net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include <net/inet_connection_sock.h>
  23 #include "core.h"
  24 #include "nl80211.h"
  25 #include "reg.h"
  26 #include "rdev-ops.h"
  27
  28 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  29                                    struct genl_info *info,
  30                                    struct cfg80211_crypto_settings *settings,
  31                                    int cipher_limit);
  32
  33 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
  34                             struct genl_info *info);
  35 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
  36                               struct genl_info *info);
  37
  38 /* the netlink family */
  39 static struct genl_family nl80211_fam = {
  40         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  41         .name = "nl80211",      /* have users key off the name instead */
  42         .hdrsize = 0,           /* no private header */
  43         .version = 1,           /* no particular meaning now */
  44         .maxattr = NL80211_ATTR_MAX,
  45         .netnsok = true,
  46         .pre_doit = nl80211_pre_doit,
  47         .post_doit = nl80211_post_doit,
  48 };
  49
  50 /* returns ERR_PTR values */
  51 static struct wireless_dev *
  52 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  53 {
  54         struct cfg80211_registered_device *rdev;
  55         struct wireless_dev *result = NULL;
  56         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  57         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  58         u64 wdev_id;
  59         int wiphy_idx = -1;
  60         int ifidx = -1;
  61
  62         assert_cfg80211_lock();
  63
  64         if (!have_ifidx && !have_wdev_id)
  65                 return ERR_PTR(-EINVAL);
  66
  67         if (have_ifidx)
  68                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  69         if (have_wdev_id) {
  70                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  71                 wiphy_idx = wdev_id >> 32;
  72         }
  73
  74         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  75                 struct wireless_dev *wdev;
  76
  77                 if (wiphy_net(&rdev->wiphy) != netns)
  78                         continue;
  79
  80                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  81                         continue;
  82
  83                 mutex_lock(&rdev->devlist_mtx);
  84                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
  85                         if (have_ifidx && wdev->netdev &&
  86                             wdev->netdev->ifindex == ifidx) {
  87                                 result = wdev;
  88                                 break;
  89                         }
  90                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
  91                                 result = wdev;
  92                                 break;
  93                         }
  94                 }
  95                 mutex_unlock(&rdev->devlist_mtx);
  96
  97                 if (result)
  98                         break;
  99         }
 100
 101         if (result)
 102                 return result;
 103         return ERR_PTR(-ENODEV);
 104 }
 105
 106 static struct cfg80211_registered_device *
 107 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 108 {
 109         struct cfg80211_registered_device *rdev = NULL, *tmp;
 110         struct net_device *netdev;
 111
 112         assert_cfg80211_lock();
 113
 114         if (!attrs[NL80211_ATTR_WIPHY] &&
 115             !attrs[NL80211_ATTR_IFINDEX] &&
 116             !attrs[NL80211_ATTR_WDEV])
 117                 return ERR_PTR(-EINVAL);
 118
 119         if (attrs[NL80211_ATTR_WIPHY])
 120                 rdev = cfg80211_rdev_by_wiphy_idx(
 121                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 122
 123         if (attrs[NL80211_ATTR_WDEV]) {
 124                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 125                 struct wireless_dev *wdev;
 126                 bool found = false;
 127
 128                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 129                 if (tmp) {
 130                         /* make sure wdev exists */
 131                         mutex_lock(&tmp->devlist_mtx);
 132                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 133                                 if (wdev->identifier != (u32)wdev_id)
 134                                         continue;
 135                                 found = true;
 136                                 break;
 137                         }
 138                         mutex_unlock(&tmp->devlist_mtx);
 139
 140                         if (!found)
 141                                 tmp = NULL;
 142
 143                         if (rdev && tmp != rdev)
 144                                 return ERR_PTR(-EINVAL);
 145                         rdev = tmp;
 146                 }
 147         }
 148
 149         if (attrs[NL80211_ATTR_IFINDEX]) {
 150                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 151                 netdev = dev_get_by_index(netns, ifindex);
 152                 if (netdev) {
 153                         if (netdev->ieee80211_ptr)
 154                                 tmp = wiphy_to_dev(
 155                                                 netdev->ieee80211_ptr->wiphy);
 156                         else
 157                                 tmp = NULL;
 158
 159                         dev_put(netdev);
 160
 161                         /* not wireless device -- return error */
 162                         if (!tmp)
 163                                 return ERR_PTR(-EINVAL);
 164
 165                         /* mismatch -- return error */
 166                         if (rdev && tmp != rdev)
 167                                 return ERR_PTR(-EINVAL);
 168
 169                         rdev = tmp;
 170                 }
 171         }
 172
 173         if (!rdev)
 174                 return ERR_PTR(-ENODEV);
 175
 176         if (netns != wiphy_net(&rdev->wiphy))
 177                 return ERR_PTR(-ENODEV);
 178
 179         return rdev;
 180 }
 181
 182 /*
 183  * This function returns a pointer to the driver
 184  * that the genl_info item that is passed refers to.
 185  * If successful, it returns non-NULL and also locks
 186  * the driver's mutex!
 187  *
 188  * This means that you need to call cfg80211_unlock_rdev()
 189  * before being allowed to acquire &cfg80211_mutex!
 190  *
 191  * This is necessary because we need to lock the global
 192  * mutex to get an item off the list safely, and then
 193  * we lock the rdev mutex so it doesn't go away under us.
 194  *
 195  * We don't want to keep cfg80211_mutex locked
 196  * for all the time in order to allow requests on
 197  * other interfaces to go through at the same time.
 198  *
 199  * The result of this can be a PTR_ERR and hence must
 200  * be checked with IS_ERR() for errors.
 201  */
 202 static struct cfg80211_registered_device *
 203 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 204 {
 205         struct cfg80211_registered_device *rdev;
 206
 207         mutex_lock(&cfg80211_mutex);
 208         rdev = __cfg80211_rdev_from_attrs(netns, info->attrs);
 209
 210         /* if it is not an error we grab the lock on
 211          * it to assure it won't be going away while
 212          * we operate on it */
 213         if (!IS_ERR(rdev))
 214                 mutex_lock(&rdev->mtx);
 215
 216         mutex_unlock(&cfg80211_mutex);
 217
 218         return rdev;
 219 }
 220
 221 /* policy for the attributes */
 222 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
 223         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 224         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 225                                       .len = 20-1 },
 226         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 227
 228         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 229         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 230         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 231         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 232         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 233
 234         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 235         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 236         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 237         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 238         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 239
 240         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 241         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 242         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 243
 244         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 245         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 246
 247         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 248         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 249                                     .len = WLAN_MAX_KEY_LEN },
 250         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 251         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 252         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 253         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 254         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 255
 256         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 257         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 258         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 259                                        .len = IEEE80211_MAX_DATA_LEN },
 260         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 261                                        .len = IEEE80211_MAX_DATA_LEN },
 262         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 263         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 264         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 265         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 266                                                .len = NL80211_MAX_SUPP_RATES },
 267         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 268         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 269         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 270         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 271                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 272         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 273
 274         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 275         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 276
 277         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 278         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 279         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 280         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 281                                            .len = NL80211_MAX_SUPP_RATES },
 282         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 283
 284         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 285         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 286
 287         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 288
 289         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 290         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 291                               .len = IEEE80211_MAX_DATA_LEN },
 292         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 293         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 294
 295         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 296                                 .len = IEEE80211_MAX_SSID_LEN },
 297         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 298         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 299         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 300         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 301         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 302         [NL80211_ATTR_STA_FLAGS2] = {
 303                 .len = sizeof(struct nl80211_sta_flag_update),
 304         },
 305         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 306         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 307         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 308         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 309         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 310         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 311         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 312         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 313         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 314                                  .len = WLAN_PMKID_LEN },
 315         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 316         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 317         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 318         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 319                                  .len = IEEE80211_MAX_DATA_LEN },
 320         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 321         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 322         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 323         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 324         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 325         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 326         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 327         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 328         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 329         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 330         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 331         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 332         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 333         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 334         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 335         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 336         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 337         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 338         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 339         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 340                                          .len = IEEE80211_MAX_DATA_LEN },
 341         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 342                                          .len = IEEE80211_MAX_DATA_LEN },
 343         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 344         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 345         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 346         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 347         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 348         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 349         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 350         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 351         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 352         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 353                                       .len = IEEE80211_MAX_DATA_LEN },
 354         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 355         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 356         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 357                 .len = NL80211_HT_CAPABILITY_LEN
 358         },
 359         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 360         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 361         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 362         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 363         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 364         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 365         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 366         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 367         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 368         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 369         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 370         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 371         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 372         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 373         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 374 };
 375
 376 /* policy for the key attributes */
 377 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 378         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 379         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 380         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 381         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 382         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 383         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 384         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 385         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 386 };
 387
 388 /* policy for the key default flags */
 389 static const struct nla_policy
 390 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 391         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 392         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 393 };
 394
 395 /* policy for WoWLAN attributes */
 396 static const struct nla_policy
 397 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 398         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 399         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 400         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 401         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 402         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 403         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 404         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 405         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 406         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 407 };
 408
 409 static const struct nla_policy
 410 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 411         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 412         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 413         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 414         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 415         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 416         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 417         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 418                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 419         },
 420         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 421                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 422         },
 423         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 424         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 425         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 426 };
 427
 428 /* policy for GTK rekey offload attributes */
 429 static const struct nla_policy
 430 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 431         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 432         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 433         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 434 };
 435
 436 static const struct nla_policy
 437 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 438         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 439                                                  .len = IEEE80211_MAX_SSID_LEN },
 440         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 441 };
 442
 443 /* ifidx get helper */
 444 static int nl80211_get_ifidx(struct netlink_callback *cb)
 445 {
 446         int res;
 447
 448         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 449                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 450                           nl80211_policy);
 451         if (res)
 452                 return res;
 453
 454         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 455                 return -EINVAL;
 456
 457         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 458         if (!res)
 459                 return -EINVAL;
 460         return res;
 461 }
 462
 463 static int nl80211_prepare_netdev_dump(struct sk_buff *skb,
 464                                        struct netlink_callback *cb,
 465                                        struct cfg80211_registered_device **rdev,
 466                                        struct net_device **dev)
 467 {
 468         int ifidx = cb->args[0];
 469         int err;
 470
 471         if (!ifidx)
 472                 ifidx = nl80211_get_ifidx(cb);
 473         if (ifidx < 0)
 474                 return ifidx;
 475
 476         cb->args[0] = ifidx;
 477
 478         rtnl_lock();
 479
 480         *dev = __dev_get_by_index(sock_net(skb->sk), ifidx);
 481         if (!*dev) {
 482                 err = -ENODEV;
 483                 goto out_rtnl;
 484         }
 485
 486         *rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
 487         if (IS_ERR(*rdev)) {
 488                 err = PTR_ERR(*rdev);
 489                 goto out_rtnl;
 490         }
 491
 492         return 0;
 493  out_rtnl:
 494         rtnl_unlock();
 495         return err;
 496 }
 497
 498 static void nl80211_finish_netdev_dump(struct cfg80211_registered_device *rdev)
 499 {
 500         cfg80211_unlock_rdev(rdev);
 501         rtnl_unlock();
 502 }
 503
 504 /* IE validation */
 505 static bool is_valid_ie_attr(const struct nlattr *attr)
 506 {
 507         const u8 *pos;
 508         int len;
 509
 510         if (!attr)
 511                 return true;
 512
 513         pos = nla_data(attr);
 514         len = nla_len(attr);
 515
 516         while (len) {
 517                 u8 elemlen;
 518
 519                 if (len < 2)
 520                         return false;
 521                 len -= 2;
 522
 523                 elemlen = pos[1];
 524                 if (elemlen > len)
 525                         return false;
 526
 527                 len -= elemlen;
 528                 pos += 2 + elemlen;
 529         }
 530
 531         return true;
 532 }
 533
 534 /* message building helper */
 535 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 536                                    int flags, u8 cmd)
 537 {
 538         /* since there is no private header just add the generic one */
 539         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 540 }
 541
 542 static int nl80211_msg_put_channel(struct sk_buff *msg,
 543                                    struct ieee80211_channel *chan)
 544 {
 545         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 546                         chan->center_freq))
 547                 goto nla_put_failure;
 548
 549         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 550             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 551                 goto nla_put_failure;
 552         if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
 553             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN))
 554                 goto nla_put_failure;
 555         if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
 556             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IBSS))
 557                 goto nla_put_failure;
 558         if ((chan->flags & IEEE80211_CHAN_RADAR) &&
 559             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 560                 goto nla_put_failure;
 561
 562         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 563                         DBM_TO_MBM(chan->max_power)))
 564                 goto nla_put_failure;
 565
 566         return 0;
 567
 568  nla_put_failure:
 569         return -ENOBUFS;
 570 }
 571
 572 /* netlink command implementations */
 573
 574 struct key_parse {
 575         struct key_params p;
 576         int idx;
 577         int type;
 578         bool def, defmgmt;
 579         bool def_uni, def_multi;
 580 };
 581
 582 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 583 {
 584         struct nlattr *tb[NL80211_KEY_MAX + 1];
 585         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 586                                    nl80211_key_policy);
 587         if (err)
 588                 return err;
 589
 590         k->def = !!tb[NL80211_KEY_DEFAULT];
 591         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 592
 593         if (k->def) {
 594                 k->def_uni = true;
 595                 k->def_multi = true;
 596         }
 597         if (k->defmgmt)
 598                 k->def_multi = true;
 599
 600         if (tb[NL80211_KEY_IDX])
 601                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 602
 603         if (tb[NL80211_KEY_DATA]) {
 604                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 605                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 606         }
 607
 608         if (tb[NL80211_KEY_SEQ]) {
 609                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 610                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 611         }
 612
 613         if (tb[NL80211_KEY_CIPHER])
 614                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 615
 616         if (tb[NL80211_KEY_TYPE]) {
 617                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 618                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 619                         return -EINVAL;
 620         }
 621
 622         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 623                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 624                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 625                                        tb[NL80211_KEY_DEFAULT_TYPES],
 626                                        nl80211_key_default_policy);
 627                 if (err)
 628                         return err;
 629
 630                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 631                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 632         }
 633
 634         return 0;
 635 }
 636
 637 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 638 {
 639         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 640                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 641                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 642         }
 643
 644         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 645                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 646                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 647         }
 648
 649         if (info->attrs[NL80211_ATTR_KEY_IDX])
 650                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 651
 652         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 653                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 654
 655         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 656         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 657
 658         if (k->def) {
 659                 k->def_uni = true;
 660                 k->def_multi = true;
 661         }
 662         if (k->defmgmt)
 663                 k->def_multi = true;
 664
 665         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 666                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 667                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 668                         return -EINVAL;
 669         }
 670
 671         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 672                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 673                 int err = nla_parse_nested(
 674                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 675                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 676                                 nl80211_key_default_policy);
 677                 if (err)
 678                         return err;
 679
 680                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 681                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 682         }
 683
 684         return 0;
 685 }
 686
 687 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 688 {
 689         int err;
 690
 691         memset(k, 0, sizeof(*k));
 692         k->idx = -1;
 693         k->type = -1;
 694
 695         if (info->attrs[NL80211_ATTR_KEY])
 696                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 697         else
 698                 err = nl80211_parse_key_old(info, k);
 699
 700         if (err)
 701                 return err;
 702
 703         if (k->def && k->defmgmt)
 704                 return -EINVAL;
 705
 706         if (k->defmgmt) {
 707                 if (k->def_uni || !k->def_multi)
 708                         return -EINVAL;
 709         }
 710
 711         if (k->idx != -1) {
 712                 if (k->defmgmt) {
 713                         if (k->idx < 4 || k->idx > 5)
 714                                 return -EINVAL;
 715                 } else if (k->def) {
 716                         if (k->idx < 0 || k->idx > 3)
 717                                 return -EINVAL;
 718                 } else {
 719                         if (k->idx < 0 || k->idx > 5)
 720                                 return -EINVAL;
 721                 }
 722         }
 723
 724         return 0;
 725 }
 726
 727 static struct cfg80211_cached_keys *
 728 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 729                        struct nlattr *keys, bool *no_ht)
 730 {
 731         struct key_parse parse;
 732         struct nlattr *key;
 733         struct cfg80211_cached_keys *result;
 734         int rem, err, def = 0;
 735
 736         result = kzalloc(sizeof(*result), GFP_KERNEL);
 737         if (!result)
