_put_failure;
4132         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
4133             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
4134                         pinfo->frame_qlen))
4135                 goto nla_put_failure;
4136         if (((pinfo->filled & MPATH_INFO_SN) &&
4137              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
4138             ((pinfo->filled & MPATH_INFO_METRIC) &&
4139              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
4140                          pinfo->metric)) ||
4141             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
4142              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
4143                          pinfo->exptime)) ||
4144             ((pinfo->filled & MPATH_INFO_FLAGS) &&
4145              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
4146                         pinfo->flags)) ||
4147             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
4148              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
4149                          pinfo->discovery_timeout)) ||
4150             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
4151              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
4152                         pinfo->discovery_retries)))
4153                 goto nla_put_failure;
4154
4155         nla_nest_end(msg, pinfoattr);
4156
4157         return genlmsg_end(msg, hdr);
4158
4159  nla_put_failure:
4160         genlmsg_cancel(msg, hdr);
4161         return -EMSGSIZE;
4162 }
4163
4164 static int nl80211_dump_mpath(struct sk_buff *skb,
4165                               struct netlink_callback *cb)
4166 {
4167         struct mpath_info pinfo;
4168         struct cfg80211_registered_device *dev;
4169         struct net_device *netdev;
4170         u8 dst[ETH_ALEN];
4171         u8 next_hop[ETH_ALEN];
4172         int path_idx = cb->args[1];
4173         int err;
4174
4175         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
4176         if (err)
4177                 return err;
4178
4179         if (!dev->ops->dump_mpath) {
4180                 err = -EOPNOTSUPP;
4181                 goto out_err;
4182         }
4183
4184         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
4185                 err = -EOPNOTSUPP;
4186                 goto out_err;
4187         }
4188
4189         while (1) {
4190                 err = rdev_dump_mpath(dev, netdev, path_idx, dst, next_hop,
4191                                       &pinfo);
4192                 if (err == -ENOENT)
4193                         break;
4194                 if (err)
4195                         goto out_err;
4196
4197                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4198                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4199                                        netdev, dst, next_hop,
4200                                        &pinfo) < 0)
4201                         goto out;
4202
4203                 path_idx++;
4204         }
4205
4206
4207  out:
4208         cb->args[1] = path_idx;
4209         err = skb->len;
4210  out_err:
4211         nl80211_finish_netdev_dump(dev);
4212         return err;
4213 }
4214
4215 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
4216 {
4217         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4218         int err;
4219         struct net_device *dev = info->user_ptr[1];
4220         struct mpath_info pinfo;
4221         struct sk_buff *msg;
4222         u8 *dst = NULL;
4223         u8 next_hop[ETH_ALEN];
4224
4225         memset(&pinfo, 0, sizeof(pinfo));
4226
4227         if (!info->attrs[NL80211_ATTR_MAC])
4228                 return -EINVAL;
4229
4230         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4231
4232         if (!rdev->ops->get_mpath)
4233                 return -EOPNOTSUPP;
4234
4235         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4236                 return -EOPNOTSUPP;
4237
4238         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4239         if (err)
4240                 return err;
4241
4242         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4243         if (!msg)
4244                 return -ENOMEM;
4245
4246         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4247                                  dev, dst, next_hop, &pinfo) < 0) {
4248                 nlmsg_free(msg);
4249                 return -ENOBUFS;
4250         }
4251
4252         return genlmsg_reply(msg, info);
4253 }
4254
4255 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
4256 {
4257         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4258         struct net_device *dev = info->user_ptr[1];
4259         u8 *dst = NULL;
4260         u8 *next_hop = NULL;
4261
4262         if (!info->attrs[NL80211_ATTR_MAC])
4263                 return -EINVAL;
4264
4265         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4266                 return -EINVAL;
4267
4268         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4269         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4270
4271         if (!rdev->ops->change_mpath)
4272                 return -EOPNOTSUPP;
4273
4274         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4275                 return -EOPNOTSUPP;
4276
4277         return rdev_change_mpath(rdev, dev, dst, next_hop);
4278 }
4279
4280 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
4281 {
4282         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4283         struct net_device *dev = info->user_ptr[1];
4284         u8 *dst = NULL;
4285         u8 *next_hop = NULL;
4286
4287         if (!info->attrs[NL80211_ATTR_MAC])
4288                 return -EINVAL;
4289
4290         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4291                 return -EINVAL;
4292
4293         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4294         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4295
4296         if (!rdev->ops->add_mpath)
4297                 return -EOPNOTSUPP;
4298
4299         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4300                 return -EOPNOTSUPP;
4301
4302         return rdev_add_mpath(rdev, dev, dst, next_hop);
4303 }
4304
4305 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
4306 {
4307         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4308         struct net_device *dev = info->user_ptr[1];
4309         u8 *dst = NULL;
4310
4311         if (info->attrs[NL80211_ATTR_MAC])
4312                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4313
4314         if (!rdev->ops->del_mpath)
4315                 return -EOPNOTSUPP;
4316
4317         return rdev_del_mpath(rdev, dev, dst);
4318 }
4319
4320 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
4321 {
4322         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4323         struct net_device *dev = info->user_ptr[1];
4324         struct bss_parameters params;
4325
4326         memset(&params, 0, sizeof(params));
4327         /* default to not changing parameters */
4328         params.use_cts_prot = -1;
4329         params.use_short_preamble = -1;
4330         params.use_short_slot_time = -1;
4331         params.ap_isolate = -1;
4332         params.ht_opmode = -1;
4333         params.p2p_ctwindow = -1;
4334         params.p2p_opp_ps = -1;
4335
4336         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
4337                 params.use_cts_prot =
4338                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
4339         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
4340                 params.use_short_preamble =
4341                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
4342         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
4343                 params.use_short_slot_time =
4344                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4345         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4346                 params.basic_rates =
4347                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4348                 params.basic_rates_len =
4349                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4350         }
4351         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
4352                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4353         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
4354                 params.ht_opmode =
4355                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4356
4357         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4358                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4359                         return -EINVAL;
4360                 params.p2p_ctwindow =
4361                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4362                 if (params.p2p_ctwindow < 0)
4363                         return -EINVAL;
4364                 if (params.p2p_ctwindow != 0 &&
4365                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4366                         return -EINVAL;
4367         }
4368
4369         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4370                 u8 tmp;
4371
4372                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4373                         return -EINVAL;
4374                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4375                 if (tmp > 1)
4376                         return -EINVAL;
4377                 params.p2p_opp_ps = tmp;
4378                 if (params.p2p_opp_ps &&
4379                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4380                         return -EINVAL;
4381         }
4382
4383         if (!rdev->ops->change_bss)
4384                 return -EOPNOTSUPP;
4385
4386         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4387             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4388                 return -EOPNOTSUPP;
4389
4390         return rdev_change_bss(rdev, dev, &params);
4391 }
4392
4393 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
4394         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
4395         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
4396         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
4397         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
4398         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
4399         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
4400 };
4401
4402 static int parse_reg_rule(struct nlattr *tb[],
4403         struct ieee80211_reg_rule *reg_rule)
4404 {
4405         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
4406         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
4407
4408         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
4409                 return -EINVAL;
4410         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
4411                 return -EINVAL;
4412         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
4413                 return -EINVAL;
4414         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
4415                 return -EINVAL;
4416         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
4417                 return -EINVAL;
4418
4419         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
4420
4421         freq_range->start_freq_khz =
4422                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
4423         freq_range->end_freq_khz =
4424                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
4425         freq_range->max_bandwidth_khz =
4426                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
4427
4428         power_rule->max_eirp =
4429                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
4430
4431         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
4432                 power_rule->max_antenna_gain =
4433                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
4434
4435         return 0;
4436 }
4437
4438 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
4439 {
4440         int r;
4441         char *data = NULL;
4442         enum nl80211_user_reg_hint_type user_reg_hint_type;
4443
4444         /*
4445          * You should only get this when cfg80211 hasn't yet initialized
4446          * completely when built-in to the kernel right between the time
4447          * window between nl80211_init() and regulatory_init(), if that is
4448          * even possible.
4449          */
4450         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4451                 return -EINPROGRESS;
4452
4453         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4454                 return -EINVAL;
4455
4456         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4457
4458         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
4459                 user_reg_hint_type =
4460                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
4461         else
4462                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
4463
4464         switch (user_reg_hint_type) {
4465         case NL80211_USER_REG_HINT_USER:
4466         case NL80211_USER_REG_HINT_CELL_BASE:
4467                 break;
4468         default:
4469                 return -EINVAL;
4470         }
4471
4472         r = regulatory_hint_user(data, user_reg_hint_type);
4473
4474         return r;
4475 }
4476
4477 static int nl80211_get_mesh_config(struct sk_buff *skb,
4478                                    struct genl_info *info)
4479 {
4480         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4481         struct net_device *dev = info->user_ptr[1];
4482         struct wireless_dev *wdev = dev->ieee80211_ptr;
4483         struct mesh_config cur_params;
4484         int err = 0;
4485         void *hdr;
4486         struct nlattr *pinfoattr;
4487         struct sk_buff *msg;
4488
4489         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4490                 return -EOPNOTSUPP;
4491
4492         if (!rdev->ops->get_mesh_config)
4493                 return -EOPNOTSUPP;
4494
4495         wdev_lock(wdev);
4496         /* If not connected, get default parameters */
4497         if (!wdev->mesh_id_len)
4498                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
4499         else
4500                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
4501         wdev_unlock(wdev);
4502
4503         if (err)
4504                 return err;
4505
4506         /* Draw up a netlink message to send back */
4507         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4508         if (!msg)
4509                 return -ENOMEM;
4510         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4511                              NL80211_CMD_GET_MESH_CONFIG);
4512         if (!hdr)
4513                 goto out;
4514         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
4515         if (!pinfoattr)
4516                 goto nla_put_failure;
4517         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4518             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
4519                         cur_params.dot11MeshRetryTimeout) ||
4520             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4521                         cur_params.dot11MeshConfirmTimeout) ||
4522             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
4523                         cur_params.dot11MeshHoldingTimeout) ||
4524             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
4525                         cur_params.dot11MeshMaxPeerLinks) ||
4526             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
4527                        cur_params.dot11MeshMaxRetries) ||
4528             nla_put_u8(msg, NL80211_MESHCONF_TTL,
4529                        cur_params.dot11MeshTTL) ||
4530             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
4531                        cur_params.element_ttl) ||
4532             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4533                        cur_params.auto_open_plinks) ||
4534             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4535                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
4536             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4537                        cur_params.dot11MeshHWMPmaxPREQretries) ||
4538             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
4539                         cur_params.path_refresh_time) ||
4540             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4541                         cur_params.min_discovery_timeout) ||
4542             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4543                         cur_params.dot11MeshHWMPactivePathTimeout) ||
4544             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4545                         cur_params.dot11MeshHWMPpreqMinInterval) ||
4546             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4547                         cur_params.dot11MeshHWMPperrMinInterval) ||
4548             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4549                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
4550             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
4551                        cur_params.dot11MeshHWMPRootMode) ||
4552             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4553                         cur_params.dot11MeshHWMPRannInterval) ||
4554             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4555                        cur_params.dot11MeshGateAnnouncementProtocol) ||
4556             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
4557                        cur_params.dot11MeshForwarding) ||
4558             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
4559                         cur_params.rssi_threshold) ||
4560             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
4561                         cur_params.ht_opmode) ||
4562             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4563                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
4564             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4565                         cur_params.dot11MeshHWMProotInterval) ||
4566             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4567                         cur_params.dot11MeshHWMPconfirmationInterval) ||
4568             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
4569                         cur_params.power_mode) ||
4570             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
4571                         cur_params.dot11MeshAwakeWindowDuration))
4572                 goto nla_put_failure;
4573         nla_nest_end(msg, pinfoattr);
4574         genlmsg_end(msg, hdr);
4575         return genlmsg_reply(msg, info);
4576
4577  nla_put_failure:
4578         genlmsg_cancel(msg, hdr);
4579  out:
4580         nlmsg_free(msg);
4581         return -ENOBUFS;
4582 }
4583
4584 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
4585         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
4586         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
4587         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
4588         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
4589         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
4590         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
4591         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
4592         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
4593         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
4594         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
4595         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
4596         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
4597         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
4598         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
4599         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
4600         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
4601         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
4602         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
4603         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
4604         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
4605         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
4606         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
4607         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
4608         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
4609         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
4610         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
4611         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
4612 };
4613
4614 static const struct nla_policy
4615         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
4616         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
4617         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
4618         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
4619         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
4620         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
4621                                     .len = IEEE80211_MAX_DATA_LEN },
4622         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
4623 };
4624
4625 static int nl80211_parse_mesh_config(struct genl_info *info,
4626                                      struct mesh_config *cfg,
4627                                      u32 *mask_out)
4628 {
4629         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
4630         u32 mask = 0;
4631
4632 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
4633 do {                                                                        \
4634         if (tb[attr]) {                                                     \
4635                 if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
4636                         return -EINVAL;                                     \
4637                 cfg->param = fn(tb[attr]);                                  \
4638                 mask |= (1 << (attr - 1));                                  \
4639         }                                                                   \
4640 } while (0)
4641
4642
4643         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
4644                 return -EINVAL;
4645         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
4646                              info->attrs[NL80211_ATTR_MESH_CONFIG],
4647                              nl80211_meshconf_params_policy))
4648                 return -EINVAL;
4649
4650         /* This makes sure that there aren't more than 32 mesh config
4651          * parameters (otherwise our bitfield scheme would not work.) */
4652         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
4653
4654         /* Fill in the params struct */
4655         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
4656                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
4657                                   nla_get_u16);
4658         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
4659                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4660                                   nla_get_u16);
4661         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
4662                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
4663                                   nla_get_u16);
4664         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
4665                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
4666                                   nla_get_u16);
4667         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
4668                                   mask, NL80211_MESHCONF_MAX_RETRIES,
4669                                   nla_get_u8);
4670         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
4671                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
4672         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
4673                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
4674                                   nla_get_u8);
4675         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
4676                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4677                                   nla_get_u8);
4678         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
4679                                   1, 255, mask,
4680                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4681                                   nla_get_u32);
4682         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
4683                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4684                                   nla_get_u8);
4685         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
4686                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
4687                                   nla_get_u32);
4688         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
4689                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4690                                   nla_get_u16);
4691         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
4692                                   1, 65535, mask,
4693                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4694                                   nla_get_u32);
4695         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
4696                                   1, 65535, mask,
4697                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4698                                   nla_get_u16);
4699         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
4700                                   1, 65535, mask,
4701                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4702                                   nla_get_u16);
4703         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4704                                   dot11MeshHWMPnetDiameterTraversalTime,
4705                                   1, 65535, mask,
4706                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4707                                   nla_get_u16);
4708         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
4709                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
4710                                   nla_get_u8);
4711         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
4712                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4713                                   nla_get_u16);
4714         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4715                                   dot11MeshGateAnnouncementProtocol, 0, 1,
4716                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4717                                   nla_get_u8);
4718         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
4719                                   mask, NL80211_MESHCONF_FORWARDING,
4720                                   nla_get_u8);
4721         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, 1, 255,
4722                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
4723                                   nla_get_u32);
4724         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
4725                                   mask, NL80211_MESHCONF_HT_OPMODE,
4726                                   nla_get_u16);
4727         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
4728                                   1, 65535, mask,
4729                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4730                                   nla_get_u32);
4731         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
4732                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4733                                   nla_get_u16);
4734         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4735                                   dot11MeshHWMPconfirmationInterval,
4736                                   1, 65535, mask,
4737                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4738                                   nla_get_u16);
4739         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
4740                                   NL80211_MESH_POWER_ACTIVE,
4741                                   NL80211_MESH_POWER_MAX,
4742                                   mask, NL80211_MESHCONF_POWER_MODE,
4743                                   nla_get_u32);
4744         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
4745                                   0, 65535, mask,
4746                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
4747         if (mask_out)
4748                 *mask_out = mask;
4749
4750         return 0;
4751
4752 #undef FILL_IN_MESH_PARAM_IF_SET
4753 }
4754
4755 static int nl80211_parse_mesh_setup(struct genl_info *info,
4756                                      struct mesh_setup *setup)
4757 {
4758         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
4759
4760         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
4761                 return -EINVAL;
4762         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
4763                              info->attrs[NL80211_ATTR_MESH_SETUP],
4764                              nl80211_mesh_setup_params_policy))
4765                 return -EINVAL;
4766
4767         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
4768                 setup->sync_method =
4769                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
4770                  IEEE80211_SYNC_METHOD_VENDOR :
4771                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
4772
4773         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
4774                 setup->path_sel_proto =
4775                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
4776                  IEEE80211_PATH_PROTOCOL_VENDOR :
4777                  IEEE80211_PATH_PROTOCOL_HWMP;
4778
4779         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
4780                 setup->path_metric =
4781                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
4782                  IEEE80211_PATH_METRIC_VENDOR :
4783                  IEEE80211_PATH_METRIC_AIRTIME;
4784
4785
4786         if (tb[NL80211_MESH_SETUP_IE]) {
4787                 struct nlattr *ieattr =
4788                         tb[NL80211_MESH_SETUP_IE];
4789                 if (!is_valid_ie_attr(ieattr))
4790                         return -EINVAL;
4791                 setup->ie = nla_data(ieattr);
4792                 setup->ie_len = nla_len(ieattr);
4793         }
4794         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
4795         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
4796
4797         return 0;
4798 }
4799
4800 static int nl80211_update_mesh_config(struct sk_buff *skb,
4801                                       struct genl_info *info)
4802 {
4803         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4804         struct net_device *dev = info->user_ptr[1];
4805         struct wireless_dev *wdev = dev->ieee80211_ptr;
4806         struct mesh_config cfg;
4807         u32 mask;
4808         int err;
4809
4810         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4811                 return -EOPNOTSUPP;
4812
4813         if (!rdev->ops->update_mesh_config)
4814                 return -EOPNOTSUPP;
4815
4816         err = nl80211_parse_mesh_config(info, &cfg, &mask);
4817         if (err)
4818                 return err;
4819
4820         wdev_lock(wdev);
4821         if (!wdev->mesh_id_len)
4822                 err = -ENOLINK;
4823
4824         if (!err)
4825                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
4826
4827         wdev_unlock(wdev);
4828
4829         return err;
4830 }
4831
4832 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
4833 {
4834         const struct ieee80211_regdomain *regdom;
4835         struct sk_buff *msg;
4836         void *hdr = NULL;
4837         struct nlattr *nl_reg_rules;
4838         unsigned int i;
4839         int err = -EINVAL;
4840
4841         mutex_lock(&cfg80211_mutex);
4842
4843         if (!cfg80211_regdomain)
4844                 goto out;
4845
4846         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4847         if (!msg) {
4848                 err = -ENOBUFS;
4849                 goto out;
4850         }
4851
4852         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4853                              NL80211_CMD_GET_REG);
4854         if (!hdr)
4855                 goto put_failure;
4856
4857         if (reg_last_request_cell_base() &&
4858             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
4859                         NL80211_USER_REG_HINT_CELL_BASE))
4860                 goto nla_put_failure;
4861
4862         rcu_read_lock();
4863         regdom = rcu_dereference(cfg80211_regdomain);
4864
4865         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
4866             (regdom->dfs_region &&
4867              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
4868                 goto nla_put_failure_rcu;
4869
4870         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
4871         if (!nl_reg_rules)
4872                 goto nla_put_failure_rcu;
4873
4874         for (i = 0; i < regdom->n_reg_rules; i++) {
4875                 struct nlattr *nl_reg_rule;
4876                 const struct ieee80211_reg_rule *reg_rule;
4877                 const struct ieee80211_freq_range *freq_range;
4878                 const struct ieee80211_power_rule *power_rule;
4879
4880                 reg_rule = &regdom->reg_rules[i];
4881                 freq_range = &reg_rule->freq_range;
4882                 power_rule = &reg_rule->power_rule;
4883
4884                 nl_reg_rule = nla_nest_start(msg, i);
4885                 if (!nl_reg_rule)
4886                         goto nla_put_failure_rcu;
4887
4888                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
4889                                 reg_rule->flags) ||
4890                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
4891                                 freq_range->start_freq_khz) ||
4892                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
4893                                 freq_range->end_freq_khz) ||
4894                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
4895                                 freq_range->max_bandwidth_khz) ||
4896                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
4897                                 power_rule->max_antenna_gain) ||
4898                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
4899                                 power_rule->max_eirp))
4900                         goto nla_put_failure_rcu;
4901
4902                 nla_nest_end(msg, nl_reg_rule);
4903         }
4904         rcu_read_unlock();
4905
4906         nla_nest_end(msg, nl_reg_rules);
4907
4908         genlmsg_end(msg, hdr);
4909         err = genlmsg_reply(msg, info);
4910         goto out;
4911
4912 nla_put_failure_rcu:
4913         rcu_read_unlock();
4914 nla_put_failure:
4915         genlmsg_cancel(msg, hdr);
4916 put_failure:
4917         nlmsg_free(msg);
4918         err = -EMSGSIZE;
4919 out:
4920         mutex_unlock(&cfg80211_mutex);
4921         return err;
4922 }
4923
4924 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
4925 {
4926         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
4927         struct nlattr *nl_reg_rule;
4928         char *alpha2 = NULL;
4929         int rem_reg_rules = 0, r = 0;
4930         u32 num_rules = 0, rule_idx = 0, size_of_regd;
4931         u8 dfs_region = 0;
4932         struct ieee80211_regdomain *rd = NULL;
4933
4934         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4935                 return -EINVAL;
4936
4937         if (!info->attrs[NL80211_ATTR_REG_RULES])
4938                 return -EINVAL;
4939
4940         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4941
4942         if (info->attrs[NL80211_ATTR_DFS_REGION])
4943                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
4944
4945         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
4946                             rem_reg_rules) {
4947                 num_rules++;
4948                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
4949                         return -EINVAL;
4950         }
4951
4952         size_of_regd = sizeof(struct ieee80211_regdomain) +
4953                        num_rules * sizeof(struct ieee80211_reg_rule);
4954
4955         rd = kzalloc(size_of_regd, GFP_KERNEL);
4956         if (!rd)
4957                 return -ENOMEM;
4958
4959         rd->n_reg_rules = num_rules;
4960         rd->alpha2[0] = alpha2[0];
4961         rd->alpha2[1] = alpha2[1];
4962
4963         /*
4964          * Disable DFS master mode if the DFS region was
4965          * not supported or known on this kernel.