 738                 return ERR_PTR(-ENOMEM);
 739
 740         result->def = -1;
 741         result->defmgmt = -1;
 742
 743         nla_for_each_nested(key, keys, rem) {
 744                 memset(&parse, 0, sizeof(parse));
 745                 parse.idx = -1;
 746
 747                 err = nl80211_parse_key_new(key, &parse);
 748                 if (err)
 749                         goto error;
 750                 err = -EINVAL;
 751                 if (!parse.p.key)
 752                         goto error;
 753                 if (parse.idx < 0 || parse.idx > 4)
 754                         goto error;
 755                 if (parse.def) {
 756                         if (def)
 757                                 goto error;
 758                         def = 1;
 759                         result->def = parse.idx;
 760                         if (!parse.def_uni || !parse.def_multi)
 761                                 goto error;
 762                 } else if (parse.defmgmt)
 763                         goto error;
 764                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 765                                                      parse.idx, false, NULL);
 766                 if (err)
 767                         goto error;
 768                 result->params[parse.idx].cipher = parse.p.cipher;
 769                 result->params[parse.idx].key_len = parse.p.key_len;
 770                 result->params[parse.idx].key = result->data[parse.idx];
 771                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 772
 773                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 774                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 775                         if (no_ht)
 776                                 *no_ht = true;
 777                 }
 778         }
 779
 780         return result;
 781  error:
 782         kfree(result);
 783         return ERR_PTR(err);
 784 }
 785
 786 static int nl80211_key_allowed(struct wireless_dev *wdev)
 787 {
 788         ASSERT_WDEV_LOCK(wdev);
 789
 790         switch (wdev->iftype) {
 791         case NL80211_IFTYPE_AP:
 792         case NL80211_IFTYPE_AP_VLAN:
 793         case NL80211_IFTYPE_P2P_GO:
 794         case NL80211_IFTYPE_MESH_POINT:
 795                 break;
 796         case NL80211_IFTYPE_ADHOC:
 797                 if (!wdev->current_bss)
 798                         return -ENOLINK;
 799                 break;
 800         case NL80211_IFTYPE_STATION:
 801         case NL80211_IFTYPE_P2P_CLIENT:
 802                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 803                         return -ENOLINK;
 804                 break;
 805         default:
 806                 return -EINVAL;
 807         }
 808
 809         return 0;
 810 }
 811
 812 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 813 {
 814         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 815         int i;
 816
 817         if (!nl_modes)
 818                 goto nla_put_failure;
 819
 820         i = 0;
 821         while (ifmodes) {
 822                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 823                         goto nla_put_failure;
 824                 ifmodes >>= 1;
 825                 i++;
 826         }
 827
 828         nla_nest_end(msg, nl_modes);
 829         return 0;
 830
 831 nla_put_failure:
 832         return -ENOBUFS;
 833 }
 834
 835 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 836                                           struct sk_buff *msg)
 837 {
 838         struct nlattr *nl_combis;
 839         int i, j;
 840
 841         nl_combis = nla_nest_start(msg,
 842                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 843         if (!nl_combis)
 844                 goto nla_put_failure;
 845
 846         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 847                 const struct ieee80211_iface_combination *c;
 848                 struct nlattr *nl_combi, *nl_limits;
 849
 850                 c = &wiphy->iface_combinations[i];
 851
 852                 nl_combi = nla_nest_start(msg, i + 1);
 853                 if (!nl_combi)
 854                         goto nla_put_failure;
 855
 856                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 857                 if (!nl_limits)
 858                         goto nla_put_failure;
 859
 860                 for (j = 0; j < c->n_limits; j++) {
 861                         struct nlattr *nl_limit;
 862
 863                         nl_limit = nla_nest_start(msg, j + 1);
 864                         if (!nl_limit)
 865                                 goto nla_put_failure;
 866                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 867                                         c->limits[j].max))
 868                                 goto nla_put_failure;
 869                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 870                                                 c->limits[j].types))
 871                                 goto nla_put_failure;
 872                         nla_nest_end(msg, nl_limit);
 873                 }
 874
 875                 nla_nest_end(msg, nl_limits);
 876
 877                 if (c->beacon_int_infra_match &&
 878                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 879                         goto nla_put_failure;
 880                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 881                                 c->num_different_channels) ||
 882                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 883                                 c->max_interfaces))
 884                         goto nla_put_failure;
 885
 886                 nla_nest_end(msg, nl_combi);
 887         }
 888
 889         nla_nest_end(msg, nl_combis);
 890
 891         return 0;
 892 nla_put_failure:
 893         return -ENOBUFS;
 894 }
 895
 896 #ifdef CONFIG_PM
 897 static int nl80211_send_wowlan(struct sk_buff *msg,
 898                                struct cfg80211_registered_device *dev)
 899 {
 900         struct nlattr *nl_wowlan;
 901
 902         if (!dev->wiphy.wowlan.flags && !dev->wiphy.wowlan.n_patterns)
 903                 return 0;
 904
 905         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
 906         if (!nl_wowlan)
 907                 return -ENOBUFS;
 908
 909         if (((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY) &&
 910              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
 911             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT) &&
 912              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
 913             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT) &&
 914              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
 915             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
 916              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
 917             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
 918              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
 919             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
 920              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
 921             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
 922              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
 923             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
 924              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
 925                 return -ENOBUFS;
 926
 927         if (dev->wiphy.wowlan.n_patterns) {
 928                 struct nl80211_wowlan_pattern_support pat = {
 929                         .max_patterns = dev->wiphy.wowlan.n_patterns,
 930                         .min_pattern_len = dev->wiphy.wowlan.pattern_min_len,
 931                         .max_pattern_len = dev->wiphy.wowlan.pattern_max_len,
 932                         .max_pkt_offset = dev->wiphy.wowlan.max_pkt_offset,
 933                 };
 934
 935                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
 936                             sizeof(pat), &pat))
 937                         return -ENOBUFS;
 938         }
 939
 940         nla_nest_end(msg, nl_wowlan);
 941
 942         return 0;
 943 }
 944 #endif
 945
 946 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
 947                                       struct ieee80211_supported_band *sband)
 948 {
 949         struct nlattr *nl_rates, *nl_rate;
 950         struct ieee80211_rate *rate;
 951         int i;
 952
 953         /* add HT info */
 954         if (sband->ht_cap.ht_supported &&
 955             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 956                      sizeof(sband->ht_cap.mcs),
 957                      &sband->ht_cap.mcs) ||
 958              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
 959                          sband->ht_cap.cap) ||
 960              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 961                         sband->ht_cap.ampdu_factor) ||
 962              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 963                         sband->ht_cap.ampdu_density)))
 964                 return -ENOBUFS;
 965
 966         /* add VHT info */
 967         if (sband->vht_cap.vht_supported &&
 968             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
 969                      sizeof(sband->vht_cap.vht_mcs),
 970                      &sband->vht_cap.vht_mcs) ||
 971              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
 972                          sband->vht_cap.cap)))
 973                 return -ENOBUFS;
 974
 975         /* add bitrates */
 976         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 977         if (!nl_rates)
 978                 return -ENOBUFS;
 979
 980         for (i = 0; i < sband->n_bitrates; i++) {
 981                 nl_rate = nla_nest_start(msg, i);
 982                 if (!nl_rate)
 983                         return -ENOBUFS;
 984
 985                 rate = &sband->bitrates[i];
 986                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
 987                                 rate->bitrate))
 988                         return -ENOBUFS;
 989                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
 990                     nla_put_flag(msg,
 991                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
 992                         return -ENOBUFS;
 993
 994                 nla_nest_end(msg, nl_rate);
 995         }
 996
 997         nla_nest_end(msg, nl_rates);
 998
 999         return 0;
1000 }
1001
1002 static int
1003 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1004                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1005 {
1006         u16 stypes;
1007         struct nlattr *nl_ftypes, *nl_ifs;
1008         enum nl80211_iftype ift;
1009         int i;
1010
1011         if (!mgmt_stypes)
1012                 return 0;
1013
1014         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1015         if (!nl_ifs)
1016                 return -ENOBUFS;
1017
1018         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1019                 nl_ftypes = nla_nest_start(msg, ift);
1020                 if (!nl_ftypes)
1021                         return -ENOBUFS;
1022                 i = 0;
1023                 stypes = mgmt_stypes[ift].tx;
1024                 while (stypes) {
1025                         if ((stypes & 1) &&
1026                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1027                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1028                                 return -ENOBUFS;
1029                         stypes >>= 1;
1030                         i++;
1031                 }
1032                 nla_nest_end(msg, nl_ftypes);
1033         }
1034
1035         nla_nest_end(msg, nl_ifs);
1036
1037         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1038         if (!nl_ifs)
1039                 return -ENOBUFS;
1040
1041         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1042                 nl_ftypes = nla_nest_start(msg, ift);
1043                 if (!nl_ftypes)
1044                         return -ENOBUFS;
1045                 i = 0;
1046                 stypes = mgmt_stypes[ift].rx;
1047                 while (stypes) {
1048                         if ((stypes & 1) &&
1049                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1050                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1051                                 return -ENOBUFS;
1052                         stypes >>= 1;
1053                         i++;
1054                 }
1055                 nla_nest_end(msg, nl_ftypes);
1056         }
1057         nla_nest_end(msg, nl_ifs);
1058
1059         return 0;
1060 }
1061
1062 static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
1063                               struct sk_buff *msg, u32 portid, u32 seq,
1064                               int flags, bool split, long *split_start,
1065                               long *band_start, long *chan_start)
1066 {
1067         void *hdr;
1068         struct nlattr *nl_bands, *nl_band;
1069         struct nlattr *nl_freqs, *nl_freq;
1070         struct nlattr *nl_cmds;
1071         enum ieee80211_band band;
1072         struct ieee80211_channel *chan;
1073         int i;
1074         const struct ieee80211_txrx_stypes *mgmt_stypes =
1075                                 dev->wiphy.mgmt_stypes;
1076         long start = 0, start_chan = 0, start_band = 0;
1077
1078         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
1079         if (!hdr)
1080                 return -ENOBUFS;
1081
1082         /* allow always using the variables */
1083         if (!split) {
1084                 split_start = &start;
1085                 band_start = &start_band;
1086                 chan_start = &start_chan;
1087         }
1088
1089         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
1090             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1091                            wiphy_name(&dev->wiphy)) ||
1092             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1093                         cfg80211_rdev_list_generation))
1094                 goto nla_put_failure;
1095
1096         switch (*split_start) {
1097         case 0:
1098                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1099                                dev->wiphy.retry_short) ||
1100                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1101                                dev->wiphy.retry_long) ||
1102                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1103                                 dev->wiphy.frag_threshold) ||
1104                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1105                                 dev->wiphy.rts_threshold) ||
1106                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1107                                dev->wiphy.coverage_class) ||
1108                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1109                                dev->wiphy.max_scan_ssids) ||
1110                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1111                                dev->wiphy.max_sched_scan_ssids) ||
1112                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1113                                 dev->wiphy.max_scan_ie_len) ||
1114                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1115                                 dev->wiphy.max_sched_scan_ie_len) ||
1116                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1117                                dev->wiphy.max_match_sets))
1118                         goto nla_put_failure;
1119
1120                 if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1121                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1122                         goto nla_put_failure;
1123                 if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1124                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1125                         goto nla_put_failure;
1126                 if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1127                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1128                         goto nla_put_failure;
1129                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1130                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1131                         goto nla_put_failure;
1132                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1133                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1134                         goto nla_put_failure;
1135                 if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1136                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1137                         goto nla_put_failure;
1138
1139                 (*split_start)++;
1140                 if (split)
1141                         break;
1142         case 1:
1143                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1144                             sizeof(u32) * dev->wiphy.n_cipher_suites,
1145                             dev->wiphy.cipher_suites))
1146                         goto nla_put_failure;
1147
1148                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1149                                dev->wiphy.max_num_pmkids))
1150                         goto nla_put_failure;
1151
1152                 if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1153                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1154                         goto nla_put_failure;
1155
1156                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1157                                 dev->wiphy.available_antennas_tx) ||
1158                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1159                                 dev->wiphy.available_antennas_rx))
1160                         goto nla_put_failure;
1161
1162                 if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1163                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1164                                 dev->wiphy.probe_resp_offload))
1165                         goto nla_put_failure;
1166
1167                 if ((dev->wiphy.available_antennas_tx ||
1168                      dev->wiphy.available_antennas_rx) &&
1169                     dev->ops->get_antenna) {
1170                         u32 tx_ant = 0, rx_ant = 0;
1171                         int res;
1172                         res = rdev_get_antenna(dev, &tx_ant, &rx_ant);
1173                         if (!res) {
1174                                 if (nla_put_u32(msg,
1175                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1176                                                 tx_ant) ||
1177                                     nla_put_u32(msg,
1178                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1179                                                 rx_ant))
1180                                         goto nla_put_failure;
1181                         }
1182                 }
1183
1184                 (*split_start)++;
1185                 if (split)
1186                         break;
1187         case 2:
1188                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1189                                         dev->wiphy.interface_modes))
1190                                 goto nla_put_failure;
1191                 (*split_start)++;
1192                 if (split)
1193                         break;
1194         case 3:
1195                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1196                 if (!nl_bands)
1197                         goto nla_put_failure;
1198
1199                 for (band = *band_start; band < IEEE80211_NUM_BANDS; band++) {
1200                         struct ieee80211_supported_band *sband;
1201
1202                         sband = dev->wiphy.bands[band];
1203
1204                         if (!sband)
1205                                 continue;
1206
1207                         nl_band = nla_nest_start(msg, band);
1208                         if (!nl_band)
1209                                 goto nla_put_failure;
1210
1211                         switch (*chan_start) {
1212                         case 0:
1213                                 if (nl80211_send_band_rateinfo(msg, sband))
1214                                         goto nla_put_failure;
1215                                 (*chan_start)++;
1216                                 if (split)
1217                                         break;
1218                         default:
1219                                 /* add frequencies */
1220                                 nl_freqs = nla_nest_start(
1221                                         msg, NL80211_BAND_ATTR_FREQS);
1222                                 if (!nl_freqs)
1223                                         goto nla_put_failure;
1224
1225                                 for (i = *chan_start - 1;
1226                                      i < sband->n_channels;
1227                                      i++) {
1228                                         nl_freq = nla_nest_start(msg, i);
1229                                         if (!nl_freq)
1230                                                 goto nla_put_failure;
1231
1232                                         chan = &sband->channels[i];
1233
1234                                         if (nl80211_msg_put_channel(msg, chan))
1235                                                 goto nla_put_failure;
1236
1237                                         nla_nest_end(msg, nl_freq);
1238                                         if (split)
1239                                                 break;
1240                                 }
1241                                 if (i < sband->n_channels)
1242                                         *chan_start = i + 2;
1243                                 else
1244                                         *chan_start = 0;
1245                                 nla_nest_end(msg, nl_freqs);
1246                         }
1247
1248                         nla_nest_end(msg, nl_band);
1249
1250                         if (split) {
1251                                 /* start again here */
1252                                 if (*chan_start)
1253                                         band--;
1254                                 break;
1255                         }
1256                 }
1257                 nla_nest_end(msg, nl_bands);
1258
1259                 if (band < IEEE80211_NUM_BANDS)
1260                         *band_start = band + 1;
1261                 else
1262                         *band_start = 0;
1263
1264                 /* if bands & channels are done, continue outside */
1265                 if (*band_start == 0 && *chan_start == 0)
1266                         (*split_start)++;
1267                 if (split)
1268                         break;
1269         case 4:
1270                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1271                 if (!nl_cmds)
1272                         goto nla_put_failure;
1273
1274                 i = 0;
1275 #define CMD(op, n)                                                      \
1276                  do {                                                   \
1277                         if (dev->ops->op) {                             \
1278                                 i++;                                    \
1279                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1280                                         goto nla_put_failure;           \
1281                         }                                               \
1282                 } while (0)
1283
1284                 CMD(add_virtual_intf, NEW_INTERFACE);
1285                 CMD(change_virtual_intf, SET_INTERFACE);
1286                 CMD(add_key, NEW_KEY);
1287                 CMD(start_ap, START_AP);
1288                 CMD(add_station, NEW_STATION);
1289                 CMD(add_mpath, NEW_MPATH);
1290                 CMD(update_mesh_config, SET_MESH_CONFIG);
1291                 CMD(change_bss, SET_BSS);
1292                 CMD(auth, AUTHENTICATE);
1293                 CMD(assoc, ASSOCIATE);
1294                 CMD(deauth, DEAUTHENTICATE);
1295                 CMD(disassoc, DISASSOCIATE);
1296                 CMD(join_ibss, JOIN_IBSS);
1297                 CMD(join_mesh, JOIN_MESH);
1298                 CMD(set_pmksa, SET_PMKSA);
1299                 CMD(del_pmksa, DEL_PMKSA);
1300                 CMD(flush_pmksa, FLUSH_PMKSA);
1301                 if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1302                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1303                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1304                 CMD(mgmt_tx, FRAME);
1305                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1306                 if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1307                         i++;
1308                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1309                                 goto nla_put_failure;
1310                 }
1311                 if (dev->ops->set_monitor_channel || dev->ops->start_ap ||
1312                     dev->ops->join_mesh) {
1313                         i++;
1314                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1315                                 goto nla_put_failure;
1316                 }
1317                 CMD(set_wds_peer, SET_WDS_PEER);
1318                 if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1319                         CMD(tdls_mgmt, TDLS_MGMT);
1320                         CMD(tdls_oper, TDLS_OPER);
1321                 }
1322                 if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1323                         CMD(sched_scan_start, START_SCHED_SCAN);
1324                 CMD(probe_client, PROBE_CLIENT);
1325                 CMD(set_noack_map, SET_NOACK_MAP);
1326                 if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1327                         i++;
1328                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1329                                 goto nla_put_failure;
1330                 }
1331                 CMD(start_p2p_device, START_P2P_DEVICE);
1332                 CMD(set_mcast_rate, SET_MCAST_RATE);
1333
1334 #ifdef CONFIG_NL80211_TESTMODE
1335                 CMD(testmode_cmd, TESTMODE);
1336 #endif
1337
1338 #undef CMD
1339
1340                 if (dev->ops->connect || dev->ops->auth) {
1341                         i++;
1342                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1343                                 goto nla_put_failure;
1344                 }
1345
1346                 if (dev->ops->disconnect || dev->ops->deauth) {
1347                         i++;
1348                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1349                                 goto nla_put_failure;
1350                 }
1351
1352                 nla_nest_end(msg, nl_cmds);
1353                 (*split_start)++;
1354                 if (split)
1355                         break;
1356         case 5:
1357                 if (dev->ops->remain_on_channel &&
1358                     (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1359                     nla_put_u32(msg,
1360                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1361                                 dev->wiphy.max_remain_on_channel_duration))
1362                         goto nla_put_failure;
1363
1364                 if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1365                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1366                         goto nla_put_failure;
1367
1368                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1369                         goto nla_put_failure;
1370                 (*split_start)++;
1371                 if (split)
1372                         break;
1373         case 6:
1374 #ifdef CONFIG_PM
1375                 if (nl80211_send_wowlan(msg, dev))
1376                         goto nla_put_failure;
1377                 (*split_start)++;
1378                 if (split)
1379                         break;
1380 #else
1381                 (*split_start)++;
1382 #endif
1383         case 7:
1384                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1385                                         dev->wiphy.software_iftypes))
1386                         goto nla_put_failure;
1387
1388                 if (nl80211_put_iface_combinations(&dev->wiphy, msg))
1389                         goto nla_put_failure;
1390
1391                 (*split_start)++;
1392                 if (split)
1393                         break;
1394         case 8:
1395                 if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1396                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1397                                 dev->wiphy.ap_sme_capa))
1398                         goto nla_put_failure;
1399
1400                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS,
1401                                 dev->wiphy.features))
1402                         goto nla_put_failure;
1403
1404                 if (dev->wiphy.ht_capa_mod_mask &&
1405                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1406                             sizeof(*dev->wiphy.ht_capa_mod_mask),
1407                             dev->wiphy.ht_capa_mod_mask))
1408                         goto nla_put_failure;
1409
1410                 if (dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1411                     dev->wiphy.max_acl_mac_addrs &&
1412                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1413                                 dev->wiphy.max_acl_mac_addrs))
1414                         goto nla_put_failure;
1415
1416                 /*
1417                  * Any information below this point is only available to
1418                  * applications that can deal with it being split. This
1419                  * helps ensure that newly added capabilities don't break
1420                  * older tools by overrunning their buffers.
1421                  *
1422                  * We still increment split_start so that in the split
1423                  * case we'll continue with more data in the next round,
1424                  * but break unconditionally so unsplit data stops here.
1425                  */
1426                 (*split_start)++;
1427                 break;
1428         case 9:
1429                 /* placeholder */
1430
1431                 /* done */
1432                 *split_start = 0;
1433                 break;
1434         }
1435         return genlmsg_end(msg, hdr);
1436
1437  nla_put_failure:
1438         genlmsg_cancel(msg, hdr);
1439         return -EMSGSIZE;
1440 }
1441
1442 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1443 {
1444         int idx = 0, ret;
1445         int start = cb->args[0];
1446         struct cfg80211_registered_device *dev;
1447         s64 filter_wiphy = -1;
1448         bool split = false;
1449         struct nlattr **tb = nl80211_fam.attrbuf;
1450         int res;
1451
1452         mutex_lock(&cfg80211_mutex);
1453         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1454                           tb, nl80211_fam.maxattr, nl80211_policy);
1455         if (res == 0) {
1456                 split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1457                 if (tb[NL80211_ATTR_WIPHY])
1458                         filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1459                 if (tb[NL80211_ATTR_WDEV])
1460                         filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1461                 if (tb[NL80211_ATTR_IFINDEX]) {
1462                         struct net_device *netdev;
1463                         int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1464
1465                         netdev = dev_get_by_index(sock_net(skb->sk), ifidx);
1466                         if (!netdev) {
1467                                 mutex_unlock(&cfg80211_mutex);
1468                                 return -ENODEV;
1469                         }
1470                         if (netdev->ieee80211_ptr) {
1471                                 dev = wiphy_to_dev(
1472                                         netdev->ieee80211_ptr->wiphy);
1473                                 filter_wiphy = dev->wiphy_idx;
1474                         }
1475                         dev_put(netdev);
1476                 }
1477         }
1478
1479         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1480                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1481                         continue;
1482                 if (++idx <= start)
1483                         continue;
1484                 if (filter_wiphy != -1 && dev->wiphy_idx != filter_wiphy)
1485                         continue;
1486                 /* attempt to fit multiple wiphy data chunks into the skb */
1487                 do {
1488                         ret = nl80211_send_wiphy(dev, skb,
1489                                                  NETLINK_CB(cb->skb).portid,
1490                                                  cb->nlh->nlmsg_seq,
1491                                                  NLM_F_MULTI,
1492                                                  split, &cb->args[1],
1493                                                  &cb->args[2],
1494                                                  &cb->args[3]);
1495                         if (ret < 0) {
1496                                 /*
1497                                  * If sending the wiphy data didn't fit (ENOBUFS
1498                                  * or EMSGSIZE returned), this SKB is still
1499                                  * empty (so it's not too big because another
1500                                  * wiphy dataset is already in the skb) and
1501                                  * we've not tried to adjust the dump allocation
1502                                  * yet ... then adjust the alloc size to be
1503                                  * bigger, and return 1 but with the empty skb.
1504                                  * This results in an empty message being RX'ed
1505                                  * in userspace, but that is ignored.
1506                                  *
1507                                  * We can then retry with the larger buffer.
1508                                  */
1509                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1510                                     !skb->len &&
1511                                     cb->min_dump_alloc < 4096) {
1512                                         cb->min_dump_alloc = 4096;
1513                                         mutex_unlock(&cfg80211_mutex);
1514                                         return 1;
1515                                 }
1516                                 idx--;
1517                                 break;
1518                         }
1519                 } while (cb->args[1] > 0);
1520                 break;
1521         }
1522         mutex_unlock(&cfg80211_mutex);
1523
1524         cb->args[0] = idx;
1525
1526         return skb->len;
1527 }
1528
1529 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1530 {
1531         struct sk_buff *msg;
1532         struct cfg80211_registered_device *dev = info->user_ptr[0];
1533
1534         msg = nlmsg_new(4096, GFP_KERNEL);
1535         if (!msg)
1536                 return -ENOMEM;
1537
1538         if (nl80211_send_wiphy(dev, msg, info->snd_portid, info->snd_seq, 0,
1539                                false, NULL, NULL, NULL) < 0) {
1540                 nlmsg_free(msg);
1541                 return -ENOBUFS;
1542         }
1543
1544         return genlmsg_reply(msg, info);
1545 }
1546
1547 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1548         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1549         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1550         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1551         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1552         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1553 };
1554
1555 static int parse_txq_params(struct nlattr *tb[],
1556                             struct ieee80211_txq_params *txq_params)
1557 {
1558         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1559             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1560             !tb[NL80211_TXQ_ATTR_AIFS])
1561                 return -EINVAL;
1562
1563         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1564         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1565         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1566         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1567         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1568
1569         if (txq_params->ac >= NL80211_NUM_ACS)
1570                 return -EINVAL;
1571
1572         return 0;
1573 }
1574
1575 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1576 {
1577         /*
1578          * You can only set the channel explicitly for WDS interfaces,
1579          * all others have their channel managed via their respective
1580          * "establish a connection" command (connect, join, ...)
1581          *
1582          * For AP/GO and mesh mode, the channel can be set with the
1583          * channel userspace API, but is only stored and passed to the
1584          * low-level driver when the AP starts or the mesh is joined.
1585          * This is for backward compatibility, userspace can also give
1586          * the channel in the start-ap or join-mesh commands instead.
1587          *
1588          * Monitors are special as they are normally slaved to
1589          * whatever else is going on, so they have their own special
1590          * operation to set the monitor channel if possible.
1591          */
1592         return !wdev ||
1593                 wdev->iftype == NL80211_IFTYPE_AP ||
1594                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1595                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1596                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1597 }
1598
1599 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1600                                  struct genl_info *info,
1601                                  struct cfg80211_chan_def *chandef)
1602 {
1603         u32 control_freq;
1604
1605         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1606                 return -EINVAL;
1607
1608         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1609
1610         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1611         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1612         chandef->center_freq1 = control_freq;
1613         chandef->center_freq2 = 0;
1614
1615         /* Primary channel not allowed */
1616         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1617                 return -EINVAL;
1618
1619         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1620                 enum nl80211_channel_type chantype;
1621
1622                 chantype = nla_get_u32(
1623                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1624
1625                 switch (chantype) {
1626                 case NL80211_CHAN_NO_HT:
1627                 case NL80211_CHAN_HT20:
1628                 case NL80211_CHAN_HT40PLUS:
1629                 case NL80211_CHAN_HT40MINUS:
1630                         cfg80211_chandef_create(chandef, chandef->chan,
1631                                                 chantype);
1632                         break;
1633                 default:
1634                         return -EINVAL;
1635                 }
1636         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1637                 chandef->width =
1638                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1639                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1640                         chandef->center_freq1 =
1641                                 nla_get_u32(
1642                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1643                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1644                         chandef->center_freq2 =
1645                                 nla_get_u32(
1646                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1647         }
1648
1649         if (!cfg80211_chandef_valid(chandef))
1650                 return -EINVAL;
1651
1652         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1653                                      IEEE80211_CHAN_DISABLED))
1654                 return -EINVAL;
1655
1656         return 0;
1657 }
1658
1659 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1660                                  struct wireless_dev *wdev,
1661                                  struct genl_info *info)
1662 {
1663         struct cfg80211_chan_def chandef;
1664         int result;
1665         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1666
1667         if (wdev)
1668                 iftype = wdev->iftype;
1669
1670         if (!nl80211_can_set_dev_channel(wdev))
1671                 return -EOPNOTSUPP;
1672
1673         result = nl80211_parse_chandef(rdev, info, &chandef);
1674         if (result)
1675                 return result;
1676
1677         mutex_lock(&rdev->devlist_mtx);
1678         switch (iftype) {
1679         case NL80211_IFTYPE_AP:
1680         case NL80211_IFTYPE_P2P_GO:
1681                 if (wdev->beacon_interval) {
1682                         result = -EBUSY;
1683                         break;
1684                 }
1685                 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef)) {
1686                         result = -EINVAL;
1687                         break;
1688                 }
1689                 wdev->preset_chandef = chandef;
1690                 result = 0;
1691                 break;
1692         case NL80211_IFTYPE_MESH_POINT:
1693                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
1694                 break;
1695         case NL80211_IFTYPE_MONITOR:
1696                 result = cfg80211_set_monitor_channel(rdev, &chandef);
1697                 break;
1698         default:
1699                 result = -EINVAL;
1700         }
1701         mutex_unlock(&rdev->devlist_mtx);
1702
1703         return result;
1704 }
1705
1706 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1707 {
1708         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1709         struct net_device *netdev = info->user_ptr[1];
1710
1711         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1712 }
1713
1714 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1715 {
1716         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1717         struct net_device *dev = info->user_ptr[1];
1718         struct wireless_dev *wdev = dev->ieee80211_ptr;
1719         const u8 *bssid;
1720
1721         if (!info->attrs[NL80211_ATTR_MAC])
1722                 return -EINVAL;
1723
1724         if (netif_running(dev))
1725                 return -EBUSY;
1726
1727         if (!rdev->ops->set_wds_peer)
1728                 return -EOPNOTSUPP;
1729
1730         if (wdev->iftype != NL80211_IFTYPE_WDS)
1731                 return -EOPNOTSUPP;
1732
1733         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1734         return rdev_set_wds_peer(rdev, dev, bssid);
1735 }
1736
1737
1738 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1739 {
1740         struct cfg80211_registered_device *rdev;
1741         struct net_device *netdev = NULL;
1742         struct wireless_dev *wdev;
1743         int result = 0, rem_txq_params = 0;
1744         struct nlattr *nl_txq_params;
1745         u32 changed;
1746         u8 retry_short = 0, retry_long = 0;
1747         u32 frag_threshold = 0, rts_threshold = 0;
1748         u8 coverage_class = 0;
1749
1750         /*
1751          * Try to find the wiphy and netdev. Normally this
1752          * function shouldn't need the netdev, but this is
1753          * done for backward compatibility -- previously
1754          * setting the channel was done per wiphy, but now
1755          * it is per netdev. Previous userland like hostapd
1756          * also passed a netdev to set_wiphy, so that it is
1757          * possible to let that go to the right netdev!
1758          */
1759         mutex_lock(&cfg80211_mutex);
1760
1761         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1762                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1763
1764                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1765                 if (netdev && netdev->ieee80211_ptr) {
1766                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1767                         mutex_lock(&rdev->mtx);
1768                 } else
1769                         netdev = NULL;
1770         }
1771
1772         if (!netdev) {
1773                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
1774                                                   info->attrs);
1775                 if (IS_ERR(rdev)) {
1776                         mutex_unlock(&cfg80211_mutex);
1777                         return PTR_ERR(rdev);
1778                 }
1779                 wdev = NULL;
1780                 netdev = NULL;
1781                 result = 0;
1782
1783                 mutex_lock(&rdev->mtx);
1784         } else
1785                 wdev = netdev->ieee80211_ptr;
1786
1787         /*
1788          * end workaround code, by now the rdev is available
1789          * and locked, and wdev may or may not be NULL.
1790          */
1791
1792         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1793                 result = cfg80211_dev_rename(
1794                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1795
1796         mutex_unlock(&cfg80211_mutex);
1797
1798         if (result)
1799                 goto bad_res;
1800
1801         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1802                 struct ieee80211_txq_params txq_params;
1803                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1804
1805                 if (!rdev->ops->set_txq_params) {
1806                         result = -EOPNOTSUPP;
1807                         goto bad_res;
1808                 }
1809
1810                 if (!netdev) {
1811                         result = -EINVAL;
1812                         goto bad_res;
1813                 }
1814
1815                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1816                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
1817                         result = -EINVAL;
1818                         goto bad_res;
1819                 }
1820
1821                 if (!netif_running(netdev)) {
1822                         result = -ENETDOWN;
1823                         goto bad_res;
1824                 }
1825
1826                 nla_for_each_nested(nl_txq_params,
1827                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1828                                     rem_txq_params) {
1829                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1830                                   nla_data(nl_txq_params),
1831                                   nla_len(nl_txq_params),
1832                                   txq_params_policy);
1833                         result = parse_txq_params(tb, &txq_params);
1834                         if (result)
1835                                 goto bad_res;
1836
1837                         result = rdev_set_txq_params(rdev, netdev,
1838                                                      &txq_params);
1839                         if (result)
1840                                 goto bad_res;
1841                 }
1842         }
1843
1844         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1845                 result = __nl80211_set_channel(rdev,
1846                                 nl80211_can_set_dev_channel(wdev) ? wdev : NULL,
1847                                 info);
1848                 if (result)
1849                         goto bad_res;
1850         }
1851
1852         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1853                 struct wireless_dev *txp_wdev = wdev;
1854                 enum nl80211_tx_power_setting type;
1855                 int idx, mbm = 0;
1856
1857                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
1858                         txp_wdev = NULL;
1859
1860                 if (!rdev->ops->set_tx_power) {
1861                         result = -EOPNOTSUPP;
1862                         goto bad_res;
1863                 }
1864
1865                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1866                 type = nla_get_u32(info->attrs[idx]);
1867
1868                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1869                     (type != NL80211_TX_POWER_AUTOMATIC)) {
1870                         result = -EINVAL;
1871                         goto bad_res;
1872                 }
1873
1874                 if (type != NL80211_TX_POWER_AUTOMATIC) {
1875                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1876                         mbm = nla_get_u32(info->attrs[idx]);
1877                 }
1878
1879                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
1880                 if (result)
1881                         goto bad_res;
1882         }
1883
1884         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
1885             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
1886                 u32 tx_ant, rx_ant;
1887                 if ((!rdev->wiphy.available_antennas_tx &&
1888                      !rdev->wiphy.available_antennas_rx) ||
1889                     !rdev->ops->set_antenna) {
1890                         result = -EOPNOTSUPP;
1891                         goto bad_res;
1892                 }
1893
1894                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
1895                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
1896
1897                 /* reject antenna configurations which don't match the
1898                  * available antenna masks, except for the "all" mask */
1899                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
1900                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
1901                         result = -EINVAL;
1902                         goto bad_res;
1903                 }
1904
1905                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
1906                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
1907
1908                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
1909                 if (result)
1910                         goto bad_res;
1911         }
1912
1913         changed = 0;
1914
1915         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
1916                 retry_short = nla_get_u8(
1917                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
1918                 if (retry_short == 0) {
1919                         result = -EINVAL;
1920                         goto bad_res;
1921                 }
1922                 changed |= WIPHY_PARAM_RETRY_SHORT;
1923         }
1924
1925         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
1926                 retry_long = nla_get_u8(
1927                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
1928                 if (retry_long == 0) {
1929                         result = -EINVAL;
1930                         goto bad_res;
1931                 }
1932                 changed |= WIPHY_PARAM_RETRY_LONG;
1933         }
1934
1935         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
1936                 frag_threshold = nla_get_u32(
1937                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
1938                 if (frag_threshold < 256) {
1939                         result = -EINVAL;
1940                         goto bad_res;
1941                 }
1942                 if (frag_threshold != (u32) -1) {
1943                         /*
1944                          * Fragments (apart from the last one) are required to
1945                          * have even length. Make the fragmentation code
1946                          * simpler by stripping LSB should someone try to use
1947                          * odd threshold value.