4966          */
4967         if (reg_supported_dfs_region(dfs_region))
4968                 rd->dfs_region = dfs_region;
4969
4970         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
4971                             rem_reg_rules) {
4972                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
4973                           nla_data(nl_reg_rule), nla_len(nl_reg_rule),
4974                           reg_rule_policy);
4975                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
4976                 if (r)
4977                         goto bad_reg;
4978
4979                 rule_idx++;
4980
4981                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
4982                         r = -EINVAL;
4983                         goto bad_reg;
4984                 }
4985         }
4986
4987         mutex_lock(&cfg80211_mutex);
4988
4989         r = set_regdom(rd);
4990         /* set_regdom took ownership */
4991         rd = NULL;
4992         mutex_unlock(&cfg80211_mutex);
4993
4994  bad_reg:
4995         kfree(rd);
4996         return r;
4997 }
4998
4999 static int validate_scan_freqs(struct nlattr *freqs)
5000 {
5001         struct nlattr *attr1, *attr2;
5002         int n_channels = 0, tmp1, tmp2;
5003
5004         nla_for_each_nested(attr1, freqs, tmp1) {
5005                 n_channels++;
5006                 /*
5007                  * Some hardware has a limited channel list for
5008                  * scanning, and it is pretty much nonsensical
5009                  * to scan for a channel twice, so disallow that
5010                  * and don't require drivers to check that the
5011                  * channel list they get isn't longer than what
5012                  * they can scan, as long as they can scan all
5013                  * the channels they registered at once.
5014                  */
5015                 nla_for_each_nested(attr2, freqs, tmp2)
5016                         if (attr1 != attr2 &&
5017                             nla_get_u32(attr1) == nla_get_u32(attr2))
5018                                 return 0;
5019         }
5020
5021         return n_channels;
5022 }
5023
5024 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
5025 {
5026         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5027         struct wireless_dev *wdev = info->user_ptr[1];
5028         struct cfg80211_scan_request *request;
5029         struct nlattr *attr;
5030         struct wiphy *wiphy;
5031         int err, tmp, n_ssids = 0, n_channels, i;
5032         size_t ie_len;
5033
5034         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5035                 return -EINVAL;
5036
5037         wiphy = &rdev->wiphy;
5038
5039         if (!rdev->ops->scan)
5040                 return -EOPNOTSUPP;
5041
5042         if (rdev->scan_req)
5043                 return -EBUSY;
5044
5045         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5046                 n_channels = validate_scan_freqs(
5047                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5048                 if (!n_channels)
5049                         return -EINVAL;
5050         } else {
5051                 enum ieee80211_band band;
5052                 n_channels = 0;
5053
5054                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
5055                         if (wiphy->bands[band])
5056                                 n_channels += wiphy->bands[band]->n_channels;
5057         }
5058
5059         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5060                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
5061                         n_ssids++;
5062
5063         if (n_ssids > wiphy->max_scan_ssids)
5064                 return -EINVAL;
5065
5066         if (info->attrs[NL80211_ATTR_IE])
5067                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5068         else
5069                 ie_len = 0;
5070
5071         if (ie_len > wiphy->max_scan_ie_len)
5072                 return -EINVAL;
5073
5074         request = kzalloc(sizeof(*request)
5075                         + sizeof(*request->ssids) * n_ssids
5076                         + sizeof(*request->channels) * n_channels
5077                         + ie_len, GFP_KERNEL);
5078         if (!request)
5079                 return -ENOMEM;
5080
5081         if (n_ssids)
5082                 request->ssids = (void *)&request->channels[n_channels];
5083         request->n_ssids = n_ssids;
5084         if (ie_len) {
5085                 if (request->ssids)
5086                         request->ie = (void *)(request->ssids + n_ssids);
5087                 else
5088                         request->ie = (void *)(request->channels + n_channels);
5089         }
5090
5091         i = 0;
5092         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5093                 /* user specified, bail out if channel not found */
5094                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
5095                         struct ieee80211_channel *chan;
5096
5097                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5098
5099                         if (!chan) {
5100                                 err = -EINVAL;
5101                                 goto out_free;
5102                         }
5103
5104                         /* ignore disabled channels */
5105                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5106                                 continue;
5107
5108                         request->channels[i] = chan;
5109                         i++;
5110                 }
5111         } else {
5112                 enum ieee80211_band band;
5113
5114                 /* all channels */
5115                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5116                         int j;
5117                         if (!wiphy->bands[band])
5118                                 continue;
5119                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5120                                 struct ieee80211_channel *chan;
5121
5122                                 chan = &wiphy->bands[band]->channels[j];
5123
5124                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5125                                         continue;
5126
5127                                 request->channels[i] = chan;
5128                                 i++;
5129                         }
5130                 }
5131         }
5132
5133         if (!i) {
5134                 err = -EINVAL;
5135                 goto out_free;
5136         }
5137
5138         request->n_channels = i;
5139
5140         i = 0;
5141         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5142                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
5143                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5144                                 err = -EINVAL;
5145                                 goto out_free;
5146                         }
5147                         request->ssids[i].ssid_len = nla_len(attr);
5148                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
5149                         i++;
5150                 }
5151         }
5152
5153         if (info->attrs[NL80211_ATTR_IE]) {
5154                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5155                 memcpy((void *)request->ie,
5156                        nla_data(info->attrs[NL80211_ATTR_IE]),
5157                        request->ie_len);
5158         }
5159
5160         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
5161                 if (wiphy->bands[i])
5162                         request->rates[i] =
5163                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
5164
5165         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
5166                 nla_for_each_nested(attr,
5167                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
5168                                     tmp) {
5169                         enum ieee80211_band band = nla_type(attr);
5170
5171                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
5172                                 err = -EINVAL;
5173                                 goto out_free;
5174                         }
5175                         err = ieee80211_get_ratemask(wiphy->bands[band],
5176                                                      nla_data(attr),
5177                                                      nla_len(attr),
5178                                                      &request->rates[band]);
5179                         if (err)
5180                                 goto out_free;
5181                 }
5182         }
5183
5184         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5185                 request->flags = nla_get_u32(
5186                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5187                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5188                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
5189                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
5190                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
5191                         err = -EOPNOTSUPP;
5192                         goto out_free;
5193                 }
5194         }
5195
5196         request->no_cck =
5197                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
5198
5199         request->wdev = wdev;
5200         request->wiphy = &rdev->wiphy;
5201         request->scan_start = jiffies;
5202
5203         rdev->scan_req = request;
5204         err = rdev_scan(rdev, request);
5205
5206         if (!err) {
5207                 nl80211_send_scan_start(rdev, wdev);
5208                 if (wdev->netdev)
5209                         dev_hold(wdev->netdev);
5210         } else {
5211  out_free:
5212                 rdev->scan_req = NULL;
5213                 kfree(request);
5214         }
5215
5216         return err;
5217 }
5218
5219 static int nl80211_start_sched_scan(struct sk_buff *skb,
5220                                     struct genl_info *info)
5221 {
5222         struct cfg80211_sched_scan_request *request;
5223         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5224         struct net_device *dev = info->user_ptr[1];
5225         struct nlattr *attr;
5226         struct wiphy *wiphy;
5227         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
5228         u32 interval;
5229         enum ieee80211_band band;
5230         size_t ie_len;
5231         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
5232
5233         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5234             !rdev->ops->sched_scan_start)
5235                 return -EOPNOTSUPP;
5236
5237         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5238                 return -EINVAL;
5239
5240         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
5241                 return -EINVAL;
5242
5243         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
5244         if (interval == 0)
5245                 return -EINVAL;
5246
5247         wiphy = &rdev->wiphy;
5248
5249         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5250                 n_channels = validate_scan_freqs(
5251                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5252                 if (!n_channels)
5253                         return -EINVAL;
5254         } else {
5255                 n_channels = 0;
5256
5257                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
5258                         if (wiphy->bands[band])
5259                                 n_channels += wiphy->bands[band]->n_channels;
5260         }
5261
5262         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5263                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5264                                     tmp)
5265                         n_ssids++;
5266
5267         if (n_ssids > wiphy->max_sched_scan_ssids)
5268                 return -EINVAL;
5269
5270         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
5271                 nla_for_each_nested(attr,
5272                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5273                                     tmp)
5274                         n_match_sets++;
5275
5276         if (n_match_sets > wiphy->max_match_sets)
5277                 return -EINVAL;
5278
5279         if (info->attrs[NL80211_ATTR_IE])
5280                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5281         else
5282                 ie_len = 0;
5283
5284         if (ie_len > wiphy->max_sched_scan_ie_len)
5285                 return -EINVAL;
5286
5287         mutex_lock(&rdev->sched_scan_mtx);
5288
5289         if (rdev->sched_scan_req) {
5290                 err = -EINPROGRESS;
5291                 goto out;
5292         }
5293
5294         request = kzalloc(sizeof(*request)
5295                         + sizeof(*request->ssids) * n_ssids
5296                         + sizeof(*request->match_sets) * n_match_sets
5297                         + sizeof(*request->channels) * n_channels
5298                         + ie_len, GFP_KERNEL);
5299         if (!request) {
5300                 err = -ENOMEM;
5301                 goto out;
5302         }
5303
5304         if (n_ssids)
5305                 request->ssids = (void *)&request->channels[n_channels];
5306         request->n_ssids = n_ssids;
5307         if (ie_len) {
5308                 if (request->ssids)
5309                         request->ie = (void *)(request->ssids + n_ssids);
5310                 else
5311                         request->ie = (void *)(request->channels + n_channels);
5312         }
5313
5314         if (n_match_sets) {
5315                 if (request->ie)
5316                         request->match_sets = (void *)(request->ie + ie_len);
5317                 else if (request->ssids)
5318                         request->match_sets =
5319                                 (void *)(request->ssids + n_ssids);
5320                 else
5321                         request->match_sets =
5322                                 (void *)(request->channels + n_channels);
5323         }
5324         request->n_match_sets = n_match_sets;
5325
5326         i = 0;
5327         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5328                 /* user specified, bail out if channel not found */
5329                 nla_for_each_nested(attr,
5330                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
5331                                     tmp) {
5332                         struct ieee80211_channel *chan;
5333
5334                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5335
5336                         if (!chan) {
5337                                 err = -EINVAL;
5338                                 goto out_free;
5339                         }
5340
5341                         /* ignore disabled channels */
5342                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5343                                 continue;
5344
5345                         request->channels[i] = chan;
5346                         i++;
5347                 }
5348         } else {
5349                 /* all channels */
5350                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5351                         int j;
5352                         if (!wiphy->bands[band])
5353                                 continue;
5354                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5355                                 struct ieee80211_channel *chan;
5356
5357                                 chan = &wiphy->bands[band]->channels[j];
5358
5359                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5360                                         continue;
5361
5362                                 request->channels[i] = chan;
5363                                 i++;
5364                         }
5365                 }
5366         }
5367
5368         if (!i) {
5369                 err = -EINVAL;
5370                 goto out_free;
5371         }
5372
5373         request->n_channels = i;
5374
5375         i = 0;
5376         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5377                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5378                                     tmp) {
5379                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5380                                 err = -EINVAL;
5381                                 goto out_free;
5382                         }
5383                         request->ssids[i].ssid_len = nla_len(attr);
5384                         memcpy(request->ssids[i].ssid, nla_data(attr),
5385                                nla_len(attr));
5386                         i++;
5387                 }
5388         }
5389
5390         i = 0;
5391         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5392                 nla_for_each_nested(attr,
5393                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5394                                     tmp) {
5395                         struct nlattr *ssid, *rssi;
5396
5397                         nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5398                                   nla_data(attr), nla_len(attr),
5399                                   nl80211_match_policy);
5400                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
5401                         if (ssid) {
5402                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
5403                                         err = -EINVAL;
5404                                         goto out_free;
5405                                 }
5406                                 memcpy(request->match_sets[i].ssid.ssid,
5407                                        nla_data(ssid), nla_len(ssid));
5408                                 request->match_sets[i].ssid.ssid_len =
5409                                         nla_len(ssid);
5410                         }
5411                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5412                         if (rssi)
5413                                 request->rssi_thold = nla_get_u32(rssi);
5414                         else
5415                                 request->rssi_thold =
5416                                                    NL80211_SCAN_RSSI_THOLD_OFF;
5417                         i++;
5418                 }
5419         }
5420
5421         if (info->attrs[NL80211_ATTR_IE]) {
5422                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5423                 memcpy((void *)request->ie,
5424                        nla_data(info->attrs[NL80211_ATTR_IE]),
5425                        request->ie_len);
5426         }
5427
5428         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5429                 request->flags = nla_get_u32(
5430                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5431                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5432                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
5433                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
5434                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
5435                         err = -EOPNOTSUPP;
5436                         goto out_free;
5437                 }
5438         }
5439
5440         request->dev = dev;
5441         request->wiphy = &rdev->wiphy;
5442         request->interval = interval;
5443         request->scan_start = jiffies;
5444
5445         err = rdev_sched_scan_start(rdev, dev, request);
5446         if (!err) {
5447                 rdev->sched_scan_req = request;
5448                 nl80211_send_sched_scan(rdev, dev,
5449                                         NL80211_CMD_START_SCHED_SCAN);
5450                 goto out;
5451         }
5452
5453 out_free:
5454         kfree(request);
5455 out:
5456         mutex_unlock(&rdev->sched_scan_mtx);
5457         return err;
5458 }
5459
5460 static int nl80211_stop_sched_scan(struct sk_buff *skb,
5461                                    struct genl_info *info)
5462 {
5463         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5464         int err;
5465
5466         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5467             !rdev->ops->sched_scan_stop)
5468                 return -EOPNOTSUPP;
5469
5470         mutex_lock(&rdev->sched_scan_mtx);
5471         err = __cfg80211_stop_sched_scan(rdev, false);
5472         mutex_unlock(&rdev->sched_scan_mtx);
5473
5474         return err;
5475 }
5476
5477 static int nl80211_start_radar_detection(struct sk_buff *skb,
5478                                          struct genl_info *info)
5479 {
5480         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5481         struct net_device *dev = info->user_ptr[1];
5482         struct wireless_dev *wdev = dev->ieee80211_ptr;
5483         struct cfg80211_chan_def chandef;
5484         int err;
5485
5486         err = nl80211_parse_chandef(rdev, info, &chandef);
5487         if (err)
5488                 return err;
5489
5490         if (wdev->cac_started)
5491                 return -EBUSY;
5492
5493         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef);
5494         if (err < 0)
5495                 return err;
5496
5497         if (err == 0)
5498                 return -EINVAL;
5499
5500         if (chandef.chan->dfs_state != NL80211_DFS_USABLE)
5501                 return -EINVAL;
5502
5503         if (!rdev->ops->start_radar_detection)
5504                 return -EOPNOTSUPP;
5505
5506         mutex_lock(&rdev->devlist_mtx);
5507         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
5508                                            chandef.chan, CHAN_MODE_SHARED,
5509                                            BIT(chandef.width));
5510         if (err)
5511                 goto err_locked;
5512
5513         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef);
5514         if (!err) {
5515                 wdev->channel = chandef.chan;
5516                 wdev->cac_started = true;
5517                 wdev->cac_start_time = jiffies;
5518         }
5519 err_locked:
5520         mutex_unlock(&rdev->devlist_mtx);
5521
5522         return err;
5523 }
5524
5525 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
5526                             u32 seq, int flags,
5527                             struct cfg80211_registered_device *rdev,
5528                             struct wireless_dev *wdev,
5529                             struct cfg80211_internal_bss *intbss)
5530 {
5531         struct cfg80211_bss *res = &intbss->pub;
5532         const struct cfg80211_bss_ies *ies;
5533         void *hdr;
5534         struct nlattr *bss;
5535         bool tsf = false;
5536
5537         ASSERT_WDEV_LOCK(wdev);
5538
5539         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
5540                              NL80211_CMD_NEW_SCAN_RESULTS);
5541         if (!hdr)
5542                 return -1;
5543
5544         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
5545
5546         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation) ||
5547             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
5548                 goto nla_put_failure;
5549
5550         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
5551         if (!bss)
5552                 goto nla_put_failure;
5553         if ((!is_zero_ether_addr(res->bssid) &&
5554              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
5555                 goto nla_put_failure;
5556
5557         rcu_read_lock();
5558         ies = rcu_dereference(res->ies);
5559         if (ies) {
5560                 if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5561                         goto fail_unlock_rcu;
5562                 tsf = true;
5563                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
5564                                         ies->len, ies->data))
5565                         goto fail_unlock_rcu;
5566         }
5567         ies = rcu_dereference(res->beacon_ies);
5568         if (ies) {
5569                 if (!tsf && nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5570                         goto fail_unlock_rcu;
5571                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
5572                                         ies->len, ies->data))
5573                         goto fail_unlock_rcu;
5574         }
5575         rcu_read_unlock();
5576
5577         if (res->beacon_interval &&
5578             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
5579                 goto nla_put_failure;
5580         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
5581             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
5582             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
5583                         jiffies_to_msecs(jiffies - intbss->ts)))
5584                 goto nla_put_failure;
5585
5586         switch (rdev->wiphy.signal_type) {
5587         case CFG80211_SIGNAL_TYPE_MBM:
5588                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
5589                         goto nla_put_failure;
5590                 break;
5591         case CFG80211_SIGNAL_TYPE_UNSPEC:
5592                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
5593                         goto nla_put_failure;
5594                 break;
5595         default:
5596                 break;
5597         }
5598
5599         switch (wdev->iftype) {
5600         case NL80211_IFTYPE_P2P_CLIENT:
5601         case NL80211_IFTYPE_STATION:
5602                 if (intbss == wdev->current_bss &&
5603                     nla_put_u32(msg, NL80211_BSS_STATUS,
5604                                 NL80211_BSS_STATUS_ASSOCIATED))
5605                         goto nla_put_failure;
5606                 break;
5607         case NL80211_IFTYPE_ADHOC:
5608                 if (intbss == wdev->current_bss &&
5609                     nla_put_u32(msg, NL80211_BSS_STATUS,
5610                                 NL80211_BSS_STATUS_IBSS_JOINED))
5611                         goto nla_put_failure;
5612                 break;
5613         default:
5614                 break;
5615         }
5616
5617         nla_nest_end(msg, bss);
5618
5619         return genlmsg_end(msg, hdr);
5620
5621  fail_unlock_rcu:
5622         rcu_read_unlock();
5623  nla_put_failure:
5624         genlmsg_cancel(msg, hdr);
5625         return -EMSGSIZE;
5626 }
5627
5628 static int nl80211_dump_scan(struct sk_buff *skb,
5629                              struct netlink_callback *cb)
5630 {
5631         struct cfg80211_registered_device *rdev;
5632         struct net_device *dev;
5633         struct cfg80211_internal_bss *scan;
5634         struct wireless_dev *wdev;
5635         int start = cb->args[1], idx = 0;
5636         int err;
5637
5638         err = nl80211_prepare_netdev_dump(skb, cb, &rdev, &dev);
5639         if (err)
5640                 return err;
5641
5642         wdev = dev->ieee80211_ptr;
5643
5644         wdev_lock(wdev);
5645         spin_lock_bh(&rdev->bss_lock);
5646         cfg80211_bss_expire(rdev);
5647
5648         cb->seq = rdev->bss_generation;
5649
5650         list_for_each_entry(scan, &rdev->bss_list, list) {
5651                 if (++idx <= start)
5652                         continue;
5653                 if (nl80211_send_bss(skb, cb,
5654                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5655                                 rdev, wdev, scan) < 0) {
5656                         idx--;
5657                         break;
5658                 }
5659         }
5660
5661         spin_unlock_bh(&rdev->bss_lock);
5662         wdev_unlock(wdev);
5663
5664         cb->args[1] = idx;
5665         nl80211_finish_netdev_dump(rdev);
5666
5667         return skb->len;
5668 }
5669
5670 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
5671                                 int flags, struct net_device *dev,
5672                                 struct survey_info *survey)
5673 {
5674         void *hdr;
5675         struct nlattr *infoattr;
5676
5677         hdr = nl80211hdr_put(msg, portid, seq, flags,
5678                              NL80211_CMD_NEW_SURVEY_RESULTS);
5679         if (!hdr)
5680                 return -ENOMEM;
5681
5682         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
5683                 goto nla_put_failure;
5684
5685         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
5686         if (!infoattr)
5687                 goto nla_put_failure;
5688
5689         if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
5690                         survey->channel->center_freq))
5691                 goto nla_put_failure;
5692
5693         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
5694             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
5695                 goto nla_put_failure;
5696         if ((survey->filled & SURVEY_INFO_IN_USE) &&
5697             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
5698                 goto nla_put_failure;
5699         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
5700             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
5701                         survey->channel_time))
5702                 goto nla_put_failure;
5703         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
5704             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
5705                         survey->channel_time_busy))
5706                 goto nla_put_failure;
5707         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
5708             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
5709                         survey->channel_time_ext_busy))
5710                 goto nla_put_failure;
5711         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
5712             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
5713                         survey->channel_time_rx))
5714                 goto nla_put_failure;
5715         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
5716             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
5717                         survey->channel_time_tx))
5718                 goto nla_put_failure;
5719
5720         nla_nest_end(msg, infoattr);
5721
5722         return genlmsg_end(msg, hdr);
5723
5724  nla_put_failure:
5725         genlmsg_cancel(msg, hdr);
5726         return -EMSGSIZE;
5727 }
5728
5729 static int nl80211_dump_survey(struct sk_buff *skb,
5730                         struct netlink_callback *cb)
5731 {
5732         struct survey_info survey;
5733         struct cfg80211_registered_device *dev;
5734         struct net_device *netdev;
5735         int survey_idx = cb->args[1];
5736         int res;
5737
5738         res = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
5739         if (res)
5740                 return res;
5741
5742         if (!dev->ops->dump_survey) {
5743                 res = -EOPNOTSUPP;
5744                 goto out_err;
5745         }
5746
5747         while (1) {
5748                 struct ieee80211_channel *chan;
5749
5750                 res = rdev_dump_survey(dev, netdev, survey_idx, &survey);
5751                 if (res == -ENOENT)
5752                         break;
5753                 if (res)
5754                         goto out_err;
5755
5756                 /* Survey without a channel doesn't make sense */
5757                 if (!survey.channel) {
5758                         res = -EINVAL;
5759                         goto out;
5760                 }
5761
5762                 chan = ieee80211_get_channel(&dev->wiphy,
5763                                              survey.channel->center_freq);
5764                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
5765                         survey_idx++;
5766                         continue;
5767                 }
5768
5769                 if (nl80211_send_survey(skb,
5770                                 NETLINK_CB(cb->skb).portid,
5771                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5772                                 netdev,
5773                                 &survey) < 0)
5774                         goto out;
5775                 survey_idx++;
5776         }
5777
5778  out:
5779         cb->args[1] = survey_idx;
5780         res = skb->len;
5781  out_err:
5782         nl80211_finish_netdev_dump(dev);
5783         return res;
5784 }
5785
5786 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
5787 {
5788         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
5789                                   NL80211_WPA_VERSION_2));
5790 }
5791
5792 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
5793 {
5794         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5795         struct net_device *dev = info->user_ptr[1];
5796         struct ieee80211_channel *chan;
5797         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
5798         int err, ssid_len, ie_len = 0, sae_data_len = 0;
5799         enum nl80211_auth_type auth_type;
5800         struct key_parse key;
5801         bool local_state_change;
5802
5803         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5804                 return -EINVAL;
5805
5806         if (!info->attrs[NL80211_ATTR_MAC])
5807                 return -EINVAL;
5808
5809         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
5810                 return -EINVAL;
5811
5812         if (!info->attrs[NL80211_ATTR_SSID])
5813                 return -EINVAL;
5814
5815         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
5816                 return -EINVAL;
5817
5818         err = nl80211_parse_key(info, &key);
5819         if (err)
5820                 return err;
5821
5822         if (key.idx >= 0) {
5823                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
5824                         return -EINVAL;
5825                 if (!key.p.key || !key.p.key_len)
5826                         return -EINVAL;
5827                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
5828                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
5829                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
5830                      key.p.key_len != WLAN_KEY_LEN_WEP104))
5831                         return -EINVAL;
5832                 if (key.idx > 4)
5833                         return -EINVAL;
5834         } else {
5835                 key.p.key_len = 0;
5836                 key.p.key = NULL;
5837         }
5838
5839         if (key.idx >= 0) {
5840                 int i;
5841                 bool ok = false;
5842                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
5843                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
5844                                 ok = true;
5845                                 break;
5846                         }
5847                 }
5848                 if (!ok)
5849                         return -EINVAL;
5850         }
5851
5852         if (!rdev->ops->auth)
5853                 return -EOPNOTSUPP;
5854
5855         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5856             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5857                 return -EOPNOTSUPP;
5858
5859         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5860         chan = ieee80211_get_channel(&rdev->wiphy,
5861                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5862         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
5863                 return -EINVAL;
5864
5865         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5866         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5867
5868         if (info->attrs[NL80211_ATTR_IE]) {
5869                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5870                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5871         }
5872
5873         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
5874         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
5875                 return -EINVAL;
5876
5877         if (auth_type == NL80211_AUTHTYPE_SAE &&
5878             !info->attrs[NL80211_ATTR_SAE_DATA])
5879                 return -EINVAL;
5880
5881         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
5882                 if (auth_type != NL80211_AUTHTYPE_SAE)
5883                         return -EINVAL;
5884                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
5885                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
5886                 /* need to include at least Auth Transaction and Status Code */
5887                 if (sae_data_len < 4)
5888                         return -EINVAL;
5889         }
5890
5891         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5892
5893         /*
5894          * Since we no longer track auth state, ignore
5895          * requests to only change local state.