1948                          */
1949                         frag_threshold &= ~0x1;
1950                 }
1951                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
1952         }
1953
1954         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
1955                 rts_threshold = nla_get_u32(
1956                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
1957                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
1958         }
1959
1960         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
1961                 coverage_class = nla_get_u8(
1962                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
1963                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
1964         }
1965
1966         if (changed) {
1967                 u8 old_retry_short, old_retry_long;
1968                 u32 old_frag_threshold, old_rts_threshold;
1969                 u8 old_coverage_class;
1970
1971                 if (!rdev->ops->set_wiphy_params) {
1972                         result = -EOPNOTSUPP;
1973                         goto bad_res;
1974                 }
1975
1976                 old_retry_short = rdev->wiphy.retry_short;
1977                 old_retry_long = rdev->wiphy.retry_long;
1978                 old_frag_threshold = rdev->wiphy.frag_threshold;
1979                 old_rts_threshold = rdev->wiphy.rts_threshold;
1980                 old_coverage_class = rdev->wiphy.coverage_class;
1981
1982                 if (changed & WIPHY_PARAM_RETRY_SHORT)
1983                         rdev->wiphy.retry_short = retry_short;
1984                 if (changed & WIPHY_PARAM_RETRY_LONG)
1985                         rdev->wiphy.retry_long = retry_long;
1986                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
1987                         rdev->wiphy.frag_threshold = frag_threshold;
1988                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
1989                         rdev->wiphy.rts_threshold = rts_threshold;
1990                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
1991                         rdev->wiphy.coverage_class = coverage_class;
1992
1993                 result = rdev_set_wiphy_params(rdev, changed);
1994                 if (result) {
1995                         rdev->wiphy.retry_short = old_retry_short;
1996                         rdev->wiphy.retry_long = old_retry_long;
1997                         rdev->wiphy.frag_threshold = old_frag_threshold;
1998                         rdev->wiphy.rts_threshold = old_rts_threshold;
1999                         rdev->wiphy.coverage_class = old_coverage_class;
2000                 }
2001         }
2002
2003  bad_res:
2004         mutex_unlock(&rdev->mtx);
2005         if (netdev)
2006                 dev_put(netdev);
2007         return result;
2008 }
2009
2010 static inline u64 wdev_id(struct wireless_dev *wdev)
2011 {
2012         return (u64)wdev->identifier |
2013                ((u64)wiphy_to_dev(wdev->wiphy)->wiphy_idx << 32);
2014 }
2015
2016 static int nl80211_send_chandef(struct sk_buff *msg,
2017                                  struct cfg80211_chan_def *chandef)
2018 {
2019         WARN_ON(!cfg80211_chandef_valid(chandef));
2020
2021         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2022                         chandef->chan->center_freq))
2023                 return -ENOBUFS;
2024         switch (chandef->width) {
2025         case NL80211_CHAN_WIDTH_20_NOHT:
2026         case NL80211_CHAN_WIDTH_20:
2027         case NL80211_CHAN_WIDTH_40:
2028                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2029                                 cfg80211_get_chandef_type(chandef)))
2030                         return -ENOBUFS;
2031                 break;
2032         default:
2033                 break;
2034         }
2035         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2036                 return -ENOBUFS;
2037         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2038                 return -ENOBUFS;
2039         if (chandef->center_freq2 &&
2040             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2041                 return -ENOBUFS;
2042         return 0;
2043 }
2044
2045 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2046                               struct cfg80211_registered_device *rdev,
2047                               struct wireless_dev *wdev)
2048 {
2049         struct net_device *dev = wdev->netdev;
2050         void *hdr;
2051
2052         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
2053         if (!hdr)
2054                 return -1;
2055
2056         if (dev &&
2057             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2058              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2059                 goto nla_put_failure;
2060
2061         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2062             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2063             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2064             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2065             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2066                         rdev->devlist_generation ^
2067                         (cfg80211_rdev_list_generation << 2)))
2068                 goto nla_put_failure;
2069
2070         if (rdev->ops->get_channel) {
2071                 int ret;
2072                 struct cfg80211_chan_def chandef;
2073
2074                 ret = rdev_get_channel(rdev, wdev, &chandef);
2075                 if (ret == 0) {
2076                         if (nl80211_send_chandef(msg, &chandef))
2077                                 goto nla_put_failure;
2078                 }
2079         }
2080
2081         if (wdev->ssid_len) {
2082                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2083                         goto nla_put_failure;
2084         }
2085
2086         return genlmsg_end(msg, hdr);
2087
2088  nla_put_failure:
2089         genlmsg_cancel(msg, hdr);
2090         return -EMSGSIZE;
2091 }
2092
2093 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2094 {
2095         int wp_idx = 0;
2096         int if_idx = 0;
2097         int wp_start = cb->args[0];
2098         int if_start = cb->args[1];
2099         struct cfg80211_registered_device *rdev;
2100         struct wireless_dev *wdev;
2101
2102         mutex_lock(&cfg80211_mutex);
2103         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2104                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2105                         continue;
2106                 if (wp_idx < wp_start) {
2107                         wp_idx++;
2108                         continue;
2109                 }
2110                 if_idx = 0;
2111
2112                 mutex_lock(&rdev->devlist_mtx);
2113                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
2114                         if (if_idx < if_start) {
2115                                 if_idx++;
2116                                 continue;
2117                         }
2118                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2119                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2120                                                rdev, wdev) < 0) {
2121                                 mutex_unlock(&rdev->devlist_mtx);
2122                                 goto out;
2123                         }
2124                         if_idx++;
2125                 }
2126                 mutex_unlock(&rdev->devlist_mtx);
2127
2128                 wp_idx++;
2129         }
2130  out:
2131         mutex_unlock(&cfg80211_mutex);
2132
2133         cb->args[0] = wp_idx;
2134         cb->args[1] = if_idx;
2135
2136         return skb->len;
2137 }
2138
2139 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2140 {
2141         struct sk_buff *msg;
2142         struct cfg80211_registered_device *dev = info->user_ptr[0];
2143         struct wireless_dev *wdev = info->user_ptr[1];
2144
2145         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2146         if (!msg)
2147                 return -ENOMEM;
2148
2149         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2150                                dev, wdev) < 0) {
2151                 nlmsg_free(msg);
2152                 return -ENOBUFS;
2153         }
2154
2155         return genlmsg_reply(msg, info);
2156 }
2157
2158 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2159         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2160         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2161         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2162         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2163         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2164 };
2165
2166 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2167 {
2168         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2169         int flag;
2170
2171         *mntrflags = 0;
2172
2173         if (!nla)
2174                 return -EINVAL;
2175
2176         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2177                              nla, mntr_flags_policy))
2178                 return -EINVAL;
2179
2180         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2181                 if (flags[flag])
2182                         *mntrflags |= (1<<flag);
2183
2184         return 0;
2185 }
2186
2187 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2188                                struct net_device *netdev, u8 use_4addr,
2189                                enum nl80211_iftype iftype)
2190 {
2191         if (!use_4addr) {
2192                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2193                         return -EBUSY;
2194                 return 0;
2195         }
2196
2197         switch (iftype) {
2198         case NL80211_IFTYPE_AP_VLAN:
2199                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2200                         return 0;
2201                 break;
2202         case NL80211_IFTYPE_STATION:
2203                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2204                         return 0;
2205                 break;
2206         default:
2207                 break;
2208         }
2209
2210         return -EOPNOTSUPP;
2211 }
2212
2213 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2214 {
2215         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2216         struct vif_params params;
2217         int err;
2218         enum nl80211_iftype otype, ntype;
2219         struct net_device *dev = info->user_ptr[1];
2220         u32 _flags, *flags = NULL;
2221         bool change = false;
2222
2223         memset(&params, 0, sizeof(params));
2224
2225         otype = ntype = dev->ieee80211_ptr->iftype;
2226
2227         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2228                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2229                 if (otype != ntype)
2230                         change = true;
2231                 if (ntype > NL80211_IFTYPE_MAX)
2232                         return -EINVAL;
2233         }
2234
2235         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2236                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2237
2238                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2239                         return -EINVAL;
2240                 if (netif_running(dev))
2241                         return -EBUSY;
2242
2243                 wdev_lock(wdev);
2244                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2245                              IEEE80211_MAX_MESH_ID_LEN);
2246                 wdev->mesh_id_up_len =
2247                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2248                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2249                        wdev->mesh_id_up_len);
2250                 wdev_unlock(wdev);
2251         }
2252
2253         if (info->attrs[NL80211_ATTR_4ADDR]) {
2254                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2255                 change = true;
2256                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2257                 if (err)
2258                         return err;
2259         } else {
2260                 params.use_4addr = -1;
2261         }
2262
2263         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2264                 if (ntype != NL80211_IFTYPE_MONITOR)
2265                         return -EINVAL;
2266                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2267                                           &_flags);
2268                 if (err)
2269                         return err;
2270
2271                 flags = &_flags;
2272                 change = true;
2273         }
2274
2275         if (change)
2276                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2277         else
2278                 err = 0;
2279
2280         if (!err && params.use_4addr != -1)
2281                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2282
2283         return err;
2284 }
2285
2286 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2287 {
2288         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2289         struct vif_params params;
2290         struct wireless_dev *wdev;
2291         struct sk_buff *msg;
2292         int err;
2293         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2294         u32 flags;
2295
2296         memset(&params, 0, sizeof(params));
2297
2298         if (!info->attrs[NL80211_ATTR_IFNAME])
2299                 return -EINVAL;
2300
2301         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2302                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2303                 if (type > NL80211_IFTYPE_MAX)
2304                         return -EINVAL;
2305         }
2306
2307         if (!rdev->ops->add_virtual_intf ||
2308             !(rdev->wiphy.interface_modes & (1 << type)))
2309                 return -EOPNOTSUPP;
2310
2311         if (type == NL80211_IFTYPE_P2P_DEVICE && info->attrs[NL80211_ATTR_MAC]) {
2312                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2313                            ETH_ALEN);
2314                 if (!is_valid_ether_addr(params.macaddr))
2315                         return -EADDRNOTAVAIL;
2316         }
2317
2318         if (info->attrs[NL80211_ATTR_4ADDR]) {
2319                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2320                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2321                 if (err)
2322                         return err;
2323         }
2324
2325         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2326         if (!msg)
2327                 return -ENOMEM;
2328
2329         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2330                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2331                                   &flags);
2332         wdev = rdev_add_virtual_intf(rdev,
2333                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2334                                 type, err ? NULL : &flags, &params);
2335         if (IS_ERR(wdev)) {
2336                 nlmsg_free(msg);
2337                 return PTR_ERR(wdev);
2338         }
2339
2340         switch (type) {
2341         case NL80211_IFTYPE_MESH_POINT:
2342                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2343                         break;
2344                 wdev_lock(wdev);
2345                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2346                              IEEE80211_MAX_MESH_ID_LEN);
2347                 wdev->mesh_id_up_len =
2348                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2349                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2350                        wdev->mesh_id_up_len);
2351                 wdev_unlock(wdev);
2352                 break;
2353         case NL80211_IFTYPE_P2P_DEVICE:
2354                 /*
2355                  * P2P Device doesn't have a netdev, so doesn't go
2356                  * through the netdev notifier and must be added here
2357                  */
2358                 mutex_init(&wdev->mtx);
2359                 INIT_LIST_HEAD(&wdev->event_list);
2360                 spin_lock_init(&wdev->event_lock);
2361                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2362                 spin_lock_init(&wdev->mgmt_registrations_lock);
2363
2364                 mutex_lock(&rdev->devlist_mtx);
2365                 wdev->identifier = ++rdev->wdev_id;
2366                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2367                 rdev->devlist_generation++;
2368                 mutex_unlock(&rdev->devlist_mtx);
2369                 break;
2370         default:
2371                 break;
2372         }
2373
2374         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2375                                rdev, wdev) < 0) {
2376                 nlmsg_free(msg);
2377                 return -ENOBUFS;
2378         }
2379
2380         return genlmsg_reply(msg, info);
2381 }
2382
2383 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2384 {
2385         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2386         struct wireless_dev *wdev = info->user_ptr[1];
2387
2388         if (!rdev->ops->del_virtual_intf)
2389                 return -EOPNOTSUPP;
2390
2391         /*
2392          * If we remove a wireless device without a netdev then clear
2393          * user_ptr[1] so that nl80211_post_doit won't dereference it
2394          * to check if it needs to do dev_put(). Otherwise it crashes
2395          * since the wdev has been freed, unlike with a netdev where
2396          * we need the dev_put() for the netdev to really be freed.
2397          */
2398         if (!wdev->netdev)
2399                 info->user_ptr[1] = NULL;
2400
2401         return rdev_del_virtual_intf(rdev, wdev);
2402 }
2403
2404 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2405 {
2406         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2407         struct net_device *dev = info->user_ptr[1];
2408         u16 noack_map;
2409
2410         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2411                 return -EINVAL;
2412
2413         if (!rdev->ops->set_noack_map)
2414                 return -EOPNOTSUPP;
2415
2416         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2417
2418         return rdev_set_noack_map(rdev, dev, noack_map);
2419 }
2420
2421 struct get_key_cookie {
2422         struct sk_buff *msg;
2423         int error;
2424         int idx;
2425 };
2426
2427 static void get_key_callback(void *c, struct key_params *params)
2428 {
2429         struct nlattr *key;
2430         struct get_key_cookie *cookie = c;
2431
2432         if ((params->key &&
2433              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2434                      params->key_len, params->key)) ||
2435             (params->seq &&
2436              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2437                      params->seq_len, params->seq)) ||
2438             (params->cipher &&
2439              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2440                          params->cipher)))
2441                 goto nla_put_failure;
2442
2443         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2444         if (!key)
2445                 goto nla_put_failure;
2446
2447         if ((params->key &&
2448              nla_put(cookie->msg, NL80211_KEY_DATA,
2449                      params->key_len, params->key)) ||
2450             (params->seq &&
2451              nla_put(cookie->msg, NL80211_KEY_SEQ,
2452                      params->seq_len, params->seq)) ||
2453             (params->cipher &&
2454              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2455                          params->cipher)))
2456                 goto nla_put_failure;
2457
2458         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2459                 goto nla_put_failure;
2460
2461         nla_nest_end(cookie->msg, key);
2462
2463         return;
2464  nla_put_failure:
2465         cookie->error = 1;
2466 }
2467
2468 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2469 {
2470         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2471         int err;
2472         struct net_device *dev = info->user_ptr[1];
2473         u8 key_idx = 0;
2474         const u8 *mac_addr = NULL;
2475         bool pairwise;
2476         struct get_key_cookie cookie = {
2477                 .error = 0,
2478         };
2479         void *hdr;
2480         struct sk_buff *msg;
2481
2482         if (info->attrs[NL80211_ATTR_KEY_IDX])
2483                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2484
2485         if (key_idx > 5)
2486                 return -EINVAL;
2487
2488         if (info->attrs[NL80211_ATTR_MAC])
2489                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2490
2491         pairwise = !!mac_addr;
2492         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2493                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2494                 if (kt >= NUM_NL80211_KEYTYPES)
2495                         return -EINVAL;
2496                 if (kt != NL80211_KEYTYPE_GROUP &&
2497                     kt != NL80211_KEYTYPE_PAIRWISE)
2498                         return -EINVAL;
2499                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2500         }
2501
2502         if (!rdev->ops->get_key)
2503                 return -EOPNOTSUPP;
2504
2505         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2506         if (!msg)
2507                 return -ENOMEM;
2508
2509         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2510                              NL80211_CMD_NEW_KEY);
2511         if (IS_ERR(hdr))
2512                 return PTR_ERR(hdr);
2513
2514         cookie.msg = msg;
2515         cookie.idx = key_idx;
2516
2517         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2518             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2519                 goto nla_put_failure;
2520         if (mac_addr &&
2521             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2522                 goto nla_put_failure;
2523
2524         if (pairwise && mac_addr &&
2525             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2526                 return -ENOENT;
2527
2528         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2529                            get_key_callback);
2530
2531         if (err)
2532                 goto free_msg;
2533
2534         if (cookie.error)
2535                 goto nla_put_failure;
2536
2537         genlmsg_end(msg, hdr);
2538         return genlmsg_reply(msg, info);
2539
2540  nla_put_failure:
2541         err = -ENOBUFS;
2542  free_msg:
2543         nlmsg_free(msg);
2544         return err;
2545 }
2546
2547 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2548 {
2549         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2550         struct key_parse key;
2551         int err;
2552         struct net_device *dev = info->user_ptr[1];
2553
2554         err = nl80211_parse_key(info, &key);
2555         if (err)
2556                 return err;
2557
2558         if (key.idx < 0)
2559                 return -EINVAL;
2560
2561         /* only support setting default key */
2562         if (!key.def && !key.defmgmt)
2563                 return -EINVAL;
2564
2565         wdev_lock(dev->ieee80211_ptr);
2566
2567         if (key.def) {
2568                 if (!rdev->ops->set_default_key) {
2569                         err = -EOPNOTSUPP;
2570                         goto out;
2571                 }
2572
2573                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2574                 if (err)
2575                         goto out;
2576
2577                 err = rdev_set_default_key(rdev, dev, key.idx,
2578                                                  key.def_uni, key.def_multi);
2579
2580                 if (err)
2581                         goto out;
2582
2583 #ifdef CONFIG_CFG80211_WEXT
2584                 dev->ieee80211_ptr->wext.default_key = key.idx;
2585 #endif
2586         } else {
2587                 if (key.def_uni || !key.def_multi) {
2588                         err = -EINVAL;
2589                         goto out;
2590                 }
2591
2592                 if (!rdev->ops->set_default_mgmt_key) {
2593                         err = -EOPNOTSUPP;
2594                         goto out;
2595                 }
2596
2597                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2598                 if (err)
2599                         goto out;
2600
2601                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2602                 if (err)
2603                         goto out;
2604
2605 #ifdef CONFIG_CFG80211_WEXT
2606                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2607 #endif
2608         }
2609
2610  out:
2611         wdev_unlock(dev->ieee80211_ptr);
2612
2613         return err;
2614 }
2615
2616 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2617 {
2618         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2619         int err;
2620         struct net_device *dev = info->user_ptr[1];
2621         struct key_parse key;
2622         const u8 *mac_addr = NULL;
2623
2624         err = nl80211_parse_key(info, &key);
2625         if (err)
2626                 return err;
2627
2628         if (!key.p.key)
2629                 return -EINVAL;
2630
2631         if (info->attrs[NL80211_ATTR_MAC])
2632                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2633
2634         if (key.type == -1) {
2635                 if (mac_addr)
2636                         key.type = NL80211_KEYTYPE_PAIRWISE;
2637                 else
2638                         key.type = NL80211_KEYTYPE_GROUP;
2639         }
2640
2641         /* for now */
2642         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2643             key.type != NL80211_KEYTYPE_GROUP)
2644                 return -EINVAL;
2645
2646         if (!rdev->ops->add_key)
2647                 return -EOPNOTSUPP;
2648
2649         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2650                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2651                                            mac_addr))
2652                 return -EINVAL;
2653
2654         wdev_lock(dev->ieee80211_ptr);
2655         err = nl80211_key_allowed(dev->ieee80211_ptr);
2656         if (!err)
2657                 err = rdev_add_key(rdev, dev, key.idx,
2658                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2659                                     mac_addr, &key.p);
2660         wdev_unlock(dev->ieee80211_ptr);
2661
2662         return err;
2663 }
2664
2665 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2666 {
2667         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2668         int err;
2669         struct net_device *dev = info->user_ptr[1];
2670         u8 *mac_addr = NULL;
2671         struct key_parse key;
2672
2673         err = nl80211_parse_key(info, &key);
2674         if (err)
2675                 return err;
2676
2677         if (info->attrs[NL80211_ATTR_MAC])
2678                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2679
2680         if (key.type == -1) {
2681                 if (mac_addr)
2682                         key.type = NL80211_KEYTYPE_PAIRWISE;
2683                 else
2684                         key.type = NL80211_KEYTYPE_GROUP;
2685         }
2686
2687         /* for now */
2688         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2689             key.type != NL80211_KEYTYPE_GROUP)
2690                 return -EINVAL;
2691
2692         if (!rdev->ops->del_key)
2693                 return -EOPNOTSUPP;
2694
2695         wdev_lock(dev->ieee80211_ptr);
2696         err = nl80211_key_allowed(dev->ieee80211_ptr);
2697
2698         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2699             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2700                 err = -ENOENT;
2701
2702         if (!err)
2703                 err = rdev_del_key(rdev, dev, key.idx,
2704                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2705                                    mac_addr);
2706
2707 #ifdef CONFIG_CFG80211_WEXT
2708         if (!err) {
2709                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
2710                         dev->ieee80211_ptr->wext.default_key = -1;
2711                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2712                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2713         }
2714 #endif
2715         wdev_unlock(dev->ieee80211_ptr);
2716
2717         return err;
2718 }
2719
2720 /* This function returns an error or the number of nested attributes */
2721 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
2722 {
2723         struct nlattr *attr;
2724         int n_entries = 0, tmp;
2725
2726         nla_for_each_nested(attr, nl_attr, tmp) {
2727                 if (nla_len(attr) != ETH_ALEN)
2728                         return -EINVAL;
2729
2730                 n_entries++;
2731         }
2732
2733         return n_entries;
2734 }
2735
2736 /*
2737  * This function parses ACL information and allocates memory for ACL data.