5896          */
5897         if (local_state_change)
5898                 return 0;
5899
5900         return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
5901                                   ssid, ssid_len, ie, ie_len,
5902                                   key.p.key, key.p.key_len, key.idx,
5903                                   sae_data, sae_data_len);
5904 }
5905
5906 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
5907                                    struct genl_info *info,
5908                                    struct cfg80211_crypto_settings *settings,
5909                                    int cipher_limit)
5910 {
5911         memset(settings, 0, sizeof(*settings));
5912
5913         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
5914
5915         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
5916                 u16 proto;
5917                 proto = nla_get_u16(
5918                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
5919                 settings->control_port_ethertype = cpu_to_be16(proto);
5920                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
5921                     proto != ETH_P_PAE)
5922                         return -EINVAL;
5923                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
5924                         settings->control_port_no_encrypt = true;
5925         } else
5926                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
5927
5928         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
5929                 void *data;
5930                 int len, i;
5931
5932                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5933                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5934                 settings->n_ciphers_pairwise = len / sizeof(u32);
5935
5936                 if (len % sizeof(u32))
5937                         return -EINVAL;
5938
5939                 if (settings->n_ciphers_pairwise > cipher_limit)
5940                         return -EINVAL;
5941
5942                 memcpy(settings->ciphers_pairwise, data, len);
5943
5944                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
5945                         if (!cfg80211_supported_cipher_suite(
5946                                         &rdev->wiphy,
5947                                         settings->ciphers_pairwise[i]))
5948                                 return -EINVAL;
5949         }
5950
5951         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
5952                 settings->cipher_group =
5953                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
5954                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
5955                                                      settings->cipher_group))
5956                         return -EINVAL;
5957         }
5958
5959         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
5960                 settings->wpa_versions =
5961                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
5962                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
5963                         return -EINVAL;
5964         }
5965
5966         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
5967                 void *data;
5968                 int len;
5969
5970                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
5971                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
5972                 settings->n_akm_suites = len / sizeof(u32);
5973
5974                 if (len % sizeof(u32))
5975                         return -EINVAL;
5976
5977                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
5978                         return -EINVAL;
5979
5980                 memcpy(settings->akm_suites, data, len);
5981         }
5982
5983         return 0;
5984 }
5985
5986 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
5987 {
5988         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5989         struct net_device *dev = info->user_ptr[1];
5990         struct ieee80211_channel *chan;
5991         struct cfg80211_assoc_request req = {};
5992         const u8 *bssid, *ssid;
5993         int err, ssid_len = 0;
5994
5995         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5996                 return -EINVAL;
5997
5998         if (!info->attrs[NL80211_ATTR_MAC] ||
5999             !info->attrs[NL80211_ATTR_SSID] ||
6000             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
6001                 return -EINVAL;
6002
6003         if (!rdev->ops->assoc)
6004                 return -EOPNOTSUPP;
6005
6006         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6007             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6008                 return -EOPNOTSUPP;
6009
6010         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6011
6012         chan = ieee80211_get_channel(&rdev->wiphy,
6013                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6014         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
6015                 return -EINVAL;
6016
6017         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6018         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6019
6020         if (info->attrs[NL80211_ATTR_IE]) {
6021                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6022                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6023         }
6024
6025         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6026                 enum nl80211_mfp mfp =
6027                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6028                 if (mfp == NL80211_MFP_REQUIRED)
6029                         req.use_mfp = true;
6030                 else if (mfp != NL80211_MFP_NO)
6031                         return -EINVAL;
6032         }
6033
6034         if (info->attrs[NL80211_ATTR_PREV_BSSID])
6035                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
6036
6037         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6038                 req.flags |= ASSOC_REQ_DISABLE_HT;
6039
6040         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6041                 memcpy(&req.ht_capa_mask,
6042                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6043                        sizeof(req.ht_capa_mask));
6044
6045         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6046                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6047                         return -EINVAL;
6048                 memcpy(&req.ht_capa,
6049                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6050                        sizeof(req.ht_capa));
6051         }
6052
6053         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
6054                 req.flags |= ASSOC_REQ_DISABLE_VHT;
6055
6056         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6057                 memcpy(&req.vht_capa_mask,
6058                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
6059                        sizeof(req.vht_capa_mask));
6060
6061         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
6062                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6063                         return -EINVAL;
6064                 memcpy(&req.vht_capa,
6065                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
6066                        sizeof(req.vht_capa));
6067         }
6068
6069         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
6070         if (!err)
6071                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
6072                                           ssid, ssid_len, &req);
6073
6074         return err;
6075 }
6076
6077 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
6078 {
6079         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6080         struct net_device *dev = info->user_ptr[1];
6081         const u8 *ie = NULL, *bssid;
6082         int ie_len = 0;
6083         u16 reason_code;
6084         bool local_state_change;
6085
6086         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6087                 return -EINVAL;
6088
6089         if (!info->attrs[NL80211_ATTR_MAC])
6090                 return -EINVAL;
6091
6092         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6093                 return -EINVAL;
6094
6095         if (!rdev->ops->deauth)
6096                 return -EOPNOTSUPP;
6097
6098         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6099             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6100                 return -EOPNOTSUPP;
6101
6102         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6103
6104         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6105         if (reason_code == 0) {
6106                 /* Reason Code 0 is reserved */
6107                 return -EINVAL;
6108         }
6109
6110         if (info->attrs[NL80211_ATTR_IE]) {
6111                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6112                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6113         }
6114
6115         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6116
6117         return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
6118                                     local_state_change);
6119 }
6120
6121 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
6122 {
6123         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6124         struct net_device *dev = info->user_ptr[1];
6125         const u8 *ie = NULL, *bssid;
6126         int ie_len = 0;
6127         u16 reason_code;
6128         bool local_state_change;
6129
6130         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6131                 return -EINVAL;
6132
6133         if (!info->attrs[NL80211_ATTR_MAC])
6134                 return -EINVAL;
6135
6136         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6137                 return -EINVAL;
6138
6139         if (!rdev->ops->disassoc)
6140                 return -EOPNOTSUPP;
6141
6142         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6143             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6144                 return -EOPNOTSUPP;
6145
6146         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6147
6148         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6149         if (reason_code == 0) {
6150                 /* Reason Code 0 is reserved */
6151                 return -EINVAL;
6152         }
6153
6154         if (info->attrs[NL80211_ATTR_IE]) {
6155                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6156                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6157         }
6158
6159         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6160
6161         return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
6162                                       local_state_change);
6163 }
6164
6165 static bool
6166 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
6167                          int mcast_rate[IEEE80211_NUM_BANDS],
6168                          int rateval)
6169 {
6170         struct wiphy *wiphy = &rdev->wiphy;
6171         bool found = false;
6172         int band, i;
6173
6174         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
6175                 struct ieee80211_supported_band *sband;
6176
6177                 sband = wiphy->bands[band];
6178                 if (!sband)
6179                         continue;
6180
6181                 for (i = 0; i < sband->n_bitrates; i++) {
6182                         if (sband->bitrates[i].bitrate == rateval) {
6183                                 mcast_rate[band] = i + 1;
6184                                 found = true;
6185                                 break;
6186                         }
6187                 }
6188         }
6189
6190         return found;
6191 }
6192
6193 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
6194 {
6195         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6196         struct net_device *dev = info->user_ptr[1];
6197         struct cfg80211_ibss_params ibss;
6198         struct wiphy *wiphy;
6199         struct cfg80211_cached_keys *connkeys = NULL;
6200         int err;
6201
6202         memset(&ibss, 0, sizeof(ibss));
6203
6204         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6205                 return -EINVAL;
6206
6207         if (!info->attrs[NL80211_ATTR_SSID] ||
6208             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6209                 return -EINVAL;
6210
6211         ibss.beacon_interval = 100;
6212
6213         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
6214                 ibss.beacon_interval =
6215                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
6216                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
6217                         return -EINVAL;
6218         }
6219
6220         if (!rdev->ops->join_ibss)
6221                 return -EOPNOTSUPP;
6222
6223         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6224                 return -EOPNOTSUPP;
6225
6226         wiphy = &rdev->wiphy;
6227
6228         if (info->attrs[NL80211_ATTR_MAC]) {
6229                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6230
6231                 if (!is_valid_ether_addr(ibss.bssid))
6232                         return -EINVAL;
6233         }
6234         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6235         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6236
6237         if (info->attrs[NL80211_ATTR_IE]) {
6238                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6239                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6240         }
6241
6242         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
6243         if (err)
6244                 return err;
6245
6246         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef))
6247                 return -EINVAL;
6248
6249         if (ibss.chandef.width > NL80211_CHAN_WIDTH_40)
6250                 return -EINVAL;
6251         if (ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
6252             !(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
6253                 return -EINVAL;
6254
6255         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
6256         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
6257
6258         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
6259                 u8 *rates =
6260                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6261                 int n_rates =
6262                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6263                 struct ieee80211_supported_band *sband =
6264                         wiphy->bands[ibss.chandef.chan->band];
6265
6266                 err = ieee80211_get_ratemask(sband, rates, n_rates,
6267                                              &ibss.basic_rates);
6268                 if (err)
6269                         return err;
6270         }
6271
6272         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
6273             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
6274                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
6275                 return -EINVAL;
6276
6277         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6278                 bool no_ht = false;
6279
6280                 connkeys = nl80211_parse_connkeys(rdev,
6281                                           info->attrs[NL80211_ATTR_KEYS],
6282                                           &no_ht);
6283                 if (IS_ERR(connkeys))
6284                         return PTR_ERR(connkeys);
6285
6286                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
6287                     no_ht) {
6288                         kfree(connkeys);
6289                         return -EINVAL;
6290                 }
6291         }
6292
6293         ibss.control_port =
6294                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
6295
6296         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
6297         if (err)
6298                 kfree(connkeys);
6299         return err;
6300 }
6301
6302 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
6303 {
6304         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6305         struct net_device *dev = info->user_ptr[1];
6306
6307         if (!rdev->ops->leave_ibss)
6308                 return -EOPNOTSUPP;
6309
6310         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6311                 return -EOPNOTSUPP;
6312
6313         return cfg80211_leave_ibss(rdev, dev, false);
6314 }
6315
6316 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
6317 {
6318         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6319         struct net_device *dev = info->user_ptr[1];
6320         int mcast_rate[IEEE80211_NUM_BANDS];
6321         u32 nla_rate;
6322         int err;
6323
6324         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
6325             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6326                 return -EOPNOTSUPP;
6327
6328         if (!rdev->ops->set_mcast_rate)
6329                 return -EOPNOTSUPP;
6330
6331         memset(mcast_rate, 0, sizeof(mcast_rate));
6332
6333         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
6334                 return -EINVAL;
6335
6336         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
6337         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
6338                 return -EINVAL;
6339
6340         err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
6341
6342         return err;
6343 }
6344
6345
6346 #ifdef CONFIG_NL80211_TESTMODE
6347 static struct genl_multicast_group nl80211_testmode_mcgrp = {
6348         .name = "testmode",
6349 };
6350
6351 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
6352 {
6353         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6354         int err;
6355
6356         if (!info->attrs[NL80211_ATTR_TESTDATA])
6357                 return -EINVAL;
6358
6359         err = -EOPNOTSUPP;
6360         if (rdev->ops->testmode_cmd) {
6361                 rdev->testmode_info = info;
6362                 err = rdev_testmode_cmd(rdev,
6363                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
6364                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
6365                 rdev->testmode_info = NULL;
6366         }
6367
6368         return err;
6369 }
6370
6371 static int nl80211_testmode_dump(struct sk_buff *skb,
6372                                  struct netlink_callback *cb)
6373 {
6374         struct cfg80211_registered_device *rdev;
6375         int err;
6376         long phy_idx;
6377         void *data = NULL;
6378         int data_len = 0;
6379
6380         if (cb->args[0]) {
6381                 /*
6382                  * 0 is a valid index, but not valid for args[0],
6383                  * so we need to offset by 1.
6384                  */
6385                 phy_idx = cb->args[0] - 1;
6386         } else {
6387                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
6388                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
6389                                   nl80211_policy);
6390                 if (err)
6391                         return err;
6392
6393                 mutex_lock(&cfg80211_mutex);
6394                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
6395                                                   nl80211_fam.attrbuf);
6396                 if (IS_ERR(rdev)) {
6397                         mutex_unlock(&cfg80211_mutex);
6398                         return PTR_ERR(rdev);
6399                 }
6400                 phy_idx = rdev->wiphy_idx;
6401                 rdev = NULL;
6402                 mutex_unlock(&cfg80211_mutex);
6403
6404                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
6405                         cb->args[1] =
6406                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
6407         }
6408
6409         if (cb->args[1]) {
6410                 data = nla_data((void *)cb->args[1]);
6411                 data_len = nla_len((void *)cb->args[1]);
6412         }
6413
6414         mutex_lock(&cfg80211_mutex);
6415         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
6416         if (!rdev) {
6417                 mutex_unlock(&cfg80211_mutex);
6418                 return -ENOENT;
6419         }
6420         cfg80211_lock_rdev(rdev);
6421         mutex_unlock(&cfg80211_mutex);
6422
6423         if (!rdev->ops->testmode_dump) {
6424                 err = -EOPNOTSUPP;
6425                 goto out_err;
6426         }
6427
6428         while (1) {
6429                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
6430                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
6431                                            NL80211_CMD_TESTMODE);
6432                 struct nlattr *tmdata;
6433
6434                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
6435                         genlmsg_cancel(skb, hdr);
6436                         break;
6437                 }
6438
6439                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6440                 if (!tmdata) {
6441                         genlmsg_cancel(skb, hdr);
6442                         break;
6443                 }
6444                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
6445                 nla_nest_end(skb, tmdata);
6446
6447                 if (err == -ENOBUFS || err == -ENOENT) {
6448                         genlmsg_cancel(skb, hdr);
6449                         break;
6450                 } else if (err) {
6451                         genlmsg_cancel(skb, hdr);
6452                         goto out_err;
6453                 }
6454
6455                 genlmsg_end(skb, hdr);
6456         }
6457
6458         err = skb->len;
6459         /* see above */
6460         cb->args[0] = phy_idx + 1;
6461  out_err:
6462         cfg80211_unlock_rdev(rdev);
6463         return err;
6464 }
6465
6466 static struct sk_buff *
6467 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
6468                               int approxlen, u32 portid, u32 seq, gfp_t gfp)
6469 {
6470         struct sk_buff *skb;
6471         void *hdr;
6472         struct nlattr *data;
6473
6474         skb = nlmsg_new(approxlen + 100, gfp);
6475         if (!skb)
6476                 return NULL;
6477
6478         hdr = nl80211hdr_put(skb, portid, seq, 0, NL80211_CMD_TESTMODE);
6479         if (!hdr) {
6480                 kfree_skb(skb);
6481                 return NULL;
6482         }
6483
6484         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
6485                 goto nla_put_failure;
6486         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6487
6488         ((void **)skb->cb)[0] = rdev;
6489         ((void **)skb->cb)[1] = hdr;
6490         ((void **)skb->cb)[2] = data;
6491
6492         return skb;
6493
6494  nla_put_failure:
6495         kfree_skb(skb);
6496         return NULL;
6497 }
6498
6499 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
6500                                                   int approxlen)
6501 {
6502         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6503
6504         if (WARN_ON(!rdev->testmode_info))
6505                 return NULL;
6506
6507         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
6508                                 rdev->testmode_info->snd_portid,
6509                                 rdev->testmode_info->snd_seq,
6510                                 GFP_KERNEL);
6511 }
6512 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
6513
6514 int cfg80211_testmode_reply(struct sk_buff *skb)
6515 {
6516         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
6517         void *hdr = ((void **)skb->cb)[1];
6518         struct nlattr *data = ((void **)skb->cb)[2];
6519
6520         if (WARN_ON(!rdev->testmode_info)) {
6521                 kfree_skb(skb);
6522                 return -EINVAL;
6523         }
6524
6525         nla_nest_end(skb, data);
6526         genlmsg_end(skb, hdr);
6527         return genlmsg_reply(skb, rdev->testmode_info);
6528 }
6529 EXPORT_SYMBOL(cfg80211_testmode_reply);
6530
6531 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
6532                                                   int approxlen, gfp_t gfp)
6533 {
6534         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6535
6536         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
6537 }
6538 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
6539
6540 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
6541 {
6542         void *hdr = ((void **)skb->cb)[1];
6543         struct nlattr *data = ((void **)skb->cb)[2];
6544
6545         nla_nest_end(skb, data);
6546         genlmsg_end(skb, hdr);
6547         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
6548 }
6549 EXPORT_SYMBOL(cfg80211_testmode_event);
6550 #endif
6551
6552 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
6553 {
6554         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6555         struct net_device *dev = info->user_ptr[1];
6556         struct cfg80211_connect_params connect;
6557         struct wiphy *wiphy;
6558         struct cfg80211_cached_keys *connkeys = NULL;
6559         int err;
6560
6561         memset(&connect, 0, sizeof(connect));
6562
6563         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6564                 return -EINVAL;
6565
6566         if (!info->attrs[NL80211_ATTR_SSID] ||
6567             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6568                 return -EINVAL;
6569
6570         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
6571                 connect.auth_type =
6572                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6573                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
6574                                              NL80211_CMD_CONNECT))
6575                         return -EINVAL;
6576         } else
6577                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
6578
6579         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
6580
6581         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
6582                                       NL80211_MAX_NR_CIPHER_SUITES);
6583         if (err)
6584                 return err;
6585
6586         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6587             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6588                 return -EOPNOTSUPP;
6589
6590         wiphy = &rdev->wiphy;
6591
6592         connect.bg_scan_period = -1;
6593         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
6594                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
6595                 connect.bg_scan_period =
6596                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
6597         }
6598
6599         if (info->attrs[NL80211_ATTR_MAC])
6600                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6601         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6602         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6603
6604         if (info->attrs[NL80211_ATTR_IE]) {
6605                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6606                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6607         }
6608
6609         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6610                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6611                 if (connect.mfp != NL80211_MFP_REQUIRED &&
6612                     connect.mfp != NL80211_MFP_NO)
6613                         return -EINVAL;
6614         } else {
6615                 connect.mfp = NL80211_MFP_NO;
6616         }
6617
6618         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6619                 connect.channel =
6620                         ieee80211_get_channel(wiphy,
6621                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6622                 if (!connect.channel ||
6623                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
6624                         return -EINVAL;
6625         }
6626
6627         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6628                 connkeys = nl80211_parse_connkeys(rdev,
6629                                           info->attrs[NL80211_ATTR_KEYS], NULL);
6630                 if (IS_ERR(connkeys))
6631                         return PTR_ERR(connkeys);
6632         }
6633
6634         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6635                 connect.flags |= ASSOC_REQ_DISABLE_HT;
6636
6637         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6638                 memcpy(&connect.ht_capa_mask,
6639                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6640                        sizeof(connect.ht_capa_mask));
6641
6642         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6643                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
6644                         kfree(connkeys);
6645                         return -EINVAL;
6646                 }
6647                 memcpy(&connect.ht_capa,
6648                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6649                        sizeof(connect.ht_capa));
6650         }
6651
6652         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
6653                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
6654
6655         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6656                 memcpy(&connect.vht_capa_mask,
6657                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
6658                        sizeof(connect.vht_capa_mask));
6659
6660         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
6661                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
6662                         kfree(connkeys);
6663                         return -EINVAL;
6664                 }
6665                 memcpy(&connect.vht_capa,
6666                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
6667                        sizeof(connect.vht_capa));
6668         }
6669
6670         err = cfg80211_connect(rdev, dev, &connect, connkeys);
6671         if (err)
6672                 kfree(connkeys);
6673         return err;
6674 }
6675
6676 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
6677 {
6678         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6679         struct net_device *dev = info->user_ptr[1];
6680         u16 reason;
6681
6682         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6683                 reason = WLAN_REASON_DEAUTH_LEAVING;
6684         else
6685                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6686
6687         if (reason == 0)
6688                 return -EINVAL;
6689
6690         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6691             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6692                 return -EOPNOTSUPP;
6693
6694         return cfg80211_disconnect(rdev, dev, reason, true);
6695 }
6696
6697 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
6698 {
6699         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6700         struct net *net;
6701         int err;
6702         u32 pid;
6703
6704         if (!info->attrs[NL80211_ATTR_PID])
6705                 return -EINVAL;
6706
6707         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
6708
6709         net = get_net_ns_by_pid(pid);
6710         if (IS_ERR(net))
6711                 return PTR_ERR(net);
6712
6713         err = 0;
6714
6715         /* check if anything to do */
6716         if (!net_eq(wiphy_net(&rdev->wiphy), net))
6717                 err = cfg80211_switch_netns(rdev, net);
6718
6719         put_net(net);
6720         return err;
6721 }
6722
6723 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
6724 {
6725         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6726         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
6727                         struct cfg80211_pmksa *pmksa) = NULL;
6728         struct net_device *dev = info->user_ptr[1];
6729         struct cfg80211_pmksa pmksa;
6730
6731         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
6732
6733         if (!info->attrs[NL80211_ATTR_MAC])
6734                 return -EINVAL;
6735
6736         if (!info->attrs[NL80211_ATTR_PMKID])
6737                 return -EINVAL;
6738
6739         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
6740         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6741
6742         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6743             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6744                 return -EOPNOTSUPP;
6745
6746         switch (info->genlhdr->cmd) {
6747         case NL80211_CMD_SET_PMKSA:
6748                 rdev_ops = rdev->ops->set_pmksa;
6749                 break;
6750         case NL80211_CMD_DEL_PMKSA:
6751                 rdev_ops = rdev->ops->del_pmksa;
6752                 break;
6753         default:
6754                 WARN_ON(1);
6755                 break;
6756         }
6757
6758         if (!rdev_ops)
6759                 return -EOPNOTSUPP;
6760
6761         return rdev_ops(&rdev->wiphy, dev, &pmksa);
6762 }
6763
6764 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
6765 {
6766         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6767         struct net_device *dev = info->user_ptr[1];
6768
6769         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6770             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6771                 return -EOPNOTSUPP;
6772
6773         if (!rdev->ops->flush_pmksa)
6774                 return -EOPNOTSUPP;
6775
6776         return rdev_flush_pmksa(rdev, dev);
6777 }
6778
6779 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
6780 {
6781         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6782         struct net_device *dev = info->user_ptr[1];
6783         u8 action_code, dialog_token;
6784         u16 status_code;
6785         u8 *peer;
6786
6787         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
6788             !rdev->ops->tdls_mgmt)
6789                 return -EOPNOTSUPP;
6790
6791         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
6792             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
6793             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
6794             !info->attrs[NL80211_ATTR_IE] ||
6795             !info->attrs[NL80211_ATTR_MAC])
6796                 return -EINVAL;
6797
6798         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
6799         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
6800         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
6801         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
6802
6803         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
6804                               dialog_token, status_code,
6805                               nla_data(info->attrs[NL80211_ATTR_IE]),
6806                               nla_len(info->attrs[NL80211_ATTR_IE]));
6807 }
6808
6809 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
6810 {
6811         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6812         struct net_device *dev = info->user_ptr[1];
6813         enum nl80211_tdls_operation operation;
6814         u8 *peer;
6815
6816         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
6817             !rdev->ops->tdls_oper)
6818                 return -EOPNOTSUPP;
6819
6820         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
6821             !info->attrs[NL80211_ATTR_MAC])
6822                 return -EINVAL;
6823
6824         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
6825         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
6826
6827         return rdev_tdls_oper(rdev, dev, peer, operation);
6828 }
6829
6830 static int nl80211_remain_on_channel(struct sk_buff *skb,
6831                                      struct genl_info *info)
6832 {
6833         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6834         struct wireless_dev *wdev = info->user_ptr[1];
6835         struct cfg80211_chan_def chandef;
6836         struct sk_buff *msg;
6837         void *hdr;
6838         u64 cookie;
6839         u32 duration;
6840         int err;
6841
6842         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
6843             !info->attrs[NL80211_ATTR_DURATION])
6844                 return -EINVAL;
6845
6846         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
6847
6848         if (!rdev->ops->remain_on_channel ||
6849             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
6850                 return -EOPNOTSUPP;
6851
6852         /*
6853          * We should be on that channel for at least a minimum amount of
6854          * time (10ms) but no longer than the driver supports.
6855          */
6856         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
6857             duration > rdev->wiphy.max_remain_on_channel_duration)
6858                 return -EINVAL;
6859
6860         err = nl80211_parse_chandef(rdev, info, &chandef);
6861         if (err)
6862                 return err;
6863
6864         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6865         if (!msg)
6866                 return -ENOMEM;
6867
6868         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6869                              NL80211_CMD_REMAIN_ON_CHANNEL);
6870
6871         if (IS_ERR(hdr)) {
6872                 err = PTR_ERR(hdr);
6873                 goto free_msg;
6874         }
6875
6876         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
6877                                      duration, &cookie);
6878
6879         if (err)
6880                 goto free_msg;
6881
6882         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6883                 goto nla_put_failure;
6884
6885         genlmsg_end(msg, hdr);
6886
6887         return genlmsg_reply(msg, info);
6888
6889  nla_put_failure:
6890         err = -ENOBUFS;
6891  free_msg:
6892         nlmsg_free(msg);
6893         return err;
6894 }
6895
6896 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
6897                                             struct genl_info *info)
6898 {
6899         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6900         struct wireless_dev *wdev = info->user_ptr[1];
6901         u64 cookie;
6902
6903         if (!info->attrs[NL80211_ATTR_COOKIE])
6904                 return -EINVAL;
6905
6906         if (!rdev->ops->cancel_remain_on_channel)
6907                 return -EOPNOTSUPP;
6908
6909         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
6910
6911         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
6912 }
6913
6914 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
6915                            u8 *rates, u8 rates_len)
6916 {
6917         u8 i;
6918         u32 mask = 0;
6919
6920         for (i = 0; i < rates_len; i++) {
6921                 int rate = (rates[i] & 0x7f) * 5;
6922                 int ridx;
6923                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
6924                         struct ieee80211_rate *srate =
6925                                 &sband->bitrates[ridx];
6926                         if (rate == srate->bitrate) {
6927                                 mask |= 1 << ridx;
6928                                 break;
6929                         }
6930                 }
6931                 if (ridx == sband->n_bitrates)
6932                         return 0; /* rate not found */
6933         }
6934
6935         return mask;
6936 }
6937
6938 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
6939                                u8 *rates, u8 rates_len,
6940                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
6941 {
6942         u8 i;
6943
6944         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
6945
6946         for (i = 0; i < rates_len; i++) {
6947                 int ridx, rbit;
6948
6949                 ridx = rates[i] / 8;
6950                 rbit = BIT(rates[i] % 8);
6951
6952                 /* check validity */
6953                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
6954                         return false;
6955
6956                 /* check availability */
6957                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
6958                         mcs[ridx] |= rbit;
6959                 else
6960                         return false;
6961         }
6962
6963         return true;
6964 }
6965
6966 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
6967         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
6968                                     .len = NL80211_MAX_SUPP_RATES },
6969         [NL80211_TXRATE_MCS] = { .type = NLA_BINARY,
6970                                  .len = NL80211_MAX_SUPP_HT_RATES },
6971 };
6972
6973 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
6974                                        struct genl_info *info)
6975 {
6976         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
6977         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6978         struct cfg80211_bitrate_mask mask;
6979         int rem, i;
6980         struct net_device *dev = info->user_ptr[1];
6981         struct nlattr *tx_rates;
6982         struct ieee80211_supported_band *sband;
6983
6984         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
6985                 return -EINVAL;
6986
6987         if (!rdev->ops->set_bitrate_mask)
6988                 return -EOPNOTSUPP;
6989
6990         memset(&mask, 0, sizeof(mask));
6991         /* Default to all rates enabled */
6992         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
6993                 sband = rdev->wiphy.bands[i];
6994                 mask.control[i].legacy =
6995                         sband ? (1 << sband->n_bitrates) - 1 : 0;
6996                 if (sband)
6997                         memcpy(mask.control[i].mcs,
6998                                sband->ht_cap.mcs.rx_mask,
6999                                sizeof(mask.control[i].mcs));
7000                 else
7001                         memset(mask.control[i].mcs, 0,
7002                                sizeof(mask.control[i].mcs));
7003         }
7004
7005         /*
7006          * The nested attribute uses enum nl80211_band as the index. This maps
7007          * directly to the enum ieee80211_band values used in cfg80211.
7008          */
7009         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
7010         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
7011         {
7012                 enum ieee80211_band band = nla_type(tx_rates);
7013                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
7014                         return -EINVAL;
7015                 sband = rdev->wiphy.bands[band];
7016                 if (sband == NULL)
7017                         return -EINVAL;
7018                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
7019                           nla_len(tx_rates), nl80211_txattr_policy);
7020                 if (tb[NL80211_TXRATE_LEGACY]) {
7021                         mask.control[band].legacy = rateset_to_mask(
7022                                 sband,
7023                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
7024                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
7025                         if ((mask.control[band].legacy == 0) &&
7026                             nla_len(tb[NL80211_TXRATE_LEGACY]))
7027                                 return -EINVAL;
7028                 }
7029                 if (tb[NL80211_TXRATE_MCS]) {
7030                         if (!ht_rateset_to_mask(
7031                                         sband,
7032                                         nla_data(tb[NL80211_TXRATE_MCS]),
7033                                         nla_len(tb[NL80211_TXRATE_MCS]),
7034                                         mask.control[band].mcs))
7035                                 return -EINVAL;
7036                 }
7037
7038                 if (mask.control[band].legacy == 0) {
7039                         /* don't allow empty legacy rates if HT
7040                          * is not even supported. */
7041                         if (!rdev->wiphy.bands[band]->ht_cap.ht_supported)
7042                                 return -EINVAL;
7043
7044                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
7045                                 if (mask.control[band].mcs[i])
7046                                         break;
7047
7048                         /* legacy and mcs rates may not be both empty */
7049                         if (i == IEEE80211_HT_MCS_MASK_LEN)
7050                                 return -EINVAL;
7051                 }
7052         }
7053
7054         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
7055 }
7056
7057 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
7058 {
7059         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7060         struct wireless_dev *wdev = info->user_ptr[1];
7061         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
7062
7063         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
7064                 return -EINVAL;
7065
7066         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
7067                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
7068
7069         switch (wdev->iftype) {
7070         case NL80211_IFTYPE_STATION:
7071         case NL80211_IFTYPE_ADHOC:
7072         case NL80211_IFTYPE_P2P_CLIENT:
7073         case NL80211_IFTYPE_AP:
7074         case NL80211_IFTYPE_AP_VLAN:
7075         case NL80211_IFTYPE_MESH_POINT:
7076         case NL80211_IFTYPE_P2P_GO:
7077         case NL80211_IFTYPE_P2P_DEVICE:
7078                 break;
7079         default:
7080                 return -EOPNOTSUPP;
7081         }
7082
7083         /* not much point in registering if we can't reply */
7084         if (!rdev->ops->mgmt_tx)
7085                 return -EOPNOTSUPP;
7086
7087         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
7088                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
7089                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
7090 }
7091
7092 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
7093 {
7094         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7095         struct wireless_dev *wdev = info->user_ptr[1];
7096         struct cfg80211_chan_def chandef;
7097         int err;
7098         void *hdr = NULL;
7099         u64 cookie;
7100         struct sk_buff *msg = NULL;
7101         unsigned int wait = 0;
7102         bool offchan, no_cck, dont_wait_for_ack;
7103
7104         dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
7105
7106         if (!info->attrs[NL80211_ATTR_FRAME])
7107                 return -EINVAL;
7108
7109         if (!rdev->ops->mgmt_tx)
7110                 return -EOPNOTSUPP;
7111
7112         switch (wdev->iftype) {
7113         case NL80211_IFTYPE_STATION:
7114         case NL80211_IFTYPE_ADHOC:
7115         case NL80211_IFTYPE_P2P_CLIENT:
7116         case NL80211_IFTYPE_AP:
7117         case NL80211_IFTYPE_AP_VLAN:
7118         case NL80211_IFTYPE_MESH_POINT:
7119         case NL80211_IFTYPE_P2P_GO:
7120         case NL80211_IFTYPE_P2P_DEVICE:
7121                 break;
7122         default:
7123                 return -EOPNOTSUPP;
7124         }
7125
7126         if (info->attrs[NL80211_ATTR_DURATION]) {
7127                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7128                         return -EINVAL;
7129                 wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7130
7131                 /*
7132                  * We should wait on the channel for at least a minimum amount
7133                  * of time (10ms) but no longer than the driver supports.
7134                  */
7135                 if (wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7136                     wait > rdev->wiphy.max_remain_on_channel_duration)
7137                         return -EINVAL;
7138
7139         }
7140
7141         offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
7142
7143         if (offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7144                 return -EINVAL;
7145
7146         no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7147
7148         err = nl80211_parse_chandef(rdev, info, &chandef);
7149         if (err)
7150                 return err;
7151
7152         if (!dont_wait_for_ack) {
7153                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7154                 if (!msg)
7155                         return -ENOMEM;
7156
7157                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7158                                      NL80211_CMD_FRAME);
7159
7160                 if (IS_ERR(hdr)) {
7161                         err = PTR_ERR(hdr);
7162                         goto free_msg;
7163                 }
7164         }
7165
7166         err = cfg80211_mlme_mgmt_tx(rdev, wdev, chandef.chan, offchan, wait,
7167                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
7168                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
7169                                     no_cck, dont_wait_for_ack, &cookie);
7170         if (err)
7171                 goto free_msg;
7172
7173         if (msg) {
7174                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7175                         goto nla_put_failure;
7176
7177                 genlmsg_end(msg, hdr);
7178                 return genlmsg_reply(msg, info);
7179         }
7180
7181         return 0;
7182
7183  nla_put_failure:
7184         err = -ENOBUFS;
7185  free_msg:
7186         nlmsg_free(msg);
7187         return err;
7188 }
7189
7190 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
7191 {
7192         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7193         struct wireless_dev *wdev = info->user_ptr[1];
7194         u64 cookie;
7195
7196         if (!info->attrs[NL80211_ATTR_COOKIE])
7197                 return -EINVAL;
7198
7199         if (!rdev->ops->mgmt_tx_cancel_wait)
7200                 return -EOPNOTSUPP;
7201
7202         switch (wdev->iftype) {
7203         case NL80211_IFTYPE_STATION:
7204         case NL80211_IFTYPE_ADHOC:
7205         case NL80211_IFTYPE_P2P_CLIENT:
7206         case NL80211_IFTYPE_AP:
7207         case NL80211_IFTYPE_AP_VLAN:
7208         case NL80211_IFTYPE_P2P_GO:
7209         case NL80211_IFTYPE_P2P_DEVICE:
7210                 break;
7211         default:
7212                 return -EOPNOTSUPP;
7213         }
7214
7215         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7216
7217         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
7218 }
7219
7220 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
7221 {
7222         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7223         struct wireless_dev *wdev;
7224         struct net_device *dev = info->user_ptr[1];
7225         u8 ps_state;
7226         bool state;
7227         int err;
7228
7229         if (!info->attrs[NL80211_ATTR_PS_STATE])
7230                 return -EINVAL;
7231
7232         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
7233
7234         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
7235                 return -EINVAL;
7236
7237         wdev = dev->ieee80211_ptr;
7238
7239         if (!rdev->ops->set_power_mgmt)
7240                 return -EOPNOTSUPP;
7241
7242         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
7243
7244         if (state == wdev->ps)
7245                 return 0;
7246
7247         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
7248         if (!err)
7249                 wdev->ps = state;
7250         return err;
7251 }
7252
7253 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
7254 {
7255         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7256         enum nl80211_ps_state ps_state;
7257         struct wireless_dev *wdev;
7258         struct net_device *dev = info->user_ptr[1];
7259         struct sk_buff *msg;
7260         void *hdr;
7261         int err;
7262
7263         wdev = dev->ieee80211_ptr;
7264
7265         if (!rdev->ops->set_power_mgmt)
7266                 return -EOPNOTSUPP;
7267
7268         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7269         if (!msg)
7270                 return -ENOMEM;
7271
7272         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7273                              NL80211_CMD_GET_POWER_SAVE);
7274         if (!hdr) {
7275                 err = -ENOBUFS;
7276                 goto free_msg;
7277         }
7278
7279         if (wdev->ps)
7280                 ps_state = NL80211_PS_ENABLED;
7281         else
7282                 ps_state = NL80211_PS_DISABLED;
7283
7284         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
7285                 goto nla_put_failure;
7286
7287         genlmsg_end(msg, hdr);
7288         return genlmsg_reply(msg, info);
7289
7290  nla_put_failure:
7291         err = -ENOBUFS;
7292  free_msg:
7293         nlmsg_free(msg);
7294         return err;
7295 }
7296
7297 static struct nla_policy
7298 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
7299         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
7300         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
7301         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
7302         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
7303         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
7304         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
7305 };
7306
7307 static int nl80211_set_cqm_txe(struct genl_info *info,
7308                                u32 rate, u32 pkts, u32 intvl)
7309 {
7310         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7311         struct wireless_dev *wdev;
7312         struct net_device *dev = info->user_ptr[1];
7313
7314         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
7315                 return -EINVAL;
7316
7317         wdev = dev->ieee80211_ptr;
7318
7319         if (!rdev->ops->set_cqm_txe_config)
7320                 return -EOPNOTSUPP;
7321
7322         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7323             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7324                 return -EOPNOTSUPP;
7325
7326         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
7327 }
7328
7329 static int nl80211_set_cqm_rssi(struct genl_info *info,
7330                                 s32 threshold, u32 hysteresis)
7331 {
7332         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7333         struct wireless_dev *wdev;
7334         struct net_device *dev = info->user_ptr[1];
7335
7336         if (threshold > 0)
7337                 return -EINVAL;
7338
7339         wdev = dev->ieee80211_ptr;
7340
7341         if (!rdev->ops->set_cqm_rssi_config)
7342                 return -EOPNOTSUPP;
7343
7344         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7345             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7346                 return -EOPNOTSUPP;
7347
7348         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
7349 }
7350
7351 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
7352 {
7353         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
7354         struct nlattr *cqm;
7355         int err;
7356
7357         cqm = info->attrs[NL80211_ATTR_CQM];
7358         if (!cqm) {
7359                 err = -EINVAL;
7360                 goto out;
7361         }
7362
7363         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
7364                                nl80211_attr_cqm_policy);
7365         if (err)
7366                 goto out;
7367
7368         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
7369             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
7370                 s32 threshold;
7371                 u32 hysteresis;
7372                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
7373                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
7374                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
7375         } else if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
7376                    attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
7377                    attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
7378                 u32 rate, pkts, intvl;
7379                 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
7380                 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
7381                 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
7382                 err = nl80211_set_cqm_txe(info, rate, pkts, intvl);
7383         } else
7384                 err = -EINVAL;
7385
7386 out:
7387         return err;
7388 }
7389
7390 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
7391 {
7392         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7393         struct net_device *dev = info->user_ptr[1];
7394         struct mesh_config cfg;
7395         struct mesh_setup setup;
7396         int err;
7397
7398         /* start with default */
7399         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
7400         memcpy(&setup, &default_mesh_setup, sizeof(setup));
7401
7402         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
7403                 /* and parse parameters if given */
7404                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
7405                 if (err)
7406                         return err;
7407         }
7408
7409         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
7410             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
7411                 return -EINVAL;
7412
7413         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
7414         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
7415
7416         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
7417             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
7418                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
7419                         return -EINVAL;
7420
7421         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
7422                 setup.beacon_interval =
7423                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
7424                 if (setup.beacon_interval < 10 ||
7425                     setup.beacon_interval > 10000)
7426                         return -EINVAL;
7427         }
7428
7429         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
7430                 setup.dtim_period =
7431                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
7432                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
7433                         return -EINVAL;
7434         }
7435
7436         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
7437                 /* parse additional setup parameters if given */
7438                 err = nl80211_parse_mesh_setup(info, &setup);
7439                 if (err)
7440                         return err;
7441         }
7442
7443         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7444                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
7445                 if (err)
7446                         return err;
7447         } else {
7448                 /* cfg80211_join_mesh() will sort it out */
7449                 setup.chandef.chan = NULL;
7450         }
7451
7452         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
7453 }
7454
7455 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
7456 {
7457         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7458         struct net_device *dev = info->user_ptr[1];
7459
7460         return cfg80211_leave_mesh(rdev, dev);
7461 }
7462
7463 #ifdef CONFIG_PM
7464 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
7465                                         struct cfg80211_registered_device *rdev)
7466 {
7467         struct nlattr *nl_pats, *nl_pat;
7468         int i, pat_len;
7469
7470         if (!rdev->wowlan->n_patterns)
7471                 return 0;
7472
7473         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
7474         if (!nl_pats)
7475                 return -ENOBUFS;
7476
7477         for (i = 0; i < rdev->wowlan->n_patterns; i++) {
7478                 nl_pat = nla_nest_start(msg, i + 1);
7479                 if (!nl_pat)
7480                         return -ENOBUFS;
7481                 pat_len = rdev->wowlan->patterns[i].pattern_len;
7482                 if (nla_put(msg, NL80211_WOWLAN_PKTPAT_MASK,
7483                             DIV_ROUND_UP(pat_len, 8),
7484                             rdev->wowlan->patterns[i].mask) ||
7485                     nla_put(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
7486                             pat_len, rdev->wowlan->patterns[i].pattern) ||
7487                     nla_put_u32(msg, NL80211_WOWLAN_PKTPAT_OFFSET,
7488                                 rdev->wowlan->patterns[i].pkt_offset))
7489                         return -ENOBUFS;
7490                 nla_nest_end(msg, nl_pat);
7491         }
7492         nla_nest_end(msg, nl_pats);
7493
7494         return 0;
7495 }
7496
7497 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
7498                                    struct cfg80211_wowlan_tcp *tcp)
7499 {
7500         struct nlattr *nl_tcp;
7501
7502         if (!tcp)
7503                 return 0;
7504
7505         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
7506         if (!nl_tcp)
7507                 return -ENOBUFS;
7508
7509         if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
7510             nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
7511             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
7512             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
7513             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
7514             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
7515                     tcp->payload_len, tcp->payload) ||
7516             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
7517                         tcp->data_interval) ||
7518             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
7519                     tcp->wake_len, tcp->wake_data) ||
7520             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
7521                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
7522                 return -ENOBUFS;
7523
7524         if (tcp->payload_seq.len &&
7525             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
7526                     sizeof(tcp->payload_seq), &tcp->payload_seq))
7527                 return -ENOBUFS;
7528
7529         if (tcp->payload_tok.len &&
7530             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
7531                     sizeof(tcp->payload_tok) + tcp->tokens_size,
7532                     &tcp->payload_tok))
7533                 return -ENOBUFS;
7534
7535         return 0;
7536 }
7537
7538 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
7539 {
7540         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7541         struct sk_buff *msg;
7542         void *hdr;
7543         u32 size = NLMSG_DEFAULT_SIZE;
7544
7545         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns &&
7546             !rdev->wiphy.wowlan.tcp)
7547                 return -EOPNOTSUPP;
7548
7549         if (rdev->wowlan && rdev->wowlan->tcp) {
7550                 /* adjust size to have room for all the data */
7551                 size += rdev->wowlan->tcp->tokens_size +
7552                         rdev->wowlan->tcp->payload_len +
7553                         rdev->wowlan->tcp->wake_len +
7554                         rdev->wowlan->tcp->wake_len / 8;
7555         }
7556
7557         msg = nlmsg_new(size, GFP_KERNEL);
7558         if (!msg)
7559                 return -ENOMEM;
7560
7561         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7562                              NL80211_CMD_GET_WOWLAN);
7563         if (!hdr)
7564                 goto nla_put_failure;
7565
7566         if (rdev->wowlan) {
7567                 struct nlattr *nl_wowlan;
7568
7569                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
7570                 if (!nl_wowlan)
7571                         goto nla_put_failure;
7572
7573                 if ((rdev->wowlan->any &&
7574                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
7575                     (rdev->wowlan->disconnect &&
7576                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
7577                     (rdev->wowlan->magic_pkt &&
7578                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
7579                     (rdev->wowlan->gtk_rekey_failure &&
7580                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
7581                     (rdev->wowlan->eap_identity_req &&
7582                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
7583                     (rdev->wowlan->four_way_handshake &&
7584                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
7585                     (rdev->wowlan->rfkill_release &&
7586                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
7587                         goto nla_put_failure;
7588
7589                 if (nl80211_send_wowlan_patterns(msg, rdev))
7590                         goto nla_put_failure;
7591
7592                 if (nl80211_send_wowlan_tcp(msg, rdev->wowlan->tcp))
7593                         goto nla_put_failure;
7594
7595                 nla_nest_end(msg, nl_wowlan);
7596         }
7597
7598         genlmsg_end(msg, hdr);
7599         return genlmsg_reply(msg, info);
7600
7601 nla_put_failure:
7602         nlmsg_free(msg);
7603         return -ENOBUFS;
7604 }
7605
7606 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
7607                                     struct nlattr *attr,
7608                                     struct cfg80211_wowlan *trig)
7609 {
7610         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
7611         struct cfg80211_wowlan_tcp *cfg;
7612         struct nl80211_wowlan_tcp_data_token *tok = NULL;
7613         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
7614         u32 size;
7615         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
7616         int err, port;
7617
7618         if (!rdev->wiphy.wowlan.tcp)
7619                 return -EINVAL;
7620
7621         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
7622                         nla_data(attr), nla_len(attr),
7623                         nl80211_wowlan_tcp_policy);
7624         if (err)
7625                 return err;
7626
7627         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
7628             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
7629             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
7630             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