2738  * On successful return, the calling function is responsible to free the
2739  * ACL buffer returned by this function.
2740  */
2741 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
2742                                                 struct genl_info *info)
2743 {
2744         enum nl80211_acl_policy acl_policy;
2745         struct nlattr *attr;
2746         struct cfg80211_acl_data *acl;
2747         int i = 0, n_entries, tmp;
2748
2749         if (!wiphy->max_acl_mac_addrs)
2750                 return ERR_PTR(-EOPNOTSUPP);
2751
2752         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
2753                 return ERR_PTR(-EINVAL);
2754
2755         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
2756         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
2757             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
2758                 return ERR_PTR(-EINVAL);
2759
2760         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
2761                 return ERR_PTR(-EINVAL);
2762
2763         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
2764         if (n_entries < 0)
2765                 return ERR_PTR(n_entries);
2766
2767         if (n_entries > wiphy->max_acl_mac_addrs)
2768                 return ERR_PTR(-ENOTSUPP);
2769
2770         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
2771                       GFP_KERNEL);
2772         if (!acl)
2773                 return ERR_PTR(-ENOMEM);
2774
2775         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
2776                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
2777                 i++;
2778         }
2779
2780         acl->n_acl_entries = n_entries;
2781         acl->acl_policy = acl_policy;
2782
2783         return acl;
2784 }
2785
2786 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
2787 {
2788         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2789         struct net_device *dev = info->user_ptr[1];
2790         struct cfg80211_acl_data *acl;
2791         int err;
2792
2793         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2794             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2795                 return -EOPNOTSUPP;
2796
2797         if (!dev->ieee80211_ptr->beacon_interval)
2798                 return -EINVAL;
2799
2800         acl = parse_acl_data(&rdev->wiphy, info);
2801         if (IS_ERR(acl))
2802                 return PTR_ERR(acl);
2803
2804         err = rdev_set_mac_acl(rdev, dev, acl);
2805
2806         kfree(acl);
2807
2808         return err;
2809 }
2810
2811 static int nl80211_parse_beacon(struct genl_info *info,
2812                                 struct cfg80211_beacon_data *bcn)
2813 {
2814         bool haveinfo = false;
2815
2816         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]) ||
2817             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]) ||
2818             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
2819             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2820                 return -EINVAL;
2821
2822         memset(bcn, 0, sizeof(*bcn));
2823
2824         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
2825                 bcn->head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2826                 bcn->head_len = nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2827                 if (!bcn->head_len)
2828                         return -EINVAL;
2829                 haveinfo = true;
2830         }
2831
2832         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
2833                 bcn->tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2834                 bcn->tail_len =
2835                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2836                 haveinfo = true;
2837         }
2838
2839         if (!haveinfo)
2840                 return -EINVAL;
2841
2842         if (info->attrs[NL80211_ATTR_IE]) {
2843                 bcn->beacon_ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2844                 bcn->beacon_ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2845         }
2846
2847         if (info->attrs[NL80211_ATTR_IE_PROBE_RESP]) {
2848                 bcn->proberesp_ies =
2849                         nla_data(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2850                 bcn->proberesp_ies_len =
2851                         nla_len(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2852         }
2853
2854         if (info->attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
2855                 bcn->assocresp_ies =
2856                         nla_data(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2857                 bcn->assocresp_ies_len =
2858                         nla_len(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2859         }
2860
2861         if (info->attrs[NL80211_ATTR_PROBE_RESP]) {
2862                 bcn->probe_resp =
2863                         nla_data(info->attrs[NL80211_ATTR_PROBE_RESP]);
2864                 bcn->probe_resp_len =
2865                         nla_len(info->attrs[NL80211_ATTR_PROBE_RESP]);
2866         }
2867
2868         return 0;
2869 }
2870
2871 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
2872                                    struct cfg80211_ap_settings *params)
2873 {
2874         struct wireless_dev *wdev;
2875         bool ret = false;
2876
2877         mutex_lock(&rdev->devlist_mtx);
2878
2879         list_for_each_entry(wdev, &rdev->wdev_list, list) {
2880                 if (wdev->iftype != NL80211_IFTYPE_AP &&
2881                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
2882                         continue;
2883
2884                 if (!wdev->preset_chandef.chan)
2885                         continue;
2886
2887                 params->chandef = wdev->preset_chandef;
2888                 ret = true;
2889                 break;
2890         }
2891
2892         mutex_unlock(&rdev->devlist_mtx);
2893
2894         return ret;
2895 }
2896
2897 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
2898                                     enum nl80211_auth_type auth_type,
2899                                     enum nl80211_commands cmd)
2900 {
2901         if (auth_type > NL80211_AUTHTYPE_MAX)
2902                 return false;
2903
2904         switch (cmd) {
2905         case NL80211_CMD_AUTHENTICATE:
2906                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
2907                     auth_type == NL80211_AUTHTYPE_SAE)
2908                         return false;
2909                 return true;
2910         case NL80211_CMD_CONNECT:
2911         case NL80211_CMD_START_AP:
2912                 /* SAE not supported yet */
2913                 if (auth_type == NL80211_AUTHTYPE_SAE)
2914                         return false;
2915                 return true;
2916         default:
2917                 return false;
2918         }
2919 }
2920
2921 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
2922 {
2923         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2924         struct net_device *dev = info->user_ptr[1];
2925         struct wireless_dev *wdev = dev->ieee80211_ptr;
2926         struct cfg80211_ap_settings params;
2927         int err;
2928         u8 radar_detect_width = 0;
2929
2930         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2931             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2932                 return -EOPNOTSUPP;
2933
2934         if (!rdev->ops->start_ap)
2935                 return -EOPNOTSUPP;
2936
2937         if (wdev->beacon_interval)
2938                 return -EALREADY;
2939
2940         memset(&params, 0, sizeof(params));
2941
2942         /* these are required for START_AP */
2943         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
2944             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
2945             !info->attrs[NL80211_ATTR_BEACON_HEAD])
2946                 return -EINVAL;
2947
2948         err = nl80211_parse_beacon(info, &params.beacon);
2949         if (err)
2950                 return err;
2951
2952         params.beacon_interval =
2953                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
2954         params.dtim_period =
2955                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
2956
2957         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
2958         if (err)
2959                 return err;
2960
2961         /*
2962          * In theory, some of these attributes should be required here
2963          * but since they were not used when the command was originally
2964          * added, keep them optional for old user space programs to let
2965          * them continue to work with drivers that do not need the
2966          * additional information -- drivers must check!
2967          */
2968         if (info->attrs[NL80211_ATTR_SSID]) {
2969                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2970                 params.ssid_len =
2971                         nla_len(info->attrs[NL80211_ATTR_SSID]);
2972                 if (params.ssid_len == 0 ||
2973                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
2974                         return -EINVAL;
2975         }
2976
2977         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
2978                 params.hidden_ssid = nla_get_u32(
2979                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
2980                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
2981                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
2982                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
2983                         return -EINVAL;
2984         }
2985
2986         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
2987
2988         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
2989                 params.auth_type = nla_get_u32(
2990                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
2991                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
2992                                              NL80211_CMD_START_AP))
2993                         return -EINVAL;
2994         } else
2995                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
2996
2997         err = nl80211_crypto_settings(rdev, info, &params.crypto,
2998                                       NL80211_MAX_NR_CIPHER_SUITES);
2999         if (err)
3000                 return err;
3001
3002         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3003                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3004                         return -EOPNOTSUPP;
3005                 params.inactivity_timeout = nla_get_u16(
3006                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3007         }
3008
3009         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3010                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3011                         return -EINVAL;
3012                 params.p2p_ctwindow =
3013                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3014                 if (params.p2p_ctwindow > 127)
3015                         return -EINVAL;
3016                 if (params.p2p_ctwindow != 0 &&
3017                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3018                         return -EINVAL;
3019         }
3020
3021         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3022                 u8 tmp;
3023
3024                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3025                         return -EINVAL;
3026                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3027                 if (tmp > 1)
3028                         return -EINVAL;
3029                 params.p2p_opp_ps = tmp;
3030                 if (params.p2p_opp_ps != 0 &&
3031                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3032                         return -EINVAL;
3033         }
3034
3035         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3036                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
3037                 if (err)
3038                         return err;
3039         } else if (wdev->preset_chandef.chan) {
3040                 params.chandef = wdev->preset_chandef;
3041         } else if (!nl80211_get_ap_channel(rdev, &params))
3042                 return -EINVAL;
3043
3044         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
3045                 return -EINVAL;
3046
3047         err = cfg80211_chandef_dfs_required(wdev->wiphy, &params.chandef);
3048         if (err < 0)
3049                 return err;
3050         if (err) {
3051                 radar_detect_width = BIT(params.chandef.width);
3052                 params.radar_required = true;
3053         }
3054
3055         mutex_lock(&rdev->devlist_mtx);
3056         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
3057                                            params.chandef.chan,
3058                                            CHAN_MODE_SHARED,
3059                                            radar_detect_width);
3060         mutex_unlock(&rdev->devlist_mtx);
3061
3062         if (err)
3063                 return err;
3064
3065         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3066                 params.acl = parse_acl_data(&rdev->wiphy, info);
3067                 if (IS_ERR(params.acl))
3068                         return PTR_ERR(params.acl);
3069         }
3070
3071         err = rdev_start_ap(rdev, dev, &params);
3072         if (!err) {
3073                 wdev->preset_chandef = params.chandef;
3074                 wdev->beacon_interval = params.beacon_interval;
3075                 wdev->channel = params.chandef.chan;
3076                 wdev->ssid_len = params.ssid_len;
3077                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3078         }
3079
3080         kfree(params.acl);
3081
3082         return err;
3083 }
3084
3085 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3086 {
3087         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3088         struct net_device *dev = info->user_ptr[1];
3089         struct wireless_dev *wdev = dev->ieee80211_ptr;
3090         struct cfg80211_beacon_data params;
3091         int err;
3092
3093         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3094             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3095                 return -EOPNOTSUPP;
3096
3097         if (!rdev->ops->change_beacon)
3098                 return -EOPNOTSUPP;
3099
3100         if (!wdev->beacon_interval)
3101                 return -EINVAL;
3102
3103         err = nl80211_parse_beacon(info, &params);
3104         if (err)
3105                 return err;
3106
3107         return rdev_change_beacon(rdev, dev, &params);
3108 }
3109
3110 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3111 {
3112         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3113         struct net_device *dev = info->user_ptr[1];
3114
3115         return cfg80211_stop_ap(rdev, dev);
3116 }
3117
3118 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3119         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3120         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3121         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3122         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3123         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3124         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3125 };
3126
3127 static int parse_station_flags(struct genl_info *info,
3128                                enum nl80211_iftype iftype,
3129                                struct station_parameters *params)
3130 {
3131         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3132         struct nlattr *nla;
3133         int flag;
3134
3135         /*
3136          * Try parsing the new attribute first so userspace
3137          * can specify both for older kernels.
3138          */
3139         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3140         if (nla) {
3141                 struct nl80211_sta_flag_update *sta_flags;
3142
3143                 sta_flags = nla_data(nla);
3144                 params->sta_flags_mask = sta_flags->mask;
3145                 params->sta_flags_set = sta_flags->set;
3146                 params->sta_flags_set &= params->sta_flags_mask;
3147                 if ((params->sta_flags_mask |
3148                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3149                         return -EINVAL;
3150                 return 0;
3151         }
3152
3153         /* if present, parse the old attribute */
3154
3155         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3156         if (!nla)
3157                 return 0;
3158
3159         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3160                              nla, sta_flags_policy))
3161                 return -EINVAL;
3162
3163         /*
3164          * Only allow certain flags for interface types so that
3165          * other attributes are silently ignored. Remember that
3166          * this is backward compatibility code with old userspace
3167          * and shouldn't be hit in other cases anyway.