7631             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
7632             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
7633             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
7634             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
7635                 return -EINVAL;
7636
7637         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
7638         if (data_size > rdev->wiphy.wowlan.tcp->data_payload_max)
7639                 return -EINVAL;
7640
7641         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
7642                         rdev->wiphy.wowlan.tcp->data_interval_max ||
7643             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
7644                 return -EINVAL;
7645
7646         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
7647         if (wake_size > rdev->wiphy.wowlan.tcp->wake_payload_max)
7648                 return -EINVAL;
7649
7650         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
7651         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
7652                 return -EINVAL;
7653
7654         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
7655                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
7656
7657                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
7658                 tokens_size = tokln - sizeof(*tok);
7659
7660                 if (!tok->len || tokens_size % tok->len)
7661                         return -EINVAL;
7662                 if (!rdev->wiphy.wowlan.tcp->tok)
7663                         return -EINVAL;
7664                 if (tok->len > rdev->wiphy.wowlan.tcp->tok->max_len)
7665                         return -EINVAL;
7666                 if (tok->len < rdev->wiphy.wowlan.tcp->tok->min_len)
7667                         return -EINVAL;
7668                 if (tokens_size > rdev->wiphy.wowlan.tcp->tok->bufsize)
7669                         return -EINVAL;
7670                 if (tok->offset + tok->len > data_size)
7671                         return -EINVAL;
7672         }
7673
7674         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
7675                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
7676                 if (!rdev->wiphy.wowlan.tcp->seq)
7677                         return -EINVAL;
7678                 if (seq->len == 0 || seq->len > 4)
7679                         return -EINVAL;
7680                 if (seq->len + seq->offset > data_size)
7681                         return -EINVAL;
7682         }
7683
7684         size = sizeof(*cfg);
7685         size += data_size;
7686         size += wake_size + wake_mask_size;
7687         size += tokens_size;
7688
7689         cfg = kzalloc(size, GFP_KERNEL);
7690         if (!cfg)
7691                 return -ENOMEM;
7692         cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
7693         cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
7694         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
7695                ETH_ALEN);
7696         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
7697                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
7698         else
7699                 port = 0;
7700 #ifdef CONFIG_INET
7701         /* allocate a socket and port for it and use it */
7702         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
7703                             IPPROTO_TCP, &cfg->sock, 1);
7704         if (err) {
7705                 kfree(cfg);
7706                 return err;
7707         }
7708         if (inet_csk_get_port(cfg->sock->sk, port)) {
7709                 sock_release(cfg->sock);
7710                 kfree(cfg);
7711                 return -EADDRINUSE;
7712         }
7713         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
7714 #else
7715         if (!port) {
7716                 kfree(cfg);
7717                 return -EINVAL;
7718         }
7719         cfg->src_port = port;
7720 #endif
7721
7722         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
7723         cfg->payload_len = data_size;
7724         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
7725         memcpy((void *)cfg->payload,
7726                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
7727                data_size);
7728         if (seq)
7729                 cfg->payload_seq = *seq;
7730         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
7731         cfg->wake_len = wake_size;
7732         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
7733         memcpy((void *)cfg->wake_data,
7734                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
7735                wake_size);
7736         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
7737                          data_size + wake_size;
7738         memcpy((void *)cfg->wake_mask,
7739                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
7740                wake_mask_size);
7741         if (tok) {
7742                 cfg->tokens_size = tokens_size;
7743                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
7744         }
7745
7746         trig->tcp = cfg;
7747
7748         return 0;
7749 }
7750
7751 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
7752 {
7753         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7754         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
7755         struct cfg80211_wowlan new_triggers = {};
7756         struct cfg80211_wowlan *ntrig;
7757         struct wiphy_wowlan_support *wowlan = &rdev->wiphy.wowlan;
7758         int err, i;
7759         bool prev_enabled = rdev->wowlan;
7760
7761         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns &&
7762             !rdev->wiphy.wowlan.tcp)
7763                 return -EOPNOTSUPP;
7764
7765         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
7766                 cfg80211_rdev_free_wowlan(rdev);
7767                 rdev->wowlan = NULL;
7768                 goto set_wakeup;
7769         }
7770
7771         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
7772                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
7773                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
7774                         nl80211_wowlan_policy);
7775         if (err)
7776                 return err;
7777
7778         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
7779                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
7780                         return -EINVAL;
7781                 new_triggers.any = true;
7782         }
7783
7784         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
7785                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
7786                         return -EINVAL;
7787                 new_triggers.disconnect = true;
7788         }
7789
7790         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
7791                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
7792                         return -EINVAL;
7793                 new_triggers.magic_pkt = true;
7794         }
7795
7796         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
7797                 return -EINVAL;
7798
7799         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
7800                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
7801                         return -EINVAL;
7802                 new_triggers.gtk_rekey_failure = true;
7803         }
7804
7805         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
7806                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
7807                         return -EINVAL;
7808                 new_triggers.eap_identity_req = true;
7809         }
7810
7811         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
7812                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
7813                         return -EINVAL;
7814                 new_triggers.four_way_handshake = true;
7815         }
7816
7817         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
7818                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
7819                         return -EINVAL;
7820                 new_triggers.rfkill_release = true;
7821         }
7822
7823         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
7824                 struct nlattr *pat;
7825                 int n_patterns = 0;
7826                 int rem, pat_len, mask_len, pkt_offset;
7827                 struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
7828
7829                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
7830                                     rem)
7831                         n_patterns++;
7832                 if (n_patterns > wowlan->n_patterns)
7833                         return -EINVAL;
7834
7835                 new_triggers.patterns = kcalloc(n_patterns,
7836                                                 sizeof(new_triggers.patterns[0]),
7837                                                 GFP_KERNEL);
7838                 if (!new_triggers.patterns)
7839                         return -ENOMEM;
7840
7841                 new_triggers.n_patterns = n_patterns;
7842                 i = 0;
7843
7844                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
7845                                     rem) {
7846                         nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
7847                                   nla_data(pat), nla_len(pat), NULL);
7848                         err = -EINVAL;
7849                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
7850                             !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
7851                                 goto error;
7852                         pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
7853                         mask_len = DIV_ROUND_UP(pat_len, 8);
7854                         if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
7855                             mask_len)
7856                                 goto error;
7857                         if (pat_len > wowlan->pattern_max_len ||
7858                             pat_len < wowlan->pattern_min_len)
7859                                 goto error;
7860
7861                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET])
7862                                 pkt_offset = 0;
7863                         else
7864                                 pkt_offset = nla_get_u32(
7865                                         pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET]);
7866                         if (pkt_offset > wowlan->max_pkt_offset)
7867                                 goto error;
7868                         new_triggers.patterns[i].pkt_offset = pkt_offset;
7869
7870                         new_triggers.patterns[i].mask =
7871                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
7872                         if (!new_triggers.patterns[i].mask) {
7873                                 err = -ENOMEM;
7874                                 goto error;
7875                         }
7876                         new_triggers.patterns[i].pattern =
7877                                 new_triggers.patterns[i].mask + mask_len;
7878                         memcpy(new_triggers.patterns[i].mask,
7879                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
7880                                mask_len);
7881                         new_triggers.patterns[i].pattern_len = pat_len;
7882                         memcpy(new_triggers.patterns[i].pattern,
7883                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
7884                                pat_len);
7885                         i++;
7886                 }
7887         }
7888
7889         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
7890                 err = nl80211_parse_wowlan_tcp(
7891                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
7892                         &new_triggers);
7893                 if (err)
7894                         goto error;
7895         }
7896
7897         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
7898         if (!ntrig) {
7899                 err = -ENOMEM;
7900                 goto error;
7901         }
7902         cfg80211_rdev_free_wowlan(rdev);
7903         rdev->wowlan = ntrig;
7904
7905  set_wakeup:
7906         if (rdev->ops->set_wakeup && prev_enabled != !!rdev->wowlan)
7907                 rdev_set_wakeup(rdev, rdev->wowlan);
7908
7909         return 0;
7910  error:
7911         for (i = 0; i < new_triggers.n_patterns; i++)
7912                 kfree(new_triggers.patterns[i].mask);
7913         kfree(new_triggers.patterns);
7914         if (new_triggers.tcp && new_triggers.tcp->sock)
7915                 sock_release(new_triggers.tcp->sock);
7916         kfree(new_triggers.tcp);
7917         return err;
7918 }
7919 #endif
7920
7921 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
7922 {
7923         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7924         struct net_device *dev = info->user_ptr[1];
7925         struct wireless_dev *wdev = dev->ieee80211_ptr;
7926         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
7927         struct cfg80211_gtk_rekey_data rekey_data;
7928         int err;
7929
7930         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
7931                 return -EINVAL;
7932
7933         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
7934                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
7935                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
7936                         nl80211_rekey_policy);
7937         if (err)
7938                 return err;
7939
7940         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
7941                 return -ERANGE;
7942         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
7943                 return -ERANGE;
7944         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
7945                 return -ERANGE;
7946
7947         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
7948                NL80211_KEK_LEN);
7949         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
7950                NL80211_KCK_LEN);
7951         memcpy(rekey_data.replay_ctr,
7952                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
7953                NL80211_REPLAY_CTR_LEN);
7954
7955         wdev_lock(wdev);
7956         if (!wdev->current_bss) {
7957                 err = -ENOTCONN;
7958                 goto out;
7959         }
7960
7961         if (!rdev->ops->set_rekey_data) {
7962                 err = -EOPNOTSUPP;
7963                 goto out;
7964         }
7965
7966         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
7967  out:
7968         wdev_unlock(wdev);
7969         return err;
7970 }
7971
7972 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
7973                                              struct genl_info *info)
7974 {
7975         struct net_device *dev = info->user_ptr[1];
7976         struct wireless_dev *wdev = dev->ieee80211_ptr;
7977
7978         if (wdev->iftype != NL80211_IFTYPE_AP &&
7979             wdev->iftype != NL80211_IFTYPE_P2P_GO)
7980                 return -EINVAL;
7981
7982         if (wdev->ap_unexpected_nlportid)
7983                 return -EBUSY;
7984
7985         wdev->ap_unexpected_nlportid = info->snd_portid;
7986         return 0;
7987 }
7988
7989 static int nl80211_probe_client(struct sk_buff *skb,
7990                                 struct genl_info *info)
7991 {
7992         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7993         struct net_device *dev = info->user_ptr[1];
7994         struct wireless_dev *wdev = dev->ieee80211_ptr;
7995         struct sk_buff *msg;
7996         void *hdr;
7997         const u8 *addr;
7998         u64 cookie;
7999         int err;
8000
8001         if (wdev->iftype != NL80211_IFTYPE_AP &&
8002             wdev->iftype != NL80211_IFTYPE_P2P_GO)
8003                 return -EOPNOTSUPP;
8004
8005         if (!info->attrs[NL80211_ATTR_MAC])
8006                 return -EINVAL;
8007
8008         if (!rdev->ops->probe_client)
8009                 return -EOPNOTSUPP;
8010
8011         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8012         if (!msg)
8013                 return -ENOMEM;
8014
8015         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8016                              NL80211_CMD_PROBE_CLIENT);
8017
8018         if (IS_ERR(hdr)) {
8019                 err = PTR_ERR(hdr);
8020                 goto free_msg;
8021         }
8022
8023         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
8024
8025         err = rdev_probe_client(rdev, dev, addr, &cookie);
8026         if (err)
8027                 goto free_msg;
8028
8029         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8030                 goto nla_put_failure;
8031
8032         genlmsg_end(msg, hdr);
8033
8034         return genlmsg_reply(msg, info);
8035
8036  nla_put_failure:
8037         err = -ENOBUFS;
8038  free_msg:
8039         nlmsg_free(msg);
8040         return err;
8041 }
8042
8043 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
8044 {
8045         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8046         struct cfg80211_beacon_registration *reg, *nreg;
8047         int rv;
8048
8049         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
8050                 return -EOPNOTSUPP;
8051
8052         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
8053         if (!nreg)
8054                 return -ENOMEM;
8055
8056         /* First, check if already registered. */
8057         spin_lock_bh(&rdev->beacon_registrations_lock);
8058         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
8059                 if (reg->nlportid == info->snd_portid) {
8060                         rv = -EALREADY;
8061                         goto out_err;
8062                 }
8063         }
8064         /* Add it to the list */
8065         nreg->nlportid = info->snd_portid;
8066         list_add(&nreg->list, &rdev->beacon_registrations);
8067
8068         spin_unlock_bh(&rdev->beacon_registrations_lock);
8069
8070         return 0;
8071 out_err:
8072         spin_unlock_bh(&rdev->beacon_registrations_lock);
8073         kfree(nreg);
8074         return rv;
8075 }
8076
8077 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
8078 {
8079         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8080         struct wireless_dev *wdev = info->user_ptr[1];
8081         int err;
8082
8083         if (!rdev->ops->start_p2p_device)
8084                 return -EOPNOTSUPP;
8085
8086         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
8087                 return -EOPNOTSUPP;
8088
8089         if (wdev->p2p_started)
8090                 return 0;
8091
8092         mutex_lock(&rdev->devlist_mtx);
8093         err = cfg80211_can_add_interface(rdev, wdev->iftype);
8094         mutex_unlock(&rdev->devlist_mtx);
8095         if (err)
8096                 return err;
8097
8098         err = rdev_start_p2p_device(rdev, wdev);
8099         if (err)
8100                 return err;
8101
8102         wdev->p2p_started = true;
8103         mutex_lock(&rdev->devlist_mtx);
8104         rdev->opencount++;
8105         mutex_unlock(&rdev->devlist_mtx);
8106
8107         return 0;
8108 }
8109
8110 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
8111 {
8112         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8113         struct wireless_dev *wdev = info->user_ptr[1];
8114
8115         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
8116                 return -EOPNOTSUPP;
8117
8118         if (!rdev->ops->stop_p2p_device)
8119                 return -EOPNOTSUPP;
8120
8121         if (!wdev->p2p_started)
8122                 return 0;
8123
8124         rdev_stop_p2p_device(rdev, wdev);
8125         wdev->p2p_started = false;
8126
8127         mutex_lock(&rdev->devlist_mtx);
8128         rdev->opencount--;
8129         mutex_unlock(&rdev->devlist_mtx);
8130
8131         if (WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev)) {
8132                 rdev->scan_req->aborted = true;
8133                 ___cfg80211_scan_done(rdev, true);
8134         }
8135
8136         return 0;
8137 }
8138
8139 static int nl80211_get_protocol_features(struct sk_buff *skb,
8140                                          struct genl_info *info)
8141 {
8142         void *hdr;
8143         struct sk_buff *msg;
8144
8145         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8146         if (!msg)
8147                 return -ENOMEM;
8148
8149         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8150                              NL80211_CMD_GET_PROTOCOL_FEATURES);
8151         if (!hdr)
8152                 goto nla_put_failure;
8153
8154         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
8155                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
8156                 goto nla_put_failure;
8157
8158         genlmsg_end(msg, hdr);
8159         return genlmsg_reply(msg, info);
8160
8161  nla_put_failure:
8162         kfree_skb(msg);
8163         return -ENOBUFS;
8164 }
8165
8166 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
8167 {
8168         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8169         struct cfg80211_update_ft_ies_params ft_params;
8170         struct net_device *dev = info->user_ptr[1];
8171
8172         if (!rdev->ops->update_ft_ies)
8173                 return -EOPNOTSUPP;
8174
8175         if (!info->attrs[NL80211_ATTR_MDID] ||
8176             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8177                 return -EINVAL;
8178
8179         memset(&ft_params, 0, sizeof(ft_params));
8180         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
8181         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8182         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8183
8184         return rdev_update_ft_ies(rdev, dev, &ft_params);
8185 }
8186
8187 #define NL80211_FLAG_NEED_WIPHY         0x01
8188 #define NL80211_FLAG_NEED_NETDEV        0x02
8189 #define NL80211_FLAG_NEED_RTNL          0x04
8190 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
8191 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
8192                                          NL80211_FLAG_CHECK_NETDEV_UP)
8193 #define NL80211_FLAG_NEED_WDEV          0x10
8194 /* If a netdev is associated, it must be UP, P2P must be started */
8195 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
8196                                          NL80211_FLAG_CHECK_NETDEV_UP)
8197
8198 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
8199                             struct genl_info *info)
8200 {
8201         struct cfg80211_registered_device *rdev;
8202         struct wireless_dev *wdev;
8203         struct net_device *dev;
8204         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
8205
8206         if (rtnl)
8207                 rtnl_lock();
8208
8209         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
8210                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
8211                 if (IS_ERR(rdev)) {
8212                         if (rtnl)
8213                                 rtnl_unlock();
8214                         return PTR_ERR(rdev);
8215                 }
8216                 info->user_ptr[0] = rdev;
8217         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
8218                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
8219                 mutex_lock(&cfg80211_mutex);
8220                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
8221                                                   info->attrs);
8222                 if (IS_ERR(wdev)) {
8223                         mutex_unlock(&cfg80211_mutex);
8224                         if (rtnl)
8225                                 rtnl_unlock();
8226                         return PTR_ERR(wdev);
8227                 }
8228
8229                 dev = wdev->netdev;
8230                 rdev = wiphy_to_dev(wdev->wiphy);
8231
8232                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
8233                         if (!dev) {
8234                                 mutex_unlock(&cfg80211_mutex);
8235                                 if (rtnl)
8236                                         rtnl_unlock();
8237                                 return -EINVAL;
8238                         }
8239
8240                         info->user_ptr[1] = dev;
8241                 } else {
8242                         info->user_ptr[1] = wdev;
8243                 }
8244
8245                 if (dev) {
8246                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
8247                             !netif_running(dev)) {
8248                                 mutex_unlock(&cfg80211_mutex);
8249                                 if (rtnl)
8250                                         rtnl_unlock();
8251                                 return -ENETDOWN;
8252                         }
8253
8254                         dev_hold(dev);
8255                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
8256                         if (!wdev->p2p_started) {
8257                                 mutex_unlock(&cfg80211_mutex);
8258                                 if (rtnl)
8259                                         rtnl_unlock();
8260                                 return -ENETDOWN;
8261                         }
8262                 }
8263
8264                 cfg80211_lock_rdev(rdev);
8265
8266                 mutex_unlock(&cfg80211_mutex);
8267
8268                 info->user_ptr[0] = rdev;
8269         }
8270
8271         return 0;
8272 }
8273
8274 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
8275                               struct genl_info *info)
8276 {
8277         if (info->user_ptr[0])
8278                 cfg80211_unlock_rdev(info->user_ptr[0]);
8279         if (info->user_ptr[1]) {
8280                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
8281                         struct wireless_dev *wdev = info->user_ptr[1];
8282
8283                         if (wdev->netdev)
8284                                 dev_put(wdev->netdev);
8285                 } else {
8286                         dev_put(info->user_ptr[1]);
8287                 }
8288         }
8289         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
8290                 rtnl_unlock();
8291 }
8292
8293 static struct genl_ops nl80211_ops[] = {
8294         {
8295                 .cmd = NL80211_CMD_GET_WIPHY,
8296                 .doit = nl80211_get_wiphy,
8297                 .dumpit = nl80211_dump_wiphy,
8298                 .policy = nl80211_policy,
8299                 /* can be retrieved by unprivileged users */
8300                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
8301         },
8302         {
8303                 .cmd = NL80211_CMD_SET_WIPHY,
8304                 .doit = nl80211_set_wiphy,
8305                 .policy = nl80211_policy,
8306                 .flags = GENL_ADMIN_PERM,
8307                 .internal_flags = NL80211_FLAG_NEED_RTNL,
8308         },
8309         {
8310                 .cmd = NL80211_CMD_GET_INTERFACE,
8311                 .doit = nl80211_get_interface,
8312                 .dumpit = nl80211_dump_interface,
8313                 .policy = nl80211_policy,
8314                 /* can be retrieved by unprivileged users */
8315                 .internal_flags = NL80211_FLAG_NEED_WDEV,
8316         },
8317         {
8318                 .cmd = NL80211_CMD_SET_INTERFACE,
8319                 .doit = nl80211_set_interface,
8320                 .policy = nl80211_policy,
8321                 .flags = GENL_ADMIN_PERM,
8322                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8323                                   NL80211_FLAG_NEED_RTNL,
8324         },
8325         {
8326                 .cmd = NL80211_CMD_NEW_INTERFACE,
8327                 .doit = nl80211_new_interface,
8328                 .policy = nl80211_policy,
8329                 .flags = GENL_ADMIN_PERM,
8330                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8331                                   NL80211_FLAG_NEED_RTNL,
8332         },
8333         {
8334                 .cmd = NL80211_CMD_DEL_INTERFACE,
8335                 .doit = nl80211_del_interface,
8336                 .policy = nl80211_policy,
8337                 .flags = GENL_ADMIN_PERM,
8338                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8339                                   NL80211_FLAG_NEED_RTNL,
8340         },
8341         {
8342                 .cmd = NL80211_CMD_GET_KEY,
8343                 .doit = nl80211_get_key,
8344                 .policy = nl80211_policy,
8345                 .flags = GENL_ADMIN_PERM,
8346                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8347                                   NL80211_FLAG_NEED_RTNL,
8348         },
8349         {
8350                 .cmd = NL80211_CMD_SET_KEY,
8351                 .doit = nl80211_set_key,
8352                 .policy = nl80211_policy,
8353                 .flags = GENL_ADMIN_PERM,
8354                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8355                                   NL80211_FLAG_NEED_RTNL,
8356         },
8357         {
8358                 .cmd = NL80211_CMD_NEW_KEY,
8359                 .doit = nl80211_new_key,
8360                 .policy = nl80211_policy,
8361                 .flags = GENL_ADMIN_PERM,
8362                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8363                                   NL80211_FLAG_NEED_RTNL,
8364         },
8365         {
8366                 .cmd = NL80211_CMD_DEL_KEY,
8367                 .doit = nl80211_del_key,
8368                 .policy = nl80211_policy,
8369                 .flags = GENL_ADMIN_PERM,
8370                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8371                                   NL80211_FLAG_NEED_RTNL,
8372         },
8373         {
8374                 .cmd = NL80211_CMD_SET_BEACON,
8375                 .policy = nl80211_policy,
8376                 .flags = GENL_ADMIN_PERM,
8377                 .doit = nl80211_set_beacon,
8378                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8379                                   NL80211_FLAG_NEED_RTNL,
8380         },
8381         {
8382                 .cmd = NL80211_CMD_START_AP,
8383                 .policy = nl80211_policy,
8384                 .flags = GENL_ADMIN_PERM,
8385                 .doit = nl80211_start_ap,
8386                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8387                                   NL80211_FLAG_NEED_RTNL,
8388         },
8389         {
8390                 .cmd = NL80211_CMD_STOP_AP,
8391                 .policy = nl80211_policy,
8392                 .flags = GENL_ADMIN_PERM,
8393                 .doit = nl80211_stop_ap,
8394                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8395                                   NL80211_FLAG_NEED_RTNL,
8396         },
8397         {
8398                 .cmd = NL80211_CMD_GET_STATION,
8399                 .doit = nl80211_get_station,
8400                 .dumpit = nl80211_dump_station,
8401                 .policy = nl80211_policy,
8402                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8403                                   NL80211_FLAG_NEED_RTNL,
8404         },
8405         {
8406                 .cmd = NL80211_CMD_SET_STATION,
8407                 .doit = nl80211_set_station,
8408                 .policy = nl80211_policy,
8409                 .flags = GENL_ADMIN_PERM,
8410                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8411                                   NL80211_FLAG_NEED_RTNL,
8412         },
8413         {
8414                 .cmd = NL80211_CMD_NEW_STATION,
8415                 .doit = nl80211_new_station,
8416                 .policy = nl80211_policy,
8417                 .flags = GENL_ADMIN_PERM,
8418                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8419                                   NL80211_FLAG_NEED_RTNL,
8420         },
8421         {
8422                 .cmd = NL80211_CMD_DEL_STATION,
8423                 .doit = nl80211_del_station,
8424                 .policy = nl80211_policy,
8425                 .flags = GENL_ADMIN_PERM,
8426                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8427                                   NL80211_FLAG_NEED_RTNL,
8428         },
8429         {
8430                 .cmd = NL80211_CMD_GET_MPATH,
8431                 .doit = nl80211_get_mpath,
8432                 .dumpit = nl80211_dump_mpath,
8433                 .policy = nl80211_policy,
8434                 .flags = GENL_ADMIN_PERM,
8435                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8436                                   NL80211_FLAG_NEED_RTNL,
8437         },
8438         {
8439                 .cmd = NL80211_CMD_SET_MPATH,
8440                 .doit = nl80211_set_mpath,
8441                 .policy = nl80211_policy,
8442                 .flags = GENL_ADMIN_PERM,
8443                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8444                                   NL80211_FLAG_NEED_RTNL,
8445         },
8446         {
8447                 .cmd = NL80211_CMD_NEW_MPATH,
8448                 .doit = nl80211_new_mpath,
8449                 .policy = nl80211_policy,
8450                 .flags = GENL_ADMIN_PERM,
8451                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8452                                   NL80211_FLAG_NEED_RTNL,
8453         },
8454         {
8455                 .cmd = NL80211_CMD_DEL_MPATH,
8456                 .doit = nl80211_del_mpath,
8457                 .policy = nl80211_policy,
8458                 .flags = GENL_ADMIN_PERM,
8459                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8460                                   NL80211_FLAG_NEED_RTNL,
8461         },
8462         {
8463                 .cmd = NL80211_CMD_SET_BSS,
8464                 .doit = nl80211_set_bss,
8465                 .policy = nl80211_policy,
8466                 .flags = GENL_ADMIN_PERM,
8467                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8468                                   NL80211_FLAG_NEED_RTNL,
8469         },
8470         {
8471                 .cmd = NL80211_CMD_GET_REG,
8472                 .doit = nl80211_get_reg,
8473                 .policy = nl80211_policy,
8474                 /* can be retrieved by unprivileged users */
8475         },
8476         {
8477                 .cmd = NL80211_CMD_SET_REG,
8478                 .doit = nl80211_set_reg,
8479                 .policy = nl80211_policy,
8480                 .flags = GENL_ADMIN_PERM,
8481         },
8482         {
8483                 .cmd = NL80211_CMD_REQ_SET_REG,
8484                 .doit = nl80211_req_set_reg,
8485                 .policy = nl80211_policy,
8486                 .flags = GENL_ADMIN_PERM,
8487         },
8488         {
8489                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
8490                 .doit = nl80211_get_mesh_config,
8491                 .policy = nl80211_policy,
8492                 /* can be retrieved by unprivileged users */
8493                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8494                                   NL80211_FLAG_NEED_RTNL,
8495         },
8496         {
8497                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
8498                 .doit = nl80211_update_mesh_config,
8499                 .policy = nl80211_policy,
8500                 .flags = GENL_ADMIN_PERM,
8501                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8502                                   NL80211_FLAG_NEED_RTNL,
8503         },
8504         {
8505                 .cmd = NL80211_CMD_TRIGGER_SCAN,
8506                 .doit = nl80211_trigger_scan,
8507                 .policy = nl80211_policy,
8508                 .flags = GENL_ADMIN_PERM,
8509                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8510                                   NL80211_FLAG_NEED_RTNL,
8511         },
8512         {
8513                 .cmd = NL80211_CMD_GET_SCAN,
8514                 .policy = nl80211_policy,
8515                 .dumpit = nl80211_dump_scan,
8516         },
8517         {
8518                 .cmd = NL80211_CMD_START_SCHED_SCAN,
8519                 .doit = nl80211_start_sched_scan,
8520                 .policy = nl80211_policy,
8521                 .flags = GENL_ADMIN_PERM,
8522                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8523                                   NL80211_FLAG_NEED_RTNL,
8524         },
8525         {
8526                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
8527                 .doit = nl80211_stop_sched_scan,
8528                 .policy = nl80211_policy,
8529                 .flags = GENL_ADMIN_PERM,
8530                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8531                                   NL80211_FLAG_NEED_RTNL,
8532         },
8533         {
8534                 .cmd = NL80211_CMD_AUTHENTICATE,
8535                 .doit = nl80211_authenticate,
8536                 .policy = nl80211_policy,
8537                 .flags = GENL_ADMIN_PERM,
8538                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8539                                   NL80211_FLAG_NEED_RTNL,
8540         },
8541         {
8542                 .cmd = NL80211_CMD_ASSOCIATE,
8543                 .doit = nl80211_associate,
8544                 .policy = nl80211_policy,
8545                 .flags = GENL_ADMIN_PERM,
8546                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8547                                   NL80211_FLAG_NEED_RTNL,
8548         },
8549         {
8550                 .cmd = NL80211_CMD_DEAUTHENTICATE,
8551                 .doit = nl80211_deauthenticate,
8552                 .policy = nl80211_policy,
8553                 .flags = GENL_ADMIN_PERM,
8554                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8555                                   NL80211_FLAG_NEED_RTNL,
8556         },
8557         {
8558                 .cmd = NL80211_CMD_DISASSOCIATE,
8559                 .doit = nl80211_disassociate,
8560                 .policy = nl80211_policy,
8561                 .flags = GENL_ADMIN_PERM,
8562                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8563                                   NL80211_FLAG_NEED_RTNL,
8564         },
8565         {
8566                 .cmd = NL80211_CMD_JOIN_IBSS,
8567                 .doit = nl80211_join_ibss,
8568                 .policy = nl80211_policy,
8569                 .flags = GENL_ADMIN_PERM,
8570                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8571                                   NL80211_FLAG_NEED_RTNL,
8572         },
8573         {
8574                 .cmd = NL80211_CMD_LEAVE_IBSS,
8575                 .doit = nl80211_leave_ibss,
8576                 .policy = nl80211_policy,
8577                 .flags = GENL_ADMIN_PERM,
8578                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8579                                   NL80211_FLAG_NEED_RTNL,
8580         },
8581 #ifdef CONFIG_NL80211_TESTMODE
8582         {
8583                 .cmd = NL80211_CMD_TESTMODE,
8584                 .doit = nl80211_testmode_do,
8585                 .dumpit = nl80211_testmode_dump,
8586                 .policy = nl80211_policy,
8587                 .flags = GENL_ADMIN_PERM,
8588                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8589                                   NL80211_FLAG_NEED_RTNL,
8590         },
8591 #endif
8592         {
8593                 .cmd = NL80211_CMD_CONNECT,
8594                 .doit = nl80211_connect,
8595                 .policy = nl80211_policy,
8596                 .flags = GENL_ADMIN_PERM,
8597                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8598                                   NL80211_FLAG_NEED_RTNL,
8599         },
8600         {
8601                 .cmd = NL80211_CMD_DISCONNECT,
8602                 .doit = nl80211_disconnect,
8603                 .policy = nl80211_policy,
8604                 .flags = GENL_ADMIN_PERM,
8605                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8606                                   NL80211_FLAG_NEED_RTNL,
8607         },
8608         {
8609                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
8610                 .doit = nl80211_wiphy_netns,
8611                 .policy = nl80211_policy,
8612                 .flags = GENL_ADMIN_PERM,
8613                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8614                                   NL80211_FLAG_NEED_RTNL,
8615         },
8616         {
8617                 .cmd = NL80211_CMD_GET_SURVEY,
8618                 .policy = nl80211_policy,
8619                 .dumpit = nl80211_dump_survey,
8620         },
8621         {
8622                 .cmd = NL80211_CMD_SET_PMKSA,
8623                 .doit = nl80211_setdel_pmksa,
8624                 .policy = nl80211_policy,
8625                 .flags = GENL_ADMIN_PERM,
8626                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8627                                   NL80211_FLAG_NEED_RTNL,
8628         },
8629         {
8630                 .cmd = NL80211_CMD_DEL_PMKSA,
8631                 .doit = nl80211_setdel_pmksa,
8632                 .policy = nl80211_policy,
8633                 .flags = GENL_ADMIN_PERM,
8634                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8635                                   NL80211_FLAG_NEED_RTNL,
8636         },
8637         {
8638                 .cmd = NL80211_CMD_FLUSH_PMKSA,
8639                 .doit = nl80211_flush_pmksa,
8640                 .policy = nl80211_policy,
8641                 .flags = GENL_ADMIN_PERM,
8642                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8643                                   NL80211_FLAG_NEED_RTNL,
8644         },
8645         {
8646                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
8647                 .doit = nl80211_remain_on_channel,
8648                 .policy = nl80211_policy,
8649                 .flags = GENL_ADMIN_PERM,
8650                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8651                                   NL80211_FLAG_NEED_RTNL,
8652         },
8653         {
8654                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
8655                 .doit = nl80211_cancel_remain_on_channel,
8656                 .policy = nl80211_policy,
8657                 .flags = GENL_ADMIN_PERM,
8658                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8659                                   NL80211_FLAG_NEED_RTNL,
8660         },
8661         {
8662                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
8663                 .doit = nl80211_set_tx_bitrate_mask,
8664                 .policy = nl80211_policy,
8665                 .flags = GENL_ADMIN_PERM,
8666                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8667                                   NL80211_FLAG_NEED_RTNL,
8668         },
8669         {
8670                 .cmd = NL80211_CMD_REGISTER_FRAME,
8671                 .doit = nl80211_register_mgmt,
8672                 .policy = nl80211_policy,
8673                 .flags = GENL_ADMIN_PERM,
8674                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8675                                   NL80211_FLAG_NEED_RTNL,
8676         },
8677         {
8678                 .cmd = NL80211_CMD_FRAME,
8679                 .doit = nl80211_tx_mgmt,
8680                 .policy = nl80211_policy,
8681                 .flags = GENL_ADMIN_PERM,
8682                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8683                                   NL80211_FLAG_NEED_RTNL,
8684         },
8685         {
8686                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
8687                 .doit = nl80211_tx_mgmt_cancel_wait,
8688                 .policy = nl80211_policy,
8689                 .flags = GENL_ADMIN_PERM,
8690                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8691                                   NL80211_FLAG_NEED_RTNL,
8692         },
8693         {
8694                 .cmd = NL80211_CMD_SET_POWER_SAVE,
8695                 .doit = nl80211_set_power_save,
8696                 .policy = nl80211_policy,
8697                 .flags = GENL_ADMIN_PERM,
8698                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8699                                   NL80211_FLAG_NEED_RTNL,
8700         },
8701         {
8702                 .cmd = NL80211_CMD_GET_POWER_SAVE,
8703                 .doit = nl80211_get_power_save,
8704                 .policy = nl80211_policy,
8705                 /* can be retrieved by unprivileged users */
8706                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8707                                   NL80211_FLAG_NEED_RTNL,
8708         },
8709         {
8710                 .cmd = NL80211_CMD_SET_CQM,
8711                 .doit = nl80211_set_cqm,
8712                 .policy = nl80211_policy,
8713                 .flags = GENL_ADMIN_PERM,
8714                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8715                                   NL80211_FLAG_NEED_RTNL,
8716         },
8717         {
8718                 .cmd = NL80211_CMD_SET_CHANNEL,
8719                 .doit = nl80211_set_channel,
8720                 .policy = nl80211_policy,
8721                 .flags = GENL_ADMIN_PERM,
8722                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8723                                   NL80211_FLAG_NEED_RTNL,
8724         },
8725         {
8726                 .cmd = NL80211_CMD_SET_WDS_PEER,
8727                 .doit = nl80211_set_wds_peer,
8728                 .policy = nl80211_policy,
8729                 .flags = GENL_ADMIN_PERM,
8730                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8731                                   NL80211_FLAG_NEED_RTNL,
8732         },
8733         {
8734                 .cmd = NL80211_CMD_JOIN_MESH,
8735                 .doit = nl80211_join_mesh,
8736                 .policy = nl80211_policy,
8737                 .flags = GENL_ADMIN_PERM,
8738                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8739                                   NL80211_FLAG_NEED_RTNL,
8740         },
8741         {
8742                 .cmd = NL80211_CMD_LEAVE_MESH,
8743                 .doit = nl80211_leave_mesh,
8744                 .policy = nl80211_policy,
8745                 .flags = GENL_ADMIN_PERM,
8746                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8747                                   NL80211_FLAG_NEED_RTNL,
8748         },
8749 #ifdef CONFIG_PM
8750         {
8751                 .cmd = NL80211_CMD_GET_WOWLAN,
8752                 .doit = nl80211_get_wowlan,
8753                 .policy = nl80211_policy,
8754                 /* can be retrieved by unprivileged users */
8755                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8756                                   NL80211_FLAG_NEED_RTNL,
8757         },
8758         {
8759                 .cmd = NL80211_CMD_SET_WOWLAN,
8760                 .doit = nl80211_set_wowlan,
8761                 .policy = nl80211_policy,
8762                 .flags = GENL_ADMIN_PERM,
8763                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8764                                   NL80211_FLAG_NEED_RTNL,
8765         },
8766 #endif
8767         {
8768                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
8769                 .doit = nl80211_set_rekey_data,
8770                 .policy = nl80211_policy,
8771                 .flags = GENL_ADMIN_PERM,
8772                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8773                                   NL80211_FLAG_NEED_RTNL,
8774         },
8775         {
8776                 .cmd = NL80211_CMD_TDLS_MGMT,
8777                 .doit = nl80211_tdls_mgmt,
8778                 .policy = nl80211_policy,
8779                 .flags = GENL_ADMIN_PERM,
8780                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8781                                   NL80211_FLAG_NEED_RTNL,
8782         },
8783         {
8784                 .cmd = NL80211_CMD_TDLS_OPER,
8785                 .doit = nl80211_tdls_oper,
8786                 .policy = nl80211_policy,
8787                 .flags = GENL_ADMIN_PERM,
8788                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8789                                   NL80211_FLAG_NEED_RTNL,
8790         },
8791         {
8792                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
8793                 .doit = nl80211_register_unexpected_frame,
8794                 .policy = nl80211_policy,
8795                 .flags = GENL_ADMIN_PERM,
8796                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8797                                   NL80211_FLAG_NEED_RTNL,
8798         },
8799         {
8800                 .cmd = NL80211_CMD_PROBE_CLIENT,
8801                 .doit = nl80211_probe_client,
8802                 .policy = nl80211_policy,
8803                 .flags = GENL_ADMIN_PERM,
8804                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8805                                   NL80211_FLAG_NEED_RTNL,
8806         },
8807         {
8808                 .cmd = NL80211_CMD_REGISTER_BEACONS,
8809                 .doit = nl80211_register_beacons,
8810                 .policy = nl80211_policy,
8811                 .flags = GENL_ADMIN_PERM,
8812                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8813                                   NL80211_FLAG_NEED_RTNL,
8814         },
8815         {
8816                 .cmd = NL80211_CMD_SET_NOACK_MAP,
8817                 .doit = nl80211_set_noack_map,
8818                 .policy = nl80211_policy,
8819                 .flags = GENL_ADMIN_PERM,
8820                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8821                                   NL80211_FLAG_NEED_RTNL,
8822         },
8823         {
8824                 .cmd = NL80211_CMD_START_P2P_DEVICE,
8825                 .doit = nl80211_start_p2p_device,
8826                 .policy = nl80211_policy,
8827                 .flags = GENL_ADMIN_PERM,
8828                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8829                                   NL80211_FLAG_NEED_RTNL,
8830         },
8831         {
8832                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
8833                 .doit = nl80211_stop_p2p_device,
8834                 .policy = nl80211_policy,
8835                 .flags = GENL_ADMIN_PERM,
8836                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8837                                   NL80211_FLAG_NEED_RTNL,
8838         },
8839         {
8840                 .cmd = NL80211_CMD_SET_MCAST_RATE,
8841                 .doit = nl80211_set_mcast_rate,
8842                 .policy = nl80211_policy,
8843                 .flags = GENL_ADMIN_PERM,
8844                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8845                                   NL80211_FLAG_NEED_RTNL,
8846         },
8847         {
8848                 .cmd = NL80211_CMD_SET_MAC_ACL,
8849                 .doit = nl80211_set_mac_acl,
8850                 .policy = nl80211_policy,
8851                 .flags = GENL_ADMIN_PERM,
8852                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8853                                   NL80211_FLAG_NEED_RTNL,
8854         },
8855         {
8856                 .cmd = NL80211_CMD_RADAR_DETECT,
8857                 .doit = nl80211_start_radar_detection,
8858                 .policy = nl80211_policy,
8859                 .flags = GENL_ADMIN_PERM,
8860                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8861                                   NL80211_FLAG_NEED_RTNL,
8862         },
8863         {
8864                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
8865                 .doit = nl80211_get_protocol_features,
8866                 .policy = nl80211_policy,
8867         },
8868         {
8869                 .cmd = NL80211_CMD_UPDATE_FT_IES,
8870                 .doit = nl80211_update_ft_ies,
8871                 .policy = nl80211_policy,
8872                 .flags = GENL_ADMIN_PERM,
8873                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8874                                   NL80211_FLAG_NEED_RTNL,
8875         },
8876 };
8877
8878 static struct genl_multicast_group nl80211_mlme_mcgrp = {
8879         .name = "mlme",
8880 };
8881
8882 /* multicast groups */
8883 static struct genl_multicast_group nl80211_config_mcgrp = {
8884         .name = "config",
8885 };
8886 static struct genl_multicast_group nl80211_scan_mcgrp = {
8887         .name = "scan",
8888 };
8889 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
8890         .name = "regulatory",
8891 };
8892
8893 /* notification functions */
8894
8895 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
8896 {
8897         struct sk_buff *msg;
8898
8899         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8900         if (!msg)
8901                 return;
8902
8903         if (nl80211_send_wiphy(rdev, msg, 0, 0, 0,
8904                                false, NULL, NULL, NULL) < 0) {
8905                 nlmsg_free(msg);
8906                 return;
8907         }
8908
8909         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8910                                 nl80211_config_mcgrp.id, GFP_KERNEL);
8911 }
8912
8913 static int nl80211_add_scan_req(struct sk_buff *msg,
8914                                 struct cfg80211_registered_device *rdev)
8915 {
8916         struct cfg80211_scan_request *req = rdev->scan_req;
8917         struct nlattr *nest;
8918         int i;
8919
8920         ASSERT_RDEV_LOCK(rdev);
8921
8922         if (WARN_ON(!req))
8923                 return 0;
8924
8925         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
8926         if (!nest)
8927                 goto nla_put_failure;
8928         for (i = 0; i < req->n_ssids; i++) {
8929                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
8930                         goto nla_put_failure;
8931         }
8932         nla_nest_end(msg, nest);
8933
8934         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
8935         if (!nest)
8936                 goto nla_put_failure;
8937         for (i = 0; i < req->n_channels; i++) {
8938                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
8939                         goto nla_put_failure;
8940         }
8941         nla_nest_end(msg, nest);
8942
8943         if (req->ie &&
8944             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
8945                 goto nla_put_failure;
8946
8947         if (req->flags)
8948                 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags);
8949
8950         return 0;
8951  nla_put_failure:
8952         return -ENOBUFS;
8953 }
8954
8955 static int nl80211_send_scan_msg(struct sk_buff *msg,
8956                                  struct cfg80211_registered_device *rdev,
8957                                  struct wireless_dev *wdev,
8958                                  u32 portid, u32 seq, int flags,
8959                                  u32 cmd)
8960 {
8961         void *hdr;
8962
8963         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
8964         if (!hdr)
8965                 return -1;
8966
8967         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8968             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
8969                                          wdev->netdev->ifindex)) ||
8970             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
8971                 goto nla_put_failure;
8972
8973         /* ignore errors and send incomplete event anyway */
8974         nl80211_add_scan_req(msg, rdev);
8975
8976         return genlmsg_end(msg, hdr);
8977
8978  nla_put_failure:
8979         genlmsg_cancel(msg, hdr);
8980         return -EMSGSIZE;
8981 }
8982
8983 static int
8984 nl80211_send_sched_scan_msg(struct sk_buff *msg,
8985                             struct cfg80211_registered_device *rdev,
8986                             struct net_device *netdev,
8987                             u32 portid, u32 seq, int flags, u32 cmd)
8988 {
8989         void *hdr;
8990
8991         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
8992         if (!hdr)
8993                 return -1;
8994
8995         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8996             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
8997                 goto nla_put_failure;
8998
8999         return genlmsg_end(msg, hdr);
9000
9001  nla_put_failure:
9002         genlmsg_cancel(msg, hdr);
9003         return -EMSGSIZE;
9004 }
9005
9006 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
9007                              struct wireless_dev *wdev)
9008 {
9009         struct sk_buff *msg;
9010
9011         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9012         if (!msg)
9013                 return;
9014
9015         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9016                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
9017                 nlmsg_free(msg);
9018                 return;
9019         }
9020
9021         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9022                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9023 }
9024
9025 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
9026                             struct wireless_dev *wdev)
9027 {
9028         struct sk_buff *msg;
9029
9030         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9031         if (!msg)
9032                 return;
9033
9034         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9035                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
9036                 nlmsg_free(msg);
9037                 return;
9038         }
9039
9040         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9041                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9042 }
9043
9044 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
9045                                struct wireless_dev *wdev)
9046 {
9047         struct sk_buff *msg;
9048
9049         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9050         if (!msg)
9051                 return;
9052
9053         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9054                                   NL80211_CMD_SCAN_ABORTED) < 0) {
9055                 nlmsg_free(msg);
9056                 return;
9057         }
9058
9059         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9060                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9061 }
9062
9063 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
9064                                      struct net_device *netdev)
9065 {
9066         struct sk_buff *msg;
9067
9068         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9069         if (!msg)
9070                 return;
9071
9072         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
9073                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
9074                 nlmsg_free(msg);
9075                 return;
9076         }
9077
9078         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9079                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9080 }
9081
9082 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
9083                              struct net_device *netdev, u32 cmd)
9084 {
9085         struct sk_buff *msg;
9086
9087         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9088         if (!msg)
9089                 return;
9090
9091         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
9092                 nlmsg_free(msg);
9093                 return;
9094         }
9095
9096         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9097                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9098 }
9099
9100 /*
9101  * This can happen on global regulatory changes or device specific settings
9102  * based on custom world regulatory domains.