3168          */
3169         switch (iftype) {
3170         case NL80211_IFTYPE_AP:
3171         case NL80211_IFTYPE_AP_VLAN:
3172         case NL80211_IFTYPE_P2P_GO:
3173                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3174                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3175                                          BIT(NL80211_STA_FLAG_WME) |
3176                                          BIT(NL80211_STA_FLAG_MFP);
3177                 break;
3178         case NL80211_IFTYPE_P2P_CLIENT:
3179         case NL80211_IFTYPE_STATION:
3180                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3181                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3182                 break;
3183         case NL80211_IFTYPE_MESH_POINT:
3184                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3185                                          BIT(NL80211_STA_FLAG_MFP) |
3186                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3187         default:
3188                 return -EINVAL;
3189         }
3190
3191         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3192                 if (flags[flag]) {
3193                         params->sta_flags_set |= (1<<flag);
3194
3195                         /* no longer support new API additions in old API */
3196                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3197                                 return -EINVAL;
3198                 }
3199         }
3200
3201         return 0;
3202 }
3203
3204 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3205                                  int attr)
3206 {
3207         struct nlattr *rate;
3208         u32 bitrate;
3209         u16 bitrate_compat;
3210
3211         rate = nla_nest_start(msg, attr);
3212         if (!rate)
3213                 return false;
3214
3215         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3216         bitrate = cfg80211_calculate_bitrate(info);
3217         /* report 16-bit bitrate only if we can */
3218         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3219         if (bitrate > 0 &&
3220             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3221                 return false;
3222         if (bitrate_compat > 0 &&
3223             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3224                 return false;
3225
3226         if (info->flags & RATE_INFO_FLAGS_MCS) {
3227                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3228                         return false;
3229                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3230                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3231                         return false;
3232                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3233                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3234                         return false;
3235         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3236                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3237                         return false;
3238                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3239                         return false;
3240                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3241                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3242                         return false;
3243                 if (info->flags & RATE_INFO_FLAGS_80_MHZ_WIDTH &&
3244                     nla_put_flag(msg, NL80211_RATE_INFO_80_MHZ_WIDTH))
3245                         return false;
3246                 if (info->flags & RATE_INFO_FLAGS_80P80_MHZ_WIDTH &&
3247                     nla_put_flag(msg, NL80211_RATE_INFO_80P80_MHZ_WIDTH))
3248                         return false;
3249                 if (info->flags & RATE_INFO_FLAGS_160_MHZ_WIDTH &&
3250                     nla_put_flag(msg, NL80211_RATE_INFO_160_MHZ_WIDTH))
3251                         return false;
3252                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3253                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3254                         return false;
3255         }
3256
3257         nla_nest_end(msg, rate);
3258         return true;
3259 }
3260
3261 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
3262                                 int flags,
3263                                 struct cfg80211_registered_device *rdev,
3264                                 struct net_device *dev,
3265                                 const u8 *mac_addr, struct station_info *sinfo)
3266 {
3267         void *hdr;
3268         struct nlattr *sinfoattr, *bss_param;
3269
3270         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3271         if (!hdr)
3272                 return -1;
3273
3274         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3275             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3276             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3277                 goto nla_put_failure;
3278
3279         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3280         if (!sinfoattr)
3281                 goto nla_put_failure;
3282         if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
3283             nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
3284                         sinfo->connected_time))
3285                 goto nla_put_failure;
3286         if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
3287             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
3288                         sinfo->inactive_time))
3289                 goto nla_put_failure;
3290         if ((sinfo->filled & (STATION_INFO_RX_BYTES |
3291                               STATION_INFO_RX_BYTES64)) &&
3292             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3293                         (u32)sinfo->rx_bytes))
3294                 goto nla_put_failure;
3295         if ((sinfo->filled & (STATION_INFO_TX_BYTES |
3296                               NL80211_STA_INFO_TX_BYTES64)) &&
3297             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3298                         (u32)sinfo->tx_bytes))
3299                 goto nla_put_failure;
3300         if ((sinfo->filled & STATION_INFO_RX_BYTES64) &&
3301             nla_put_u64(msg, NL80211_STA_INFO_RX_BYTES64,
3302                         sinfo->rx_bytes))
3303                 goto nla_put_failure;
3304         if ((sinfo->filled & STATION_INFO_TX_BYTES64) &&
3305             nla_put_u64(msg, NL80211_STA_INFO_TX_BYTES64,
3306                         sinfo->tx_bytes))
3307                 goto nla_put_failure;
3308         if ((sinfo->filled & STATION_INFO_LLID) &&
3309             nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
3310                 goto nla_put_failure;
3311         if ((sinfo->filled & STATION_INFO_PLID) &&
3312             nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
3313                 goto nla_put_failure;
3314         if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
3315             nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
3316                        sinfo->plink_state))
3317                 goto nla_put_failure;
3318         switch (rdev->wiphy.signal_type) {
3319         case CFG80211_SIGNAL_TYPE_MBM:
3320                 if ((sinfo->filled & STATION_INFO_SIGNAL) &&
3321                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
3322                                sinfo->signal))
3323                         goto nla_put_failure;
3324                 if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
3325                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
3326                                sinfo->signal_avg))
3327                         goto nla_put_failure;
3328                 break;
3329         default:
3330                 break;
3331         }
3332         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
3333                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3334                                           NL80211_STA_INFO_TX_BITRATE))
3335                         goto nla_put_failure;
3336         }
3337         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
3338                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3339                                           NL80211_STA_INFO_RX_BITRATE))
3340                         goto nla_put_failure;
3341         }
3342         if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
3343             nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
3344                         sinfo->rx_packets))
3345                 goto nla_put_failure;
3346         if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
3347             nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
3348                         sinfo->tx_packets))
3349                 goto nla_put_failure;
3350         if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
3351             nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
3352                         sinfo->tx_retries))
3353                 goto nla_put_failure;
3354         if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
3355             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
3356                         sinfo->tx_failed))
3357                 goto nla_put_failure;
3358         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
3359             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
3360                         sinfo->beacon_loss_count))
3361                 goto nla_put_failure;
3362         if ((sinfo->filled & STATION_INFO_LOCAL_PM) &&
3363             nla_put_u32(msg, NL80211_STA_INFO_LOCAL_PM,
3364                         sinfo->local_pm))
3365                 goto nla_put_failure;
3366         if ((sinfo->filled & STATION_INFO_PEER_PM) &&
3367             nla_put_u32(msg, NL80211_STA_INFO_PEER_PM,
3368                         sinfo->peer_pm))
3369                 goto nla_put_failure;
3370         if ((sinfo->filled & STATION_INFO_NONPEER_PM) &&
3371             nla_put_u32(msg, NL80211_STA_INFO_NONPEER_PM,
3372                         sinfo->nonpeer_pm))
3373                 goto nla_put_failure;
3374         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
3375                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3376                 if (!bss_param)
3377                         goto nla_put_failure;
3378
3379                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3380                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3381                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3382                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3383                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3384                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3385                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3386                                sinfo->bss_param.dtim_period) ||
3387                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3388                                 sinfo->bss_param.beacon_interval))
3389                         goto nla_put_failure;
3390
3391                 nla_nest_end(msg, bss_param);
3392         }
3393         if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
3394             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3395                     sizeof(struct nl80211_sta_flag_update),
3396                     &sinfo->sta_flags))
3397                 goto nla_put_failure;
3398         if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
3399                 nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
3400                             sinfo->t_offset))
3401                 goto nla_put_failure;
3402         nla_nest_end(msg, sinfoattr);
3403
3404         if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
3405             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3406                     sinfo->assoc_req_ies))
3407                 goto nla_put_failure;
3408
3409         return genlmsg_end(msg, hdr);
3410
3411  nla_put_failure:
3412         genlmsg_cancel(msg, hdr);
3413         return -EMSGSIZE;
3414 }
3415
3416 static int nl80211_dump_station(struct sk_buff *skb,
3417                                 struct netlink_callback *cb)
3418 {
3419         struct station_info sinfo;
3420         struct cfg80211_registered_device *dev;
3421         struct net_device *netdev;
3422         u8 mac_addr[ETH_ALEN];
3423         int sta_idx = cb->args[1];
3424         int err;
3425
3426         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
3427         if (err)
3428                 return err;
3429
3430         if (!dev->ops->dump_station) {
3431                 err = -EOPNOTSUPP;
3432                 goto out_err;
3433         }
3434
3435         while (1) {
3436                 memset(&sinfo, 0, sizeof(sinfo));
3437                 err = rdev_dump_station(dev, netdev, sta_idx,
3438                                         mac_addr, &sinfo);
3439                 if (err == -ENOENT)
3440                         break;
3441                 if (err)
3442                         goto out_err;
3443
3444                 if (nl80211_send_station(skb,
3445                                 NETLINK_CB(cb->skb).portid,
3446                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3447                                 dev, netdev, mac_addr,
3448                                 &sinfo) < 0)
3449                         goto out;
3450
3451                 sta_idx++;
3452         }
3453
3454
3455  out:
3456         cb->args[1] = sta_idx;
3457         err = skb->len;
3458  out_err:
3459         nl80211_finish_netdev_dump(dev);
3460
3461         return err;
3462 }
3463
3464 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3465 {
3466         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3467         struct net_device *dev = info->user_ptr[1];
3468         struct station_info sinfo;
3469         struct sk_buff *msg;
3470         u8 *mac_addr = NULL;
3471         int err;
3472
3473         memset(&sinfo, 0, sizeof(sinfo));
3474
3475         if (!info->attrs[NL80211_ATTR_MAC])
3476                 return -EINVAL;
3477
3478         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3479
3480         if (!rdev->ops->get_station)
3481                 return -EOPNOTSUPP;
3482
3483         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3484         if (err)
3485                 return err;
3486
3487         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3488         if (!msg)
3489                 return -ENOMEM;
3490
3491         if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3492                                  rdev, dev, mac_addr, &sinfo) < 0) {
3493                 nlmsg_free(msg);
3494                 return -ENOBUFS;
3495         }
3496
3497         return genlmsg_reply(msg, info);
3498 }
3499
3500 int cfg80211_check_station_change(struct wiphy *wiphy,
3501                                   struct station_parameters *params,
3502                                   enum cfg80211_station_type statype)
3503 {
3504         if (params->listen_interval != -1)
3505                 return -EINVAL;
3506         if (params->aid)
3507                 return -EINVAL;
3508
3509         /* When you run into this, adjust the code below for the new flag */
3510         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
3511
3512         switch (statype) {
3513         case CFG80211_STA_MESH_PEER_NONSEC:
3514         case CFG80211_STA_MESH_PEER_SECURE:
3515                 /*
3516                  * No ignoring the TDLS flag here -- the userspace mesh
3517                  * code doesn't have the bug of including TDLS in the
3518                  * mask everywhere.
3519                  */
3520                 if (params->sta_flags_mask &
3521                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3522                                   BIT(NL80211_STA_FLAG_MFP) |
3523                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3524                         return -EINVAL;
3525                 break;
3526         case CFG80211_STA_TDLS_PEER_SETUP:
3527         case CFG80211_STA_TDLS_PEER_ACTIVE:
3528                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3529                         return -EINVAL;
3530                 /* ignore since it can't change */
3531                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3532                 break;
3533         default:
3534                 /* disallow mesh-specific things */
3535                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3536                         return -EINVAL;
3537                 if (params->local_pm)
3538                         return -EINVAL;
3539                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3540                         return -EINVAL;
3541         }
3542
3543         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
3544             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
3545                 /* TDLS can't be set, ... */
3546                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3547                         return -EINVAL;
3548                 /*
3549                  * ... but don't bother the driver with it. This works around
3550                  * a hostapd/wpa_supplicant issue -- it always includes the
3551                  * TLDS_PEER flag in the mask even for AP mode.
3552                  */
3553                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3554         }
3555
3556         if (statype != CFG80211_STA_TDLS_PEER_SETUP) {
3557                 /* reject other things that can't change */
3558                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
3559                         return -EINVAL;
3560                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
3561                         return -EINVAL;
3562                 if (params->supported_rates)
3563                         return -EINVAL;
3564                 if (params->ext_capab || params->ht_capa || params->vht_capa)
3565                         return -EINVAL;
3566         }
3567
3568         if (statype != CFG80211_STA_AP_CLIENT) {
3569                 if (params->vlan)
3570                         return -EINVAL;
3571         }
3572
3573         switch (statype) {
3574         case CFG80211_STA_AP_MLME_CLIENT:
3575                 /* Use this only for authorizing/unauthorizing a station */
3576                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
3577                         return -EOPNOTSUPP;
3578                 break;
3579         case CFG80211_STA_AP_CLIENT:
3580                 /* accept only the listed bits */
3581                 if (params->sta_flags_mask &
3582                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3583                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3584                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
3585                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3586                                   BIT(NL80211_STA_FLAG_WME) |
3587                                   BIT(NL80211_STA_FLAG_MFP)))
3588                         return -EINVAL;
3589
3590                 /* but authenticated/associated only if driver handles it */
3591                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
3592                     params->sta_flags_mask &
3593                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3594                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
3595                         return -EINVAL;
3596                 break;
3597         case CFG80211_STA_IBSS:
3598         case CFG80211_STA_AP_STA:
3599                 /* reject any changes other than AUTHORIZED */
3600                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
3601                         return -EINVAL;
3602                 break;
3603         case CFG80211_STA_TDLS_PEER_SETUP:
3604                 /* reject any changes other than AUTHORIZED or WME */
3605                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3606                                                BIT(NL80211_STA_FLAG_WME)))
3607                         return -EINVAL;
3608                 /* force (at least) rates when authorizing */
3609                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
3610                     !params->supported_rates)
3611                         return -EINVAL;
3612                 break;
3613         case CFG80211_STA_TDLS_PEER_ACTIVE:
3614                 /* reject any changes */
3615                 return -EINVAL;
3616         case CFG80211_STA_MESH_PEER_NONSEC:
3617                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3618                         return -EINVAL;
3619                 break;
3620         case CFG80211_STA_MESH_PEER_SECURE:
3621                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3622                         return -EINVAL;
3623                 break;
3624         }
3625
3626         return 0;
3627 }
3628 EXPORT_SYMBOL(cfg80211_check_station_change);
3629
3630 /*
3631  * Get vlan interface making sure it is running and on the right wiphy.
3632  */
3633 static struct net_device *get_vlan(struct genl_info *info,
3634                                    struct cfg80211_registered_device *rdev)
3635 {
3636         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
3637         struct net_device *v;
3638         int ret;
3639
3640         if (!vlanattr)
3641                 return NULL;
3642
3643         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
3644         if (!v)
3645                 return ERR_PTR(-ENODEV);
3646
3647         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
3648                 ret = -EINVAL;
3649                 goto error;
3650         }
3651
3652         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
3653             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3654             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
3655                 ret = -EINVAL;
3656                 goto error;
3657         }
3658
3659         if (!netif_running(v)) {
3660                 ret = -ENETDOWN;
3661                 goto error;
3662         }
3663
3664         return v;
3665  error:
3666         dev_put(v);
3667         return ERR_PTR(ret);
3668 }
3669
3670 static struct nla_policy
3671 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
3672         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
3673         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
3674 };
3675
3676 static int nl80211_parse_sta_wme(struct genl_info *info,
3677                                  struct station_parameters *params)
3678 {
3679         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
3680         struct nlattr *nla;
3681         int err;
3682
3683         /* parse WME attributes if present */
3684         if (!info->attrs[NL80211_ATTR_STA_WME])
3685                 return 0;
3686
3687         nla = info->attrs[NL80211_ATTR_STA_WME];
3688         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
3689                                nl80211_sta_wme_policy);
3690         if (err)
3691                 return err;
3692
3693         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
3694                 params->uapsd_queues = nla_get_u8(
3695                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
3696         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
3697                 return -EINVAL;
3698
3699         if (tb[NL80211_STA_WME_MAX_SP])
3700                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
3701
3702         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
3703                 return -EINVAL;
3704
3705         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
3706
3707         return 0;
3708 }
3709
3710 static int nl80211_set_station_tdls(struct genl_info *info,
3711                                     struct station_parameters *params)
3712 {
3713         /* Dummy STA entry gets updated once the peer capabilities are known */
3714         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3715                 params->ht_capa =
3716                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3717         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
3718                 params->vht_capa =
3719                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
3720
3721         return nl80211_parse_sta_wme(info, params);
3722 }
3723
3724 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
3725 {
3726         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3727         struct net_device *dev = info->user_ptr[1];
3728         struct station_parameters params;
3729         u8 *mac_addr;
3730         int err;
3731
3732         memset(&params, 0, sizeof(params));
3733
3734         params.listen_interval = -1;
3735
3736         if (!rdev->ops->change_station)
3737                 return -EOPNOTSUPP;
3738
3739         if (info->attrs[NL80211_ATTR_STA_AID])
3740                 return -EINVAL;
3741
3742         if (!info->attrs[NL80211_ATTR_MAC])
3743                 return -EINVAL;
3744
3745         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3746
3747         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
3748                 params.supported_rates =
3749                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3750                 params.supported_rates_len =
3751                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3752         }
3753
3754         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
3755                 params.capability =
3756                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
3757                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
3758         }
3759
3760         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
3761                 params.ext_capab =
3762                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3763                 params.ext_capab_len =
3764                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3765         }
3766
3767         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3768                 return -EINVAL;
3769
3770         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3771                 return -EINVAL;
3772
3773         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
3774                 params.plink_action =
3775                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3776                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
3777                         return -EINVAL;
3778         }
3779
3780         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
3781                 params.plink_state =
3782                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
3783                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
3784                         return -EINVAL;
3785                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
3786         }
3787
3788         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
3789                 enum nl80211_mesh_power_mode pm = nla_get_u32(
3790                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
3791
3792                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
3793                     pm > NL80211_MESH_POWER_MAX)
3794                         return -EINVAL;
3795
3796                 params.local_pm = pm;
3797         }
3798
3799         /* Include parameters for TDLS peer (will check later) */
3800         err = nl80211_set_station_tdls(info, &params);
3801         if (err)
3802                 return err;
3803
3804         params.vlan = get_vlan(info, rdev);
3805         if (IS_ERR(params.vlan))
3806                 return PTR_ERR(params.vlan);
3807
3808         switch (dev->ieee80211_ptr->iftype) {
3809         case NL80211_IFTYPE_AP:
3810         case NL80211_IFTYPE_AP_VLAN:
3811         case NL80211_IFTYPE_P2P_GO:
3812         case NL80211_IFTYPE_P2P_CLIENT:
3813         case NL80211_IFTYPE_STATION:
3814         case NL80211_IFTYPE_ADHOC:
3815         case NL80211_IFTYPE_MESH_POINT:
3816                 break;
3817         default:
3818                 err = -EOPNOTSUPP;
3819                 goto out_put_vlan;
3820         }
3821
3822         /* driver will call cfg80211_check_station_change() */
3823         err = rdev_change_station(rdev, dev, mac_addr, &params);
3824
3825  out_put_vlan:
3826         if (params.vlan)
3827                 dev_put(params.vlan);
3828
3829         return err;
3830 }
3831
3832 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
3833 {
3834         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3835         int err;
3836         struct net_device *dev = info->user_ptr[1];
3837         struct station_parameters params;
3838         u8 *mac_addr = NULL;
3839
3840         memset(&params, 0, sizeof(params));
3841
3842         if (!rdev->ops->add_station)
3843                 return -EOPNOTSUPP;
3844
3845         if (!info->attrs[NL80211_ATTR_MAC])
3846                 return -EINVAL;
3847
3848         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3849                 return -EINVAL;
3850
3851         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
3852                 return -EINVAL;
3853
3854         if (!info->attrs[NL80211_ATTR_STA_AID])
3855                 return -EINVAL;
3856
3857         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3858         params.supported_rates =
3859                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3860         params.supported_rates_len =
3861                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3862         params.listen_interval =
3863                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
3864
3865         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
3866         if (!params.aid || params.aid > IEEE80211_MAX_AID)
3867                 return -EINVAL;
3868
3869         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
3870                 params.capability =
3871                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
3872                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
3873         }
3874
3875         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
3876                 params.ext_capab =
3877                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3878                 params.ext_capab_len =
3879                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3880         }
3881
3882         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3883                 params.ht_capa =
3884                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3885
3886         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
3887                 params.vht_capa =
3888                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
3889
3890         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
3891                 params.plink_action =
3892                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3893                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
3894                         return -EINVAL;
3895         }
3896
3897         err = nl80211_parse_sta_wme(info, &params);
3898         if (err)
3899                 return err;
3900
3901         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3902                 return -EINVAL;
3903
3904         /* When you run into this, adjust the code below for the new flag */
3905         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
3906
3907         switch (dev->ieee80211_ptr->iftype) {
3908         case NL80211_IFTYPE_AP:
3909         case NL80211_IFTYPE_AP_VLAN:
3910         case NL80211_IFTYPE_P2P_GO:
3911                 /* ignore WME attributes if iface/sta is not capable */
3912                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
3913                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
3914                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
3915
3916                 /* TDLS peers cannot be added */
3917                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3918                         return -EINVAL;
3919                 /* but don't bother the driver with it */
3920                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3921
3922                 /* allow authenticated/associated only if driver handles it */
3923                 if (!(rdev->wiphy.features &
3924                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
3925                     params.sta_flags_mask &
3926                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3927                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
3928                         return -EINVAL;
3929
3930                 /* must be last in here for error handling */
3931                 params.vlan = get_vlan(info, rdev);
3932                 if (IS_ERR(params.vlan))
3933                         return PTR_ERR(params.vlan);
3934                 break;
3935         case NL80211_IFTYPE_MESH_POINT:
3936                 /* ignore uAPSD data */
3937                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
3938
3939                 /* associated is disallowed */
3940                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
3941                         return -EINVAL;
3942                 /* TDLS peers cannot be added */
3943                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3944                         return -EINVAL;
3945                 break;
3946         case NL80211_IFTYPE_STATION:
3947                 /* ignore uAPSD data */
3948                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
3949
3950                 /* these are disallowed */
3951                 if (params.sta_flags_mask &
3952                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
3953                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
3954                         return -EINVAL;
3955                 /* Only TDLS peers can be added */
3956                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3957                         return -EINVAL;
3958                 /* Can only add if TDLS ... */
3959                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
3960                         return -EOPNOTSUPP;
3961                 /* ... with external setup is supported */
3962                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
3963                         return -EOPNOTSUPP;
3964                 /*
3965                  * Older wpa_supplicant versions always mark the TDLS peer
3966                  * as authorized, but it shouldn't yet be.