9103  */
9104 void nl80211_send_reg_change_event(struct regulatory_request *request)
9105 {
9106         struct sk_buff *msg;
9107         void *hdr;
9108
9109         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9110         if (!msg)
9111                 return;
9112
9113         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
9114         if (!hdr) {
9115                 nlmsg_free(msg);
9116                 return;
9117         }
9118
9119         /* Userspace can always count this one always being set */
9120         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
9121                 goto nla_put_failure;
9122
9123         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
9124                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9125                                NL80211_REGDOM_TYPE_WORLD))
9126                         goto nla_put_failure;
9127         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
9128                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9129                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
9130                         goto nla_put_failure;
9131         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
9132                    request->intersect) {
9133                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9134                                NL80211_REGDOM_TYPE_INTERSECTION))
9135                         goto nla_put_failure;
9136         } else {
9137                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9138                                NL80211_REGDOM_TYPE_COUNTRY) ||
9139                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
9140                                    request->alpha2))
9141                         goto nla_put_failure;
9142         }
9143
9144         if (request->wiphy_idx != WIPHY_IDX_INVALID &&
9145             nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
9146                 goto nla_put_failure;
9147
9148         genlmsg_end(msg, hdr);
9149
9150         rcu_read_lock();
9151         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
9152                                 GFP_ATOMIC);
9153         rcu_read_unlock();
9154
9155         return;
9156
9157 nla_put_failure:
9158         genlmsg_cancel(msg, hdr);
9159         nlmsg_free(msg);
9160 }
9161
9162 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
9163                                     struct net_device *netdev,
9164                                     const u8 *buf, size_t len,
9165                                     enum nl80211_commands cmd, gfp_t gfp)
9166 {
9167         struct sk_buff *msg;
9168         void *hdr;
9169
9170         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9171         if (!msg)
9172                 return;
9173
9174         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9175         if (!hdr) {
9176                 nlmsg_free(msg);
9177                 return;
9178         }
9179
9180         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9181             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9182             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
9183                 goto nla_put_failure;
9184
9185         genlmsg_end(msg, hdr);
9186
9187         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9188                                 nl80211_mlme_mcgrp.id, gfp);
9189         return;
9190
9191  nla_put_failure:
9192         genlmsg_cancel(msg, hdr);
9193         nlmsg_free(msg);
9194 }
9195
9196 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
9197                           struct net_device *netdev, const u8 *buf,
9198                           size_t len, gfp_t gfp)
9199 {
9200         nl80211_send_mlme_event(rdev, netdev, buf, len,
9201                                 NL80211_CMD_AUTHENTICATE, gfp);
9202 }
9203
9204 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
9205                            struct net_device *netdev, const u8 *buf,
9206                            size_t len, gfp_t gfp)
9207 {
9208         nl80211_send_mlme_event(rdev, netdev, buf, len,
9209                                 NL80211_CMD_ASSOCIATE, gfp);
9210 }
9211
9212 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
9213                          struct net_device *netdev, const u8 *buf,
9214                          size_t len, gfp_t gfp)
9215 {
9216         nl80211_send_mlme_event(rdev, netdev, buf, len,
9217                                 NL80211_CMD_DEAUTHENTICATE, gfp);
9218 }
9219
9220 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
9221                            struct net_device *netdev, const u8 *buf,
9222                            size_t len, gfp_t gfp)
9223 {
9224         nl80211_send_mlme_event(rdev, netdev, buf, len,
9225                                 NL80211_CMD_DISASSOCIATE, gfp);
9226 }
9227
9228 void cfg80211_send_unprot_deauth(struct net_device *dev, const u8 *buf,
9229                                  size_t len)
9230 {
9231         struct wireless_dev *wdev = dev->ieee80211_ptr;
9232         struct wiphy *wiphy = wdev->wiphy;
9233         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9234
9235         trace_cfg80211_send_unprot_deauth(dev);
9236         nl80211_send_mlme_event(rdev, dev, buf, len,
9237                                 NL80211_CMD_UNPROT_DEAUTHENTICATE, GFP_ATOMIC);
9238 }
9239 EXPORT_SYMBOL(cfg80211_send_unprot_deauth);
9240
9241 void cfg80211_send_unprot_disassoc(struct net_device *dev, const u8 *buf,
9242                                    size_t len)
9243 {
9244         struct wireless_dev *wdev = dev->ieee80211_ptr;
9245         struct wiphy *wiphy = wdev->wiphy;
9246         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9247
9248         trace_cfg80211_send_unprot_disassoc(dev);
9249         nl80211_send_mlme_event(rdev, dev, buf, len,
9250                                 NL80211_CMD_UNPROT_DISASSOCIATE, GFP_ATOMIC);
9251 }
9252 EXPORT_SYMBOL(cfg80211_send_unprot_disassoc);
9253
9254 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
9255                                       struct net_device *netdev, int cmd,
9256                                       const u8 *addr, gfp_t gfp)
9257 {
9258         struct sk_buff *msg;
9259         void *hdr;
9260
9261         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9262         if (!msg)
9263                 return;
9264
9265         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9266         if (!hdr) {
9267                 nlmsg_free(msg);
9268                 return;
9269         }
9270
9271         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9272             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9273             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
9274             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
9275                 goto nla_put_failure;
9276
9277         genlmsg_end(msg, hdr);
9278
9279         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9280                                 nl80211_mlme_mcgrp.id, gfp);
9281         return;
9282
9283  nla_put_failure:
9284         genlmsg_cancel(msg, hdr);
9285         nlmsg_free(msg);
9286 }
9287
9288 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
9289                                struct net_device *netdev, const u8 *addr,
9290                                gfp_t gfp)
9291 {
9292         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
9293                                   addr, gfp);
9294 }
9295
9296 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
9297                                 struct net_device *netdev, const u8 *addr,
9298                                 gfp_t gfp)
9299 {
9300         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
9301                                   addr, gfp);
9302 }
9303
9304 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
9305                                  struct net_device *netdev, const u8 *bssid,
9306                                  const u8 *req_ie, size_t req_ie_len,
9307                                  const u8 *resp_ie, size_t resp_ie_len,
9308                                  u16 status, gfp_t gfp)
9309 {
9310         struct sk_buff *msg;
9311         void *hdr;
9312
9313         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9314         if (!msg)
9315                 return;
9316
9317         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
9318         if (!hdr) {
9319                 nlmsg_free(msg);
9320                 return;
9321         }
9322
9323         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9324             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9325             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
9326             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
9327             (req_ie &&
9328              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
9329             (resp_ie &&
9330              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
9331                 goto nla_put_failure;
9332
9333         genlmsg_end(msg, hdr);
9334
9335         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9336                                 nl80211_mlme_mcgrp.id, gfp);
9337         return;
9338
9339  nla_put_failure:
9340         genlmsg_cancel(msg, hdr);
9341         nlmsg_free(msg);
9342
9343 }
9344
9345 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
9346                          struct net_device *netdev, const u8 *bssid,
9347                          const u8 *req_ie, size_t req_ie_len,
9348                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
9349 {
9350         struct sk_buff *msg;
9351         void *hdr;
9352
9353         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9354         if (!msg)
9355                 return;
9356
9357         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
9358         if (!hdr) {
9359                 nlmsg_free(msg);
9360                 return;
9361         }
9362
9363         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9364             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9365             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
9366             (req_ie &&
9367              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
9368             (resp_ie &&
9369              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
9370                 goto nla_put_failure;
9371
9372         genlmsg_end(msg, hdr);
9373
9374         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9375                                 nl80211_mlme_mcgrp.id, gfp);
9376         return;
9377
9378  nla_put_failure:
9379         genlmsg_cancel(msg, hdr);
9380         nlmsg_free(msg);
9381
9382 }
9383
9384 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
9385                                struct net_device *netdev, u16 reason,
9386                                const u8 *ie, size_t ie_len, bool from_ap)
9387 {
9388         struct sk_buff *msg;
9389         void *hdr;
9390
9391         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9392         if (!msg)
9393                 return;
9394
9395         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
9396         if (!hdr) {
9397                 nlmsg_free(msg);
9398                 return;
9399         }
9400
9401         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9402             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9403             (from_ap && reason &&
9404              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
9405             (from_ap &&
9406              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
9407             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
9408                 goto nla_put_failure;
9409
9410         genlmsg_end(msg, hdr);
9411
9412         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9413                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
9414         return;
9415
9416  nla_put_failure:
9417         genlmsg_cancel(msg, hdr);
9418         nlmsg_free(msg);
9419
9420 }
9421
9422 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
9423                              struct net_device *netdev, const u8 *bssid,
9424                              gfp_t gfp)
9425 {
9426         struct sk_buff *msg;
9427         void *hdr;
9428
9429         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9430         if (!msg)
9431                 return;
9432
9433         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
9434         if (!hdr) {
9435                 nlmsg_free(msg);
9436                 return;
9437         }
9438
9439         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9440             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9441             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
9442                 goto nla_put_failure;
9443
9444         genlmsg_end(msg, hdr);
9445
9446         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9447                                 nl80211_mlme_mcgrp.id, gfp);
9448         return;
9449
9450  nla_put_failure:
9451         genlmsg_cancel(msg, hdr);
9452         nlmsg_free(msg);
9453 }
9454
9455 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
9456                                         const u8* ie, u8 ie_len, gfp_t gfp)
9457 {
9458         struct wireless_dev *wdev = dev->ieee80211_ptr;
9459         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9460         struct sk_buff *msg;
9461         void *hdr;
9462
9463         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
9464                 return;
9465
9466         trace_cfg80211_notify_new_peer_candidate(dev, addr);
9467
9468         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9469         if (!msg)
9470                 return;
9471
9472         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
9473         if (!hdr) {
9474                 nlmsg_free(msg);
9475                 return;
9476         }
9477
9478         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9479             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9480             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
9481             (ie_len && ie &&
9482              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
9483                 goto nla_put_failure;
9484
9485         genlmsg_end(msg, hdr);
9486
9487         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9488                                 nl80211_mlme_mcgrp.id, gfp);
9489         return;
9490
9491  nla_put_failure:
9492         genlmsg_cancel(msg, hdr);
9493         nlmsg_free(msg);
9494 }
9495 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
9496
9497 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
9498                                  struct net_device *netdev, const u8 *addr,
9499                                  enum nl80211_key_type key_type, int key_id,
9500                                  const u8 *tsc, gfp_t gfp)
9501 {
9502         struct sk_buff *msg;
9503         void *hdr;
9504
9505         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9506         if (!msg)
9507                 return;
9508
9509         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
9510         if (!hdr) {
9511                 nlmsg_free(msg);
9512                 return;
9513         }
9514
9515         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9516             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9517             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
9518             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
9519             (key_id != -1 &&
9520              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
9521             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
9522                 goto nla_put_failure;
9523
9524         genlmsg_end(msg, hdr);
9525
9526         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9527                                 nl80211_mlme_mcgrp.id, gfp);
9528         return;
9529
9530  nla_put_failure:
9531         genlmsg_cancel(msg, hdr);
9532         nlmsg_free(msg);
9533 }
9534
9535 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
9536                                     struct ieee80211_channel *channel_before,
9537                                     struct ieee80211_channel *channel_after)
9538 {
9539         struct sk_buff *msg;
9540         void *hdr;
9541         struct nlattr *nl_freq;
9542
9543         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
9544         if (!msg)
9545                 return;
9546
9547         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
9548         if (!hdr) {
9549                 nlmsg_free(msg);
9550                 return;
9551         }
9552
9553         /*
9554          * Since we are applying the beacon hint to a wiphy we know its
9555          * wiphy_idx is valid
9556          */
9557         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
9558                 goto nla_put_failure;
9559
9560         /* Before */
9561         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
9562         if (!nl_freq)
9563                 goto nla_put_failure;
9564         if (nl80211_msg_put_channel(msg, channel_before, false))
9565                 goto nla_put_failure;
9566         nla_nest_end(msg, nl_freq);
9567
9568         /* After */
9569         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
9570         if (!nl_freq)
9571                 goto nla_put_failure;
9572         if (nl80211_msg_put_channel(msg, channel_after, false))
9573                 goto nla_put_failure;
9574         nla_nest_end(msg, nl_freq);
9575
9576         genlmsg_end(msg, hdr);
9577
9578         rcu_read_lock();
9579         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
9580                                 GFP_ATOMIC);
9581         rcu_read_unlock();
9582
9583         return;
9584
9585 nla_put_failure:
9586         genlmsg_cancel(msg, hdr);
9587         nlmsg_free(msg);
9588 }
9589
9590 static void nl80211_send_remain_on_chan_event(
9591         int cmd, struct cfg80211_registered_device *rdev,
9592         struct wireless_dev *wdev, u64 cookie,
9593         struct ieee80211_channel *chan,
9594         unsigned int duration, gfp_t gfp)
9595 {
9596         struct sk_buff *msg;
9597         void *hdr;
9598
9599         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9600         if (!msg)
9601                 return;
9602
9603         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9604         if (!hdr) {
9605                 nlmsg_free(msg);
9606                 return;
9607         }
9608
9609         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9610             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9611                                          wdev->netdev->ifindex)) ||
9612             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
9613             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
9614             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
9615                         NL80211_CHAN_NO_HT) ||
9616             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
9617                 goto nla_put_failure;
9618
9619         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
9620             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
9621                 goto nla_put_failure;
9622
9623         genlmsg_end(msg, hdr);
9624
9625         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9626                                 nl80211_mlme_mcgrp.id, gfp);
9627         return;
9628
9629  nla_put_failure:
9630         genlmsg_cancel(msg, hdr);
9631         nlmsg_free(msg);
9632 }
9633
9634 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
9635                                struct ieee80211_channel *chan,
9636                                unsigned int duration, gfp_t gfp)
9637 {
9638         struct wiphy *wiphy = wdev->wiphy;
9639         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9640
9641         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
9642         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
9643                                           rdev, wdev, cookie, chan,
9644                                           duration, gfp);
9645 }
9646 EXPORT_SYMBOL(cfg80211_ready_on_channel);
9647
9648 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
9649                                         struct ieee80211_channel *chan,
9650                                         gfp_t gfp)
9651 {
9652         struct wiphy *wiphy = wdev->wiphy;
9653         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9654
9655         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
9656         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
9657                                           rdev, wdev, cookie, chan, 0, gfp);
9658 }
9659 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
9660
9661 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
9662                       struct station_info *sinfo, gfp_t gfp)
9663 {
9664         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
9665         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9666         struct sk_buff *msg;
9667
9668         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
9669
9670         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9671         if (!msg)
9672                 return;
9673
9674         if (nl80211_send_station(msg, 0, 0, 0,
9675                                  rdev, dev, mac_addr, sinfo) < 0) {
9676                 nlmsg_free(msg);
9677                 return;
9678         }
9679
9680         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9681                                 nl80211_mlme_mcgrp.id, gfp);
9682 }
9683 EXPORT_SYMBOL(cfg80211_new_sta);
9684
9685 void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
9686 {
9687         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
9688         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9689         struct sk_buff *msg;
9690         void *hdr;
9691
9692         trace_cfg80211_del_sta(dev, mac_addr);
9693
9694         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9695         if (!msg)
9696                 return;
9697
9698         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
9699         if (!hdr) {
9700                 nlmsg_free(msg);
9701                 return;
9702         }
9703
9704         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9705             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
9706                 goto nla_put_failure;
9707
9708         genlmsg_end(msg, hdr);
9709
9710         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9711                                 nl80211_mlme_mcgrp.id, gfp);
9712         return;
9713
9714  nla_put_failure:
9715         genlmsg_cancel(msg, hdr);
9716         nlmsg_free(msg);
9717 }
9718 EXPORT_SYMBOL(cfg80211_del_sta);
9719
9720 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
9721                           enum nl80211_connect_failed_reason reason,
9722                           gfp_t gfp)
9723 {
9724         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
9725         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9726         struct sk_buff *msg;
9727         void *hdr;
9728
9729         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
9730         if (!msg)
9731                 return;
9732
9733         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
9734         if (!hdr) {
9735                 nlmsg_free(msg);
9736                 return;
9737         }
9738
9739         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9740             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
9741             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
9742                 goto nla_put_failure;
9743
9744         genlmsg_end(msg, hdr);
9745
9746         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9747                                 nl80211_mlme_mcgrp.id, gfp);
9748         return;
9749
9750  nla_put_failure:
9751         genlmsg_cancel(msg, hdr);
9752         nlmsg_free(msg);
9753 }
9754 EXPORT_SYMBOL(cfg80211_conn_failed);
9755
9756 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
9757                                        const u8 *addr, gfp_t gfp)
9758 {
9759         struct wireless_dev *wdev = dev->ieee80211_ptr;
9760         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9761         struct sk_buff *msg;
9762         void *hdr;
9763         int err;
9764         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
9765
9766         if (!nlportid)
9767                 return false;
9768
9769         msg = nlmsg_new(100, gfp);
9770         if (!msg)
9771                 return true;
9772
9773         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9774         if (!hdr) {
9775                 nlmsg_free(msg);
9776                 return true;
9777         }
9778
9779         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9780             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9781             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
9782                 goto nla_put_failure;
9783
9784         err = genlmsg_end(msg, hdr);
9785         if (err < 0) {
9786                 nlmsg_free(msg);
9787                 return true;
9788         }
9789
9790         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
9791         return true;
9792
9793  nla_put_failure:
9794         genlmsg_cancel(msg, hdr);
9795         nlmsg_free(msg);
9796         return true;
9797 }
9798
9799 bool cfg80211_rx_spurious_frame(struct net_device *dev,
9800                                 const u8 *addr, gfp_t gfp)
9801 {
9802         struct wireless_dev *wdev = dev->ieee80211_ptr;
9803         bool ret;
9804
9805         trace_cfg80211_rx_spurious_frame(dev, addr);
9806
9807         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
9808                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
9809                 trace_cfg80211_return_bool(false);
9810                 return false;
9811         }
9812         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
9813                                          addr, gfp);
9814         trace_cfg80211_return_bool(ret);
9815         return ret;
9816 }
9817 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
9818
9819 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
9820                                         const u8 *addr, gfp_t gfp)
9821 {
9822         struct wireless_dev *wdev = dev->ieee80211_ptr;
9823         bool ret;
9824
9825         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
9826
9827         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
9828                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
9829                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
9830                 trace_cfg80211_return_bool(false);
9831                 return false;
9832         }
9833         ret = __nl80211_unexpected_frame(dev,
9834                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
9835                                          addr, gfp);
9836         trace_cfg80211_return_bool(ret);
9837         return ret;
9838 }
9839 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
9840
9841 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
9842                       struct wireless_dev *wdev, u32 nlportid,
9843                       int freq, int sig_dbm,
9844                       const u8 *buf, size_t len, gfp_t gfp)
9845 {
9846         struct net_device *netdev = wdev->netdev;
9847         struct sk_buff *msg;
9848         void *hdr;
9849
9850         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9851         if (!msg)
9852                 return -ENOMEM;
9853
9854         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
9855         if (!hdr) {
9856                 nlmsg_free(msg);
9857                 return -ENOMEM;
9858         }
9859
9860         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9861             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9862                                         netdev->ifindex)) ||
9863             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
9864             (sig_dbm &&
9865              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
9866             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
9867                 goto nla_put_failure;
9868
9869         genlmsg_end(msg, hdr);
9870
9871         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
9872
9873  nla_put_failure:
9874         genlmsg_cancel(msg, hdr);
9875         nlmsg_free(msg);
9876         return -ENOBUFS;
9877 }
9878
9879 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
9880                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
9881 {
9882         struct wiphy *wiphy = wdev->wiphy;
9883         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9884         struct net_device *netdev = wdev->netdev;
9885         struct sk_buff *msg;
9886         void *hdr;
9887
9888         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
9889
9890         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9891         if (!msg)
9892                 return;
9893
9894         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
9895         if (!hdr) {
9896                 nlmsg_free(msg);
9897                 return;
9898         }
9899
9900         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9901             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9902                                    netdev->ifindex)) ||
9903             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
9904             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
9905             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
9906                 goto nla_put_failure;
9907
9908         genlmsg_end(msg, hdr);
9909
9910         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
9911         return;
9912
9913  nla_put_failure:
9914         genlmsg_cancel(msg, hdr);
9915         nlmsg_free(msg);
9916 }
9917 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
9918
9919 void cfg80211_cqm_rssi_notify(struct net_device *dev,
9920                               enum nl80211_cqm_rssi_threshold_event rssi_event,
9921                               gfp_t gfp)
9922 {
9923         struct wireless_dev *wdev = dev->ieee80211_ptr;
9924         struct wiphy *wiphy = wdev->wiphy;
9925         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9926         struct sk_buff *msg;
9927         struct nlattr *pinfoattr;
9928         void *hdr;
9929
9930         trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
9931
9932         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9933         if (!msg)
9934                 return;
9935
9936         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
9937         if (!hdr) {
9938                 nlmsg_free(msg);
9939                 return;
9940         }
9941
9942         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9943             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
9944                 goto nla_put_failure;
9945
9946         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
9947         if (!pinfoattr)
9948                 goto nla_put_failure;
9949
9950         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
9951                         rssi_event))
9952                 goto nla_put_failure;
9953
9954         nla_nest_end(msg, pinfoattr);
9955
9956         genlmsg_end(msg, hdr);
9957
9958         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9959                                 nl80211_mlme_mcgrp.id, gfp);
9960         return;
9961
9962  nla_put_failure:
9963         genlmsg_cancel(msg, hdr);
9964         nlmsg_free(msg);
9965 }
9966 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
9967
9968 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
9969                                      struct net_device *netdev, const u8 *bssid,
9970                                      const u8 *replay_ctr, gfp_t gfp)
9971 {
9972         struct sk_buff *msg;
9973         struct nlattr *rekey_attr;
9974         void *hdr;
9975
9976         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9977         if (!msg)
9978                 return;
9979
9980         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
9981         if (!hdr) {
9982                 nlmsg_free(msg);
9983                 return;
9984         }
9985
9986         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9987             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9988             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
9989                 goto nla_put_failure;
9990
9991         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
9992         if (!rekey_attr)
9993                 goto nla_put_failure;
9994
9995         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
9996                     NL80211_REPLAY_CTR_LEN, replay_ctr))
9997                 goto nla_put_failure;
9998
9999         nla_nest_end(msg, rekey_attr);
10000
10001         genlmsg_end(msg, hdr);
10002
10003         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10004                                 nl80211_mlme_mcgrp.id, gfp);
10005         return;
10006
10007  nla_put_failure:
10008         genlmsg_cancel(msg, hdr);
10009         nlmsg_free(msg);
10010 }
10011
10012 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
10013                                const u8 *replay_ctr, gfp_t gfp)
10014 {
10015         struct wireless_dev *wdev = dev->ieee80211_ptr;
10016         struct wiphy *wiphy = wdev->wiphy;
10017         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10018
10019         trace_cfg80211_gtk_rekey_notify(dev, bssid);
10020         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
10021 }
10022 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
10023
10024 static void
10025 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
10026                                struct net_device *netdev, int index,
10027                                const u8 *bssid, bool preauth, gfp_t gfp)
10028 {
10029         struct sk_buff *msg;
10030         struct nlattr *attr;
10031         void *hdr;
10032
10033         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10034         if (!msg)
10035                 return;
10036
10037         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
10038         if (!hdr) {
10039                 nlmsg_free(msg);
10040                 return;
10041         }
10042
10043         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10044             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
10045                 goto nla_put_failure;
10046
10047         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
10048         if (!attr)
10049                 goto nla_put_failure;
10050
10051         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
10052             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
10053             (preauth &&
10054              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
10055                 goto nla_put_failure;
10056
10057         nla_nest_end(msg, attr);
10058
10059         genlmsg_end(msg, hdr);
10060
10061         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10062                                 nl80211_mlme_mcgrp.id, gfp);
10063         return;
10064
10065  nla_put_failure:
10066         genlmsg_cancel(msg, hdr);
10067         nlmsg_free(msg);
10068 }
10069
10070 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
10071                                      const u8 *bssid, bool preauth, gfp_t gfp)
10072 {
10073         struct wireless_dev *wdev = dev->ieee80211_ptr;
10074         struct wiphy *wiphy = wdev->wiphy;
10075         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10076
10077         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
10078         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
10079 }
10080 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
10081
10082 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
10083                                      struct net_device *netdev,
10084                                      struct cfg80211_chan_def *chandef,
10085                                      gfp_t gfp)
10086 {
10087         struct sk_buff *msg;
10088         void *hdr;
10089
10090         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10091         if (!msg)
10092                 return;
10093
10094         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
10095         if (!hdr) {
10096                 nlmsg_free(msg);
10097                 return;
10098         }
10099
10100         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
10101                 goto nla_put_failure;
10102
10103         if (nl80211_send_chandef(msg, chandef))
10104                 goto nla_put_failure;
10105
10106         genlmsg_end(msg, hdr);
10107
10108         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10109                                 nl80211_mlme_mcgrp.id, gfp);
10110         return;
10111
10112  nla_put_failure:
10113         genlmsg_cancel(msg, hdr);
10114         nlmsg_free(msg);
10115 }
10116
10117 void cfg80211_ch_switch_notify(struct net_device *dev,
10118                                struct cfg80211_chan_def *chandef)
10119 {
10120         struct wireless_dev *wdev = dev->ieee80211_ptr;
10121         struct wiphy *wiphy = wdev->wiphy;
10122         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10123
10124         trace_cfg80211_ch_switch_notify(dev, chandef);
10125
10126         wdev_lock(wdev);
10127
10128         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
10129                     wdev->iftype != NL80211_IFTYPE_P2P_GO))
10130                 goto out;
10131
10132         wdev->channel = chandef->chan;
10133         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL);
10134 out:
10135         wdev_unlock(wdev);
10136         return;
10137 }
10138 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
10139
10140 void cfg80211_cqm_txe_notify(struct net_device *dev,
10141                              const u8 *peer, u32 num_packets,
10142                              u32 rate, u32 intvl, gfp_t gfp)
10143 {
10144         struct wireless_dev *wdev = dev->ieee80211_ptr;
10145         struct wiphy *wiphy = wdev->wiphy;
10146         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10147         struct sk_buff *msg;
10148         struct nlattr *pinfoattr;
10149         void *hdr;
10150
10151         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
10152         if (!msg)
10153                 return;
10154
10155         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10156         if (!hdr) {
10157                 nlmsg_free(msg);
10158                 return;
10159         }
10160
10161         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10162             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10163             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
10164                 goto nla_put_failure;
10165
10166         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10167         if (!pinfoattr)
10168                 goto nla_put_failure;
10169
10170         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
10171                 goto nla_put_failure;
10172
10173         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
10174                 goto nla_put_failure;
10175
10176         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
10177                 goto nla_put_failure;
10178
10179         nla_nest_end(msg, pinfoattr);
10180
10181         genlmsg_end(msg, hdr);
10182
10183         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10184                                 nl80211_mlme_mcgrp.id, gfp);
10185         return;
10186
10187  nla_put_failure:
10188         genlmsg_cancel(msg, hdr);
10189         nlmsg_free(msg);
10190 }
10191 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
10192
10193 void
10194 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
10195                      struct cfg80211_chan_def *chandef,
10196                      enum nl80211_radar_event event,
10197                      struct net_device *netdev, gfp_t gfp)
10198 {
10199         struct sk_buff *msg;
10200         void *hdr;
10201
10202         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10203         if (!msg)
10204                 return;
10205
10206         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
10207         if (!hdr) {
10208                 nlmsg_free(msg);
10209                 return;
10210         }
10211
10212         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
10213                 goto nla_put_failure;
10214
10215         /* NOP and radar events don't need a netdev parameter */
10216         if (netdev) {
10217                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
10218
10219                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10220                     nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10221                         goto nla_put_failure;
10222         }
10223
10224         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
10225                 goto nla_put_failure;
10226
10227         if (nl80211_send_chandef(msg, chandef))
10228                 goto nla_put_failure;
10229
10230         if (genlmsg_end(msg, hdr) < 0) {
10231                 nlmsg_free(msg);
10232                 return;
10233         }
10234
10235         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10236                                 nl80211_mlme_mcgrp.id, gfp);
10237         return;
10238
10239  nla_put_failure:
10240         genlmsg_cancel(msg, hdr);
10241         nlmsg_free(msg);
10242 }
10243
10244 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
10245                                  const u8 *peer, u32 num_packets, gfp_t gfp)
10246 {
10247         struct wireless_dev *wdev = dev->ieee80211_ptr;
10248         struct wiphy *wiphy = wdev->wiphy;
10249         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10250         struct sk_buff *msg;
10251         struct nlattr *pinfoattr;
10252         void *hdr;
10253
10254         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
10255
10256         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10257         if (!msg)
10258                 return;
10259
10260         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10261         if (!hdr) {
10262                 nlmsg_free(msg);
10263                 return;
10264         }
10265
10266         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10267             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10268             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
10269                 goto nla_put_failure;
10270
10271         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10272         if (!pinfoattr)
10273                 goto nla_put_failure;
10274
10275         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
10276                 goto nla_put_failure;
10277
10278         nla_nest_end(msg, pinfoattr);
10279
10280         genlmsg_end(msg, hdr);
10281
10282         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10283                                 nl80211_mlme_mcgrp.id, gfp);
10284         return;
10285
10286  nla_put_failure:
10287         genlmsg_cancel(msg, hdr);
10288         nlmsg_free(msg);
10289 }
10290 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
10291
10292 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
10293                            u64 cookie, bool acked, gfp_t gfp)
10294 {
10295         struct wireless_dev *wdev = dev->ieee80211_ptr;
10296         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10297         struct sk_buff *msg;
10298         void *hdr;
10299         int err;
10300
10301         trace_cfg80211_probe_status(dev, addr, cookie, acked);
10302
10303         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10304
10305         if (!msg)
10306                 return;
10307
10308         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
10309         if (!hdr) {
10310                 nlmsg_free(msg);
10311                 return;
10312         }
10313
10314         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10315             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10316             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
10317             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
10318             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
10319                 goto nla_put_failure;
10320
10321         err = genlmsg_end(msg, hdr);
10322         if (err < 0) {
10323                 nlmsg_free(msg);
10324                 return;
10325         }
10326
10327         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10328                                 nl80211_mlme_mcgrp.id, gfp);
10329         return;
10330
10331  nla_put_failure:
10332         genlmsg_cancel(msg, hdr);
10333         nlmsg_free(msg);
10334 }
10335 EXPORT_SYMBOL(cfg80211_probe_status);
10336
10337 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
10338                                  const u8 *frame, size_t len,
10339                                  int freq, int sig_dbm)
10340 {
10341         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10342         struct sk_buff *msg;
10343         void *hdr;
10344         struct cfg80211_beacon_registration *reg;
10345
10346         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
10347
10348         spin_lock_bh(&rdev->beacon_registrations_lock);
10349         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
10350                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
10351                 if (!msg) {
10352                         spin_unlock_bh(&rdev->beacon_registrations_lock);
10353                         return;
10354                 }
10355
10356                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
10357                 if (!hdr)
10358                         goto nla_put_failure;
10359
10360                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10361                     (freq &&
10362                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
10363                     (sig_dbm &&
10364                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
10365                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
10366                         goto nla_put_failure;
10367
10368                 genlmsg_end(msg, hdr);
10369
10370                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
10371         }
10372         spin_unlock_bh(&rdev->beacon_registrations_lock);
10373         return;
10374
10375  nla_put_failure:
10376         spin_unlock_bh(&rdev->beacon_registrations_lock);
10377         if (hdr)
10378                 genlmsg_cancel(msg, hdr);
10379         nlmsg_free(msg);
10380 }
10381 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
10382
10383 #ifdef CONFIG_PM
10384 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
10385                                    struct cfg80211_wowlan_wakeup *wakeup,
10386                                    gfp_t gfp)
10387 {
10388         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10389         struct sk_buff *msg;
10390         void *hdr;
10391         int err, size = 200;
10392
10393         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
10394
10395         if (wakeup)
10396                 size += wakeup->packet_present_len;
10397
10398         msg = nlmsg_new(size, gfp);
10399         if (!msg)
10400                 return;
10401
10402         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
10403         if (!hdr)
10404                 goto free_msg;
10405
10406         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10407             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10408                 goto free_msg;
10409
10410         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10411                                         wdev->netdev->ifindex))
10412                 goto free_msg;
10413
10414         if (wakeup) {
10415                 struct nlattr *reasons;
10416
10417                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
10418
10419                 if (wakeup->disconnect &&
10420                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
10421                         goto free_msg;
10422                 if (wakeup->magic_pkt &&
10423                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
10424                         goto free_msg;
10425                 if (wakeup->gtk_rekey_failure &&
10426                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
10427                         goto free_msg;
10428                 if (wakeup->eap_identity_req &&
10429                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
10430                         goto free_msg;
10431                 if (wakeup->four_way_handshake &&
10432                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
10433                         goto free_msg;
10434                 if (wakeup->rfkill_release &&
10435                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
10436                         goto free_msg;
10437
10438                 if (wakeup->pattern_idx >= 0 &&
10439                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
10440                                 wakeup->pattern_idx))
10441                         goto free_msg;
10442
10443                 if (wakeup->tcp_match)
10444                         nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH);
10445
10446                 if (wakeup->tcp_connlost)
10447                         nla_put_flag(msg,
10448                                      NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST);
10449
10450                 if (wakeup->tcp_nomoretokens)
10451                         nla_put_flag(msg,
10452                                 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS);
10453
10454                 if (wakeup->packet) {
10455                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
10456                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
10457
10458                         if (!wakeup->packet_80211) {
10459                                 pkt_attr =
10460                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
10461                                 len_attr =
10462                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
10463                         }
10464
10465                         if (wakeup->packet_len &&
10466                             nla_put_u32(msg, len_attr, wakeup->packet_len))
10467                                 goto free_msg;
10468
10469                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
10470                                     wakeup->packet))
10471                                 goto free_msg;
10472                 }
10473
10474                 nla_nest_end(msg, reasons);
10475         }
10476
10477         err = genlmsg_end(msg, hdr);
10478         if (err < 0)
10479                 goto free_msg;
10480
10481         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10482                                 nl80211_mlme_mcgrp.id, gfp);
10483         return;
10484
10485  free_msg:
10486         nlmsg_free(msg);
10487 }
10488 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
10489 #endif
10490
10491 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
10492                                 enum nl80211_tdls_operation oper,
10493                                 u16 reason_code, gfp_t gfp)
10494 {
10495         struct wireless_dev *wdev = dev->ieee80211_ptr;
10496         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10497         struct sk_buff *msg;
10498         void *hdr;
10499         int err;
10500
10501         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
10502                                          reason_code);
10503
10504         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10505         if (!msg)
10506                 return;
10507
10508         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
10509         if (!hdr) {
10510                 nlmsg_free(msg);
10511                 return;
10512         }
10513
10514         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10515             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10516             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
10517             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
10518             (reason_code > 0 &&
10519              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
10520                 goto nla_put_failure;
10521
10522         err = genlmsg_end(msg, hdr);
10523         if (err < 0) {
10524                 nlmsg_free(msg);
10525                 return;
10526         }
10527
10528         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10529                                 nl80211_mlme_mcgrp.id, gfp);
10530         return;
10531
10532  nla_put_failure:
10533         genlmsg_cancel(msg, hdr);
10534         nlmsg_free(msg);
10535 }
10536 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
10537
10538 static int nl80211_netlink_notify(struct notifier_block * nb,
10539                                   unsigned long state,
10540                                   void *_notify)
10541 {
10542         struct netlink_notify *notify = _notify;
10543         struct cfg80211_registered_device *rdev;
10544         struct wireless_dev *wdev;
10545         struct cfg80211_beacon_registration *reg, *tmp;
10546
10547         if (state != NETLINK_URELEASE)
10548                 return NOTIFY_DONE;
10549
10550         rcu_read_lock();
10551
10552         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
10553                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list)
10554                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
10555
10556                 spin_lock_bh(&rdev->beacon_registrations_lock);
10557                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
10558                                          list) {
10559                         if (reg->nlportid == notify->portid) {
10560                                 list_del(&reg->list);
10561                                 kfree(reg);
10562                                 break;
10563                         }
10564                 }
10565                 spin_unlock_bh(&rdev->beacon_registrations_lock);
10566         }
10567
10568         rcu_read_unlock();
10569
10570         return NOTIFY_DONE;
10571 }
10572
10573 static struct notifier_block nl80211_netlink_notifier = {
10574         .notifier_call = nl80211_netlink_notify,
10575 };
10576
10577 void cfg80211_ft_event(struct net_device *netdev,
10578                        struct cfg80211_ft_event_params *ft_event)
10579 {
10580         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
10581         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10582         struct sk_buff *msg;
10583         void *hdr;
10584         int err;
10585
10586         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
10587
10588         if (!ft_event->target_ap)
10589                 return;
10590
10591         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10592         if (!msg)
10593                 return;
10594
10595         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
10596         if (!hdr) {
10597                 nlmsg_free(msg);
10598                 return;
10599         }
10600
10601         nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
10602         nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
10603         nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap);
10604         if (ft_event->ies)
10605                 nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies);
10606         if (ft_event->ric_ies)
10607                 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
10608                         ft_event->ric_ies);
10609
10610         err = genlmsg_end(msg, hdr);
10611         if (err < 0) {
10612                 nlmsg_free(msg);
10613                 return;
10614         }
10615
10616         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10617                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
10618 }
10619 EXPORT_SYMBOL(cfg80211_ft_event);
10620
10621 /* initialisation/exit functions */
10622
10623 int nl80211_init(void)
10624 {
10625         int err;
10626
10627         err = genl_register_family_with_ops(&nl80211_fam,
10628                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
10629         if (err)
10630                 return err;
10631
10632         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
10633         if (err)
10634                 goto err_out;
10635
10636         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
10637         if (err)
10638                 goto err_out;
10639
10640         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
10641         if (err)
10642                 goto err_out;
10643
10644         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
10645         if (err)
10646                 goto err_out;
10647
10648 #ifdef CONFIG_NL80211_TESTMODE
10649         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
10650         if (err)
10651                 goto err_out;
10652 #endif
10653
10654         err = netlink_register_notifier(&nl80211_netlink_notifier);
10655         if (err)
10656                 goto err_out;
10657
10658         return 0;
10659  err_out:
10660         genl_unregister_family(&nl80211_fam);
10661         return err;
10662 }
10663
10664 void nl80211_exit(void)
10665 {
10666         netlink_unregister_notifier(&nl80211_netlink_notifier);
10667         genl_unregister_family(&nl80211_fam);
10668 }