3967                  */
3968                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
3969                 break;
3970         default:
3971                 return -EOPNOTSUPP;
3972         }
3973
3974         /* be aware of params.vlan when changing code here */
3975
3976         err = rdev_add_station(rdev, dev, mac_addr, &params);
3977
3978         if (params.vlan)
3979                 dev_put(params.vlan);
3980         return err;
3981 }
3982
3983 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
3984 {
3985         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3986         struct net_device *dev = info->user_ptr[1];
3987         u8 *mac_addr = NULL;
3988
3989         if (info->attrs[NL80211_ATTR_MAC])
3990                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3991
3992         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3993             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
3994             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
3995             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3996                 return -EINVAL;
3997
3998         if (!rdev->ops->del_station)
3999                 return -EOPNOTSUPP;
4000
4001         return rdev_del_station(rdev, dev, mac_addr);
4002 }
4003
4004 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4005                                 int flags, struct net_device *dev,
4006                                 u8 *dst, u8 *next_hop,
4007                                 struct mpath_info *pinfo)
4008 {
4009         void *hdr;
4010         struct nlattr *pinfoattr;
4011
4012         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
4013         if (!hdr)
4014                 return -1;
4015
4016         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4017             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
4018             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
4019             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
4020                 goto nla_put_failure;
4021
4022         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
4023         if (!pinfoattr)
4024                 goto nla_put_failure;
4025         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
4026             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
4027                         pinfo->frame_qlen))
4028                 goto nla_put_failure;
4029         if (((pinfo->filled & MPATH_INFO_SN) &&
4030              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
4031             ((pinfo->filled & MPATH_INFO_METRIC) &&
4032              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
4033                          pinfo->metric)) ||
4034             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
4035              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
4036                          pinfo->exptime)) ||
4037             ((pinfo->filled & MPATH_INFO_FLAGS) &&
4038              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
4039                         pinfo->flags)) ||
4040             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
4041              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
4042                          pinfo->discovery_timeout)) ||
4043             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
4044              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
4045                         pinfo->discovery_retries)))
4046                 goto nla_put_failure;
4047
4048         nla_nest_end(msg, pinfoattr);
4049
4050         return genlmsg_end(msg, hdr);
4051
4052  nla_put_failure:
4053         genlmsg_cancel(msg, hdr);
4054         return -EMSGSIZE;
4055 }
4056
4057 static int nl80211_dump_mpath(struct sk_buff *skb,
4058                               struct netlink_callback *cb)
4059 {
4060         struct mpath_info pinfo;
4061         struct cfg80211_registered_device *dev;
4062         struct net_device *netdev;
4063         u8 dst[ETH_ALEN];
4064         u8 next_hop[ETH_ALEN];
4065         int path_idx = cb->args[1];
4066         int err;
4067
4068         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
4069         if (err)
4070                 return err;
4071
4072         if (!dev->ops->dump_mpath) {
4073                 err = -EOPNOTSUPP;
4074                 goto out_err;
4075         }
4076
4077         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
4078                 err = -EOPNOTSUPP;
4079                 goto out_err;
4080         }
4081
4082         while (1) {
4083                 err = rdev_dump_mpath(dev, netdev, path_idx, dst, next_hop,
4084                                       &pinfo);
4085                 if (err == -ENOENT)
4086                         break;
4087                 if (err)
4088                         goto out_err;
4089
4090                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4091                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4092                                        netdev, dst, next_hop,
4093                                        &pinfo) < 0)
4094                         goto out;
4095
4096                 path_idx++;
4097         }
4098
4099
4100  out:
4101         cb->args[1] = path_idx;
4102         err = skb->len;
4103  out_err:
4104         nl80211_finish_netdev_dump(dev);
4105         return err;
4106 }
4107
4108 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
4109 {
4110         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4111         int err;
4112         struct net_device *dev = info->user_ptr[1];
4113         struct mpath_info pinfo;
4114         struct sk_buff *msg;
4115         u8 *dst = NULL;
4116         u8 next_hop[ETH_ALEN];
4117
4118         memset(&pinfo, 0, sizeof(pinfo));
4119
4120         if (!info->attrs[NL80211_ATTR_MAC])
4121                 return -EINVAL;
4122
4123         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4124
4125         if (!rdev->ops->get_mpath)
4126                 return -EOPNOTSUPP;
4127
4128         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4129                 return -EOPNOTSUPP;
4130
4131         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4132         if (err)
4133                 return err;
4134
4135         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4136         if (!msg)
4137                 return -ENOMEM;
4138
4139         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4140                                  dev, dst, next_hop, &pinfo) < 0) {
4141                 nlmsg_free(msg);
4142                 return -ENOBUFS;
4143         }
4144
4145         return genlmsg_reply(msg, info);
4146 }
4147
4148 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
4149 {
4150         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4151         struct net_device *dev = info->user_ptr[1];
4152         u8 *dst = NULL;
4153         u8 *next_hop = NULL;
4154
4155         if (!info->attrs[NL80211_ATTR_MAC])
4156                 return -EINVAL;
4157
4158         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4159                 return -EINVAL;
4160
4161         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4162         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4163
4164         if (!rdev->ops->change_mpath)
4165                 return -EOPNOTSUPP;
4166
4167         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4168                 return -EOPNOTSUPP;
4169
4170         return rdev_change_mpath(rdev, dev, dst, next_hop);
4171 }
4172
4173 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
4174 {
4175         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4176         struct net_device *dev = info->user_ptr[1];
4177         u8 *dst = NULL;
4178         u8 *next_hop = NULL;
4179
4180         if (!info->attrs[NL80211_ATTR_MAC])
4181                 return -EINVAL;
4182
4183         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4184                 return -EINVAL;
4185
4186         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4187         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4188
4189         if (!rdev->ops->add_mpath)
4190                 return -EOPNOTSUPP;
4191
4192         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4193                 return -EOPNOTSUPP;
4194
4195         return rdev_add_mpath(rdev, dev, dst, next_hop);
4196 }
4197
4198 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
4199 {
4200         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4201         struct net_device *dev = info->user_ptr[1];
4202         u8 *dst = NULL;
4203
4204         if (info->attrs[NL80211_ATTR_MAC])
4205                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4206
4207         if (!rdev->ops->del_mpath)
4208                 return -EOPNOTSUPP;
4209
4210         return rdev_del_mpath(rdev, dev, dst);
4211 }
4212
4213 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
4214 {
4215         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4216         struct net_device *dev = info->user_ptr[1];
4217         struct bss_parameters params;
4218
4219         memset(&params, 0, sizeof(params));
4220         /* default to not changing parameters */
4221         params.use_cts_prot = -1;
4222         params.use_short_preamble = -1;
4223         params.use_short_slot_time = -1;
4224         params.ap_isolate = -1;
4225         params.ht_opmode = -1;
4226         params.p2p_ctwindow = -1;
4227         params.p2p_opp_ps = -1;
4228
4229         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
4230                 params.use_cts_prot =
4231                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
4232         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
4233                 params.use_short_preamble =
4234                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
4235         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
4236                 params.use_short_slot_time =
4237                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4238         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4239                 params.basic_rates =
4240                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4241                 params.basic_rates_len =
4242                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4243         }
4244         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
4245                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4246         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
4247                 params.ht_opmode =
4248                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4249
4250         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4251                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4252                         return -EINVAL;
4253                 params.p2p_ctwindow =
4254                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4255                 if (params.p2p_ctwindow < 0)
4256                         return -EINVAL;
4257                 if (params.p2p_ctwindow != 0 &&
4258                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4259                         return -EINVAL;
4260         }
4261
4262         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4263                 u8 tmp;
4264
4265                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4266                         return -EINVAL;
4267                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4268                 if (tmp > 1)
4269                         return -EINVAL;
4270                 params.p2p_opp_ps = tmp;
4271                 if (params.p2p_opp_ps &&
4272                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4273                         return -EINVAL;
4274         }
4275
4276         if (!rdev->ops->change_bss)
4277                 return -EOPNOTSUPP;
4278
4279         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4280             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4281                 return -EOPNOTSUPP;
4282
4283         return rdev_change_bss(rdev, dev, &params);
4284 }
4285
4286 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
4287         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
4288         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
4289         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
4290         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
4291         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
4292         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
4293 };
4294
4295 static int parse_reg_rule(struct nlattr *tb[],
4296         struct ieee80211_reg_rule *reg_rule)
4297 {
4298         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
4299         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
4300
4301         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
4302                 return -EINVAL;
4303         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
4304                 return -EINVAL;
4305         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
4306                 return -EINVAL;
4307         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
4308                 return -EINVAL;
4309         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
4310                 return -EINVAL;
4311
4312         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
4313
4314         freq_range->start_freq_khz =
4315                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
4316         freq_range->end_freq_khz =
4317                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
4318         freq_range->max_bandwidth_khz =
4319                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
4320
4321         power_rule->max_eirp =
4322                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
4323
4324         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
4325                 power_rule->max_antenna_gain =
4326                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
4327
4328         return 0;
4329 }
4330
4331 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
4332 {
4333         int r;
4334         char *data = NULL;
4335         enum nl80211_user_reg_hint_type user_reg_hint_type;
4336
4337         /*
4338          * You should only get this when cfg80211 hasn't yet initialized
4339          * completely when built-in to the kernel right between the time
4340          * window between nl80211_init() and regulatory_init(), if that is
4341          * even possible.
4342          */
4343         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4344                 return -EINPROGRESS;
4345
4346         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4347                 return -EINVAL;
4348
4349         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4350
4351         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
4352                 user_reg_hint_type =
4353                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
4354         else
4355                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
4356
4357         switch (user_reg_hint_type) {
4358         case NL80211_USER_REG_HINT_USER:
4359         case NL80211_USER_REG_HINT_CELL_BASE:
4360                 break;
4361         default:
4362                 return -EINVAL;
4363         }
4364
4365         r = regulatory_hint_user(data, user_reg_hint_type);
4366
4367         return r;
4368 }
4369
4370 static int nl80211_get_mesh_config(struct sk_buff *skb,
4371                                    struct genl_info *info)
4372 {
4373         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4374         struct net_device *dev = info->user_ptr[1];
4375         struct wireless_dev *wdev = dev->ieee80211_ptr;
4376         struct mesh_config cur_params;
4377         int err = 0;
4378         void *hdr;
4379         struct nlattr *pinfoattr;
4380         struct sk_buff *msg;
4381
4382         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4383                 return -EOPNOTSUPP;
4384
4385         if (!rdev->ops->get_mesh_config)
4386                 return -EOPNOTSUPP;
4387
4388         wdev_lock(wdev);
4389         /* If not connected, get default parameters */
4390         if (!wdev->mesh_id_len)
4391                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
4392         else
4393                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
4394         wdev_unlock(wdev);
4395
4396         if (err)
4397                 return err;
4398
4399         /* Draw up a netlink message to send back */
4400         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4401         if (!msg)
4402                 return -ENOMEM;
4403         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4404                              NL80211_CMD_GET_MESH_CONFIG);
4405         if (!hdr)
4406                 goto out;
4407         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
4408         if (!pinfoattr)
4409                 goto nla_put_failure;
4410         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4411             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
4412                         cur_params.dot11MeshRetryTimeout) ||
4413             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4414                         cur_params.dot11MeshConfirmTimeout) ||
4415             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
4416                         cur_params.dot11MeshHoldingTimeout) ||
4417             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
4418                         cur_params.dot11MeshMaxPeerLinks) ||
4419             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
4420                        cur_params.dot11MeshMaxRetries) ||
4421             nla_put_u8(msg, NL80211_MESHCONF_TTL,
4422                        cur_params.dot11MeshTTL) ||
4423             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
4424                        cur_params.element_ttl) ||
4425             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4426                        cur_params.auto_open_plinks) ||
4427             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4428                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
4429             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4430                        cur_params.dot11MeshHWMPmaxPREQretries) ||
4431             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
4432                         cur_params.path_refresh_time) ||
4433             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4434                         cur_params.min_discovery_timeout) ||
4435             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4436                         cur_params.dot11MeshHWMPactivePathTimeout) ||
4437             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4438                         cur_params.dot11MeshHWMPpreqMinInterval) ||
4439             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4440                         cur_params.dot11MeshHWMPperrMinInterval) ||
4441             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4442                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
4443             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
4444                        cur_params.dot11MeshHWMPRootMode) ||
4445             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4446                         cur_params.dot11MeshHWMPRannInterval) ||
4447             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4448                        cur_params.dot11MeshGateAnnouncementProtocol) ||
4449             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
4450                        cur_params.dot11MeshForwarding) ||
4451             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
4452                         cur_params.rssi_threshold) ||
4453             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
4454                         cur_params.ht_opmode) ||
4455             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4456                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
4457             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4458                         cur_params.dot11MeshHWMProotInterval) ||
4459             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4460                         cur_params.dot11MeshHWMPconfirmationInterval) ||
4461             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
4462                         cur_params.power_mode) ||
4463             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
4464                         cur_params.dot11MeshAwakeWindowDuration))
4465                 goto nla_put_failure;
4466         nla_nest_end(msg, pinfoattr);
4467         genlmsg_end(msg, hdr);
4468         return genlmsg_reply(msg, info);
4469
4470  nla_put_failure:
4471         genlmsg_cancel(msg, hdr);
4472  out:
4473         nlmsg_free(msg);
4474         return -ENOBUFS;
4475 }
4476
4477 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
4478         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
4479         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
4480         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
4481         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
4482         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
4483         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
4484         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
4485         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
4486         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
4487         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
4488         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
4489         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
4490         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
4491         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
4492         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
4493         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
4494         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
4495         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
4496         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
4497         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
4498         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
4499         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
4500         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
4501         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
4502         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
4503         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
4504         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
4505 };
4506
4507 static const struct nla_policy
4508         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
4509         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
4510         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
4511         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
4512         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
4513         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
4514                                     .len = IEEE80211_MAX_DATA_LEN },
4515         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
4516 };
4517
4518 static int nl80211_parse_mesh_config(struct genl_info *info,
4519                                      struct mesh_config *cfg,
4520                                      u32 *mask_out)
4521 {
4522         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
4523         u32 mask = 0;
4524
4525 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
4526 do {                                                                        \
4527         if (tb[attr]) {                                                     \
4528                 if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
4529                         return -EINVAL;                                     \
4530                 cfg->param = fn(tb[attr]);                                  \
4531                 mask |= (1 << (attr - 1));                                  \
4532         }                                                                   \
4533 } while (0)
4534
4535
4536         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
4537                 return -EINVAL;
4538         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
4539                              info->attrs[NL80211_ATTR_MESH_CONFIG],
4540                              nl80211_meshconf_params_policy))
4541                 return -EINVAL;
4542
4543         /* This makes sure that there aren't more than 32 mesh config
4544          * parameters (otherwise our bitfield scheme would not work.) */
4545         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
4546
4547         /* Fill in the params struct */
4548         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
4549                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
4550                                   nla_get_u16);
4551         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
4552                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4553                                   nla_get_u16);
4554         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
4555                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
4556                                   nla_get_u16);
4557         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
4558                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
4559                                   nla_get_u16);
4560         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
4561                                   mask, NL80211_MESHCONF_MAX_RETRIES,
4562                                   nla_get_u8);
4563         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
4564                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
4565         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
4566                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
4567                                   nla_get_u8);
4568         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
4569                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4570                                   nla_get_u8);
4571         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
4572                                   1, 255, mask,
4573                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4574                                   nla_get_u32);
4575         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
4576                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4577                                   nla_get_u8);
4578         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
4579                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
4580                                   nla_get_u32);
4581         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
4582                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4583                                   nla_get_u16);
4584         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
4585                                   1, 65535, mask,
4586                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4587                                   nla_get_u32);
4588         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
4589                                   1, 65535, mask,
4590                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4591                                   nla_get_u16);
4592         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
4593                                   1, 65535, mask,
4594                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4595                                   nla_get_u16);
4596         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4597                                   dot11MeshHWMPnetDiameterTraversalTime,
4598                                   1, 65535, mask,
4599                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4600                                   nla_get_u16);
4601         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
4602                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
4603                                   nla_get_u8);
4604         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
4605                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4606                                   nla_get_u16);
4607         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4608                                   dot11MeshGateAnnouncementProtocol, 0, 1,
4609                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4610                                   nla_get_u8);
4611         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
4612                                   mask, NL80211_MESHCONF_FORWARDING,
4613                                   nla_get_u8);
4614         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, 1, 255,
4615                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
4616                                   nla_get_u32);
4617         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
4618                                   mask, NL80211_MESHCONF_HT_OPMODE,
4619                                   nla_get_u16);
4620         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
4621                                   1, 65535, mask,
4622                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4623                                   nla_get_u32);
4624         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
4625                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4626                                   nla_get_u16);
4627         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4628                                   dot11MeshHWMPconfirmationInterval,
4629                                   1, 65535, mask,
4630                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4631                                   nla_get_u16);
4632         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
4633                                   NL80211_MESH_POWER_ACTIVE,
4634                                   NL80211_MESH_POWER_MAX,
4635                                   mask, NL80211_MESHCONF_POWER_MODE,
4636                                   nla_get_u32);
4637         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
4638                                   0, 65535, mask,
4639                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
4640         if (mask_out)
4641                 *mask_out = mask;
4642
4643         return 0;
4644
4645 #undef FILL_IN_MESH_PARAM_IF_SET
4646 }
4647
4648 static int nl80211_parse_mesh_setup(struct genl_info *info,
4649                                      struct mesh_setup *setup)
4650 {
4651         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
4652
4653         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
4654                 return -EINVAL;
4655         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
4656                              info->attrs[NL80211_ATTR_MESH_SETUP],
4657                              nl80211_mesh_setup_params_policy))
4658                 return -EINVAL;
4659
4660         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
4661                 setup->sync_method =
4662                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
4663                  IEEE80211_SYNC_METHOD_VENDOR :
4664                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
4665
4666         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
4667                 setup->path_sel_proto =
4668                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
4669                  IEEE80211_PATH_PROTOCOL_VENDOR :
4670                  IEEE80211_PATH_PROTOCOL_HWMP;
4671
4672         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
4673                 setup->path_metric =
4674                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
4675                  IEEE80211_PATH_METRIC_VENDOR :
4676                  IEEE80211_PATH_METRIC_AIRTIME;
4677
4678
4679         if (tb[NL80211_MESH_SETUP_IE]) {
4680                 struct nlattr *ieattr =
4681                         tb[NL80211_MESH_SETUP_IE];
4682                 if (!is_valid_ie_attr(ieattr))
4683                         return -EINVAL;
4684                 setup->ie = nla_data(ieattr);
4685                 setup->ie_len = nla_len(ieattr);
4686         }
4687         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
4688         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
4689
4690         return 0;
4691 }
4692
4693 static int nl80211_update_mesh_config(struct sk_buff *skb,
4694                                       struct genl_info *info)
4695 {
4696         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4697         struct net_device *dev = info->user_ptr[1];
4698         struct wireless_dev *wdev = dev->ieee80211_ptr;
4699         struct mesh_config cfg;
4700         u32 mask;
4701         int err;
4702
4703         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4704                 return -EOPNOTSUPP;
4705
4706         if (!rdev->ops->update_mesh_config)
4707                 return -EOPNOTSUPP;
4708
4709         err = nl80211_parse_mesh_config(info, &cfg, &mask);
4710         if (err)
4711                 return err;
4712
4713         wdev_lock(wdev);
4714         if (!wdev->mesh_id_len)
4715                 err = -ENOLINK;
4716
4717         if (!err)
4718                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
4719
4720         wdev_unlock(wdev);
4721
4722         return err;
4723 }
4724
4725 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
4726 {
4727         const struct ieee80211_regdomain *regdom;
4728         struct sk_buff *msg;
4729         void *hdr = NULL;
4730         struct nlattr *nl_reg_rules;
4731         unsigned int i;
4732         int err = -EINVAL;
4733
4734         mutex_lock(&cfg80211_mutex);
4735
4736         if (!cfg80211_regdomain)
4737                 goto out;
4738
4739         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4740         if (!msg) {
4741                 err = -ENOBUFS;
4742                 goto out;
4743         }
4744
4745         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4746                              NL80211_CMD_GET_REG);
4747         if (!hdr)
4748                 goto put_failure;
4749
4750         if (reg_last_request_cell_base() &&
4751             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
4752                         NL80211_USER_REG_HINT_CELL_BASE))
4753                 goto nla_put_failure;
4754
4755         rcu_read_lock();
4756         regdom = rcu_dereference(cfg80211_regdomain);
4757
4758         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
4759             (regdom->dfs_region &&
4760              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
4761                 goto nla_put_failure_rcu;
4762
4763         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
4764         if (!nl_reg_rules)
4765                 goto nla_put_failure_rcu;
4766
4767         for (i = 0; i < regdom->n_reg_rules; i++) {
4768                 struct nlattr *nl_reg_rule;
4769                 const struct ieee80211_reg_rule *reg_rule;
4770                 const struct ieee80211_freq_range *freq_range;
4771                 const struct ieee80211_power_rule *power_rule;
4772
4773                 reg_rule = &regdom->reg_rules[i];
4774                 freq_range = &reg_rule->freq_range;
4775                 power_rule = &reg_rule->power_rule;
4776
4777                 nl_reg_rule = nla_nest_start(msg, i);
4778                 if (!nl_reg_rule)
4779                         goto nla_put_failure_rcu;
4780
4781                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
4782                                 reg_rule->flags) ||
4783                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
4784                                 freq_range->start_freq_khz) ||
4785                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
4786                                 freq_range->end_freq_khz) ||
4787                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
4788                                 freq_range->max_bandwidth_khz) ||
4789                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
4790                                 power_rule->max_antenna_gain) ||
4791                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
4792                                 power_rule->max_eirp))
4793                         goto nla_put_failure_rcu;
4794
4795                 nla_nest_end(msg, nl_reg_rule);
4796         }
4797         rcu_read_unlock();
4798
4799         nla_nest_end(msg, nl_reg_rules);
4800
4801         genlmsg_end(msg, hdr);
4802         err = genlmsg_reply(msg, info);
4803         goto out;
4804
4805 nla_put_failure_rcu:
4806         rcu_read_unlock();
4807 nla_put_failure:
4808         genlmsg_cancel(msg, hdr);
4809 put_failure:
4810         nlmsg_free(msg);
4811         err = -EMSGSIZE;
4812 out:
4813         mutex_unlock(&cfg80211_mutex);
4814         return err;
4815 }
4816
4817 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
4818 {
4819         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
4820         struct nlattr *nl_reg_rule;
4821         char *alpha2 = NULL;
4822         int rem_reg_rules = 0, r = 0;
4823         u32 num_rules = 0, rule_idx = 0, size_of_regd;
4824         u8 dfs_region = 0;
4825         struct ieee80211_regdomain *rd = NULL;
4826
4827         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4828                 return -EINVAL;
4829
4830         if (!info->attrs[NL80211_ATTR_REG_RULES])
4831                 return -EINVAL;
4832
4833         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4834
4835         if (info->attrs[NL80211_ATTR_DFS_REGION])
4836                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
4837
4838         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
4839                             rem_reg_rules) {
4840                 num_rules++;
4841                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
4842                         return -EINVAL;
4843         }
4844
4845         size_of_regd = sizeof(struct ieee80211_regdomain) +
4846                        num_rules * sizeof(struct ieee80211_reg_rule);
4847
4848         rd = kzalloc(size_of_regd, GFP_KERNEL);
4849         if (!rd)
4850                 return -ENOMEM;
4851
4852         rd->n_reg_rules = num_rules;
4853         rd->alpha2[0] = alpha2[0];
4854         rd->alpha2[1] = alpha2[1];
4855
4856         /*
4857          * Disable DFS master mode if the DFS region was
4858          * not supported or known on this kernel.
4859          */
4860         if (reg_supported_dfs_region(dfs_region))
4861                 rd->dfs_region = dfs_region;
4862
4863         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
4864                             rem_reg_rules) {
4865                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
4866                           nla_data(nl_reg_rule), nla_len(nl_reg_rule),
4867                           reg_rule_policy);
4868                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
4869                 if (r)
4870                         goto bad_reg;
4871
4872                 rule_idx++;
4873
4874                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
4875                         r = -EINVAL;
4876                         goto bad_reg;
4877                 }
4878         }
4879
4880         mutex_lock(&cfg80211_mutex);
4881
4882         r = set_regdom(rd);
4883         /* set_regdom took ownership */
4884         rd = NULL;
4885         mutex_unlock(&cfg80211_mutex);
4886
4887  bad_reg:
4888         kfree(rd);
4889         return r;
4890 }
4891
4892 static int validate_scan_freqs(struct nlattr *freqs)
4893 {
4894         struct nlattr *attr1, *attr2;
4895         int n_channels = 0, tmp1, tmp2;
4896
4897         nla_for_each_nested(attr1, freqs, tmp1) {
4898                 n_channels++;
4899                 /*
4900                  * Some hardware has a limited channel list for
4901                  * scanning, and it is pretty much nonsensical
4902                  * to scan for a channel twice, so disallow that
4903                  * and don't require drivers to check that the
4904                  * channel list they get isn't longer than what
4905                  * they can scan, as long as they can scan all
4906                  * the channels they registered at once.
4907                  */
4908                 nla_for_each_nested(attr2, freqs, tmp2)
4909                         if (attr1 != attr2 &&
4910                             nla_get_u32(attr1) == nla_get_u32(attr2))
4911                                 return 0;
4912         }
4913
4914         return n_channels;
4915 }
4916
4917 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
4918 {
4919         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4920         struct wireless_dev *wdev = info->user_ptr[1];
4921         struct cfg80211_scan_request *request;
4922         struct nlattr *attr;
4923         struct wiphy *wiphy;
4924         int err, tmp, n_ssids = 0, n_channels, i;
4925         size_t ie_len;
4926
4927         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4928                 return -EINVAL;
4929
4930         wiphy = &rdev->wiphy;
4931
4932         if (!rdev->ops->scan)
4933                 return -EOPNOTSUPP;
4934
4935         if (rdev->scan_req)
4936                 return -EBUSY;
4937
4938         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4939                 n_channels = validate_scan_freqs(
4940                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
4941                 if (!n_channels)
4942                         return -EINVAL;
4943         } else {
4944                 enum ieee80211_band band;
4945                 n_channels = 0;
4946
4947                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
4948                         if (wiphy->bands[band])
4949                                 n_channels += wiphy->bands[band]->n_channels;
4950         }
4951
4952         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
4953                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
4954                         n_ssids++;
4955
4956         if (n_ssids > wiphy->max_scan_ssids)
4957                 return -EINVAL;
4958
4959         if (info->attrs[NL80211_ATTR_IE])
4960                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4961         else
4962                 ie_len = 0;
4963
4964         if (ie_len > wiphy->max_scan_ie_len)
4965                 return -EINVAL;
4966
4967         request = kzalloc(sizeof(*request)
4968                         + sizeof(*request->ssids) * n_ssids
4969                         + sizeof(*request->channels) * n_channels
4970                         + ie_len, GFP_KERNEL);
4971         if (!request)
4972                 return -ENOMEM;
4973
4974         if (n_ssids)
4975                 request->ssids = (void *)&request->channels[n_channels];
4976         request->n_ssids = n_ssids;
4977         if (ie_len) {
4978                 if (request->ssids)
4979                         request->ie = (void *)(request->ssids + n_ssids);
4980                 else
4981                         request->ie = (void *)(request->channels + n_channels);
4982         }
4983
4984         i = 0;
4985         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4986                 /* user specified, bail out if channel not found */
4987                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
4988                         struct ieee80211_channel *chan;
4989
4990                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
4991
4992                         if (!chan) {
4993                                 err = -EINVAL;
4994                                 goto out_free;
4995                         }
4996
4997                         /* ignore disabled channels */
4998                         if (chan->flags & IEEE80211_CHAN_DISABLED)
4999                                 continue;
5000
5001                         request->channels[i] = chan;
5002                         i++;
5003                 }
5004         } else {
5005                 enum ieee80211_band band;
5006
5007                 /* all channels */
5008                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5009                         int j;
5010                         if (!wiphy->bands[band])
5011                                 continue;
5012                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5013                                 struct ieee80211_channel *chan;
5014
5015                                 chan = &wiphy->bands[band]->channels[j];
5016
5017                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5018                                         continue;
5019
5020                                 request->channels[i] = chan;
5021                                 i++;
5022                         }
5023                 }
5024         }
5025
5026         if (!i) {
5027                 err = -EINVAL;
5028                 goto out_free;
5029         }
5030
5031         request->n_channels = i;
5032
5033         i = 0;
5034         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5035                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
5036                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5037                                 err = -EINVAL;
5038                                 goto out_free;
5039                         }
5040                         request->ssids[i].ssid_len = nla_len(attr);
5041                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
5042                         i++;
5043                 }
5044         }
5045
5046         if (info->attrs[NL80211_ATTR_IE]) {
5047                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5048                 memcpy((void *)request->ie,
5049                        nla_data(info->attrs[NL80211_ATTR_IE]),
5050                        request->ie_len);
5051         }
5052
5053         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
5054                 if (wiphy->bands[i])
5055                         request->rates[i] =
5056                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
5057
5058         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
5059                 nla_for_each_nested(attr,
5060                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
5061                                     tmp) {
5062                         enum ieee80211_band band = nla_type(attr);
5063
5064                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
5065                                 err = -EINVAL;
5066                                 goto out_free;
5067                         }
5068                         err = ieee80211_get_ratemask(wiphy->bands[band],
5069                                                      nla_data(attr),
5070                                                      nla_len(attr),
5071                                                      &request->rates[band]);
5072                         if (err)
5073                                 goto out_free;
5074                 }
5075         }
5076
5077         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5078                 request->flags = nla_get_u32(
5079                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5080                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5081                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
5082                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
5083                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
5084                         err = -EOPNOTSUPP;
5085                         goto out_free;
5086                 }
5087         }
5088
5089         request->no_cck =
5090                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
5091
5092         request->wdev = wdev;
5093         request->wiphy = &rdev->wiphy;
5094         request->scan_start = jiffies;
5095
5096         rdev->scan_req = request;
5097         err = rdev_scan(rdev, request);
5098
5099         if (!err) {
5100                 nl80211_send_scan_start(rdev, wdev);
5101                 if (wdev->netdev)
5102                         dev_hold(wdev->netdev);
5103         } else {
5104  out_free:
5105                 rdev->scan_req = NULL;
5106                 kfree(request);
5107         }
5108
5109         return err;
5110 }
5111
5112 static int nl80211_start_sched_scan(struct sk_buff *skb,
5113                                     struct genl_info *info)
5114 {
5115         struct cfg80211_sched_scan_request *request;
5116         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5117         struct net_device *dev = info->user_ptr[1];
5118         struct nlattr *attr;
5119         struct wiphy *wiphy;
5120         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
5121         u32 interval;
5122         enum ieee80211_band band;
5123         size_t ie_len;
5124         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
5125
5126         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5127             !rdev->ops->sched_scan_start)
5128                 return -EOPNOTSUPP;
5129
5130         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5131                 return -EINVAL;
5132
5133         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
5134                 return -EINVAL;
5135
5136         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
5137         if (interval == 0)
5138                 return -EINVAL;
5139
5140         wiphy = &rdev->wiphy;
5141
5142         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5143                 n_channels = validate_scan_freqs(
5144                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5145                 if (!n_channels)
5146                         return -EINVAL;
5147         } else {
5148                 n_channels = 0;
5149
5150                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
5151                         if (wiphy->bands[band])
5152                                 n_channels += wiphy->bands[band]->n_channels;
5153         }
5154
5155         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5156                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5157                                     tmp)
5158                         n_ssids++;
5159
5160         if (n_ssids > wiphy->max_sched_scan_ssids)
5161                 return -EINVAL;
5162
5163         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
5164                 nla_for_each_nested(attr,
5165                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5166                                     tmp)
5167                         n_match_sets++;
5168
5169         if (n_match_sets > wiphy->max_match_sets)
5170                 return -EINVAL;
5171
5172         if (info->attrs[NL80211_ATTR_IE])
5173                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5174         else
5175                 ie_len = 0;
5176
5177         if (ie_len > wiphy->max_sched_scan_ie_len)
5178                 return -EINVAL;
5179
5180         mutex_lock(&rdev->sched_scan_mtx);
5181
5182         if (rdev->sched_scan_req) {
5183                 err = -EINPROGRESS;
5184                 goto out;
5185         }
5186
5187         request = kzalloc(sizeof(*request)
5188                         + sizeof(*request->ssids) * n_ssids
5189                         + sizeof(*request->match_sets) * n_match_sets
5190                         + sizeof(*request->channels) * n_channels
5191                         + ie_len, GFP_KERNEL);
5192         if (!request) {
5193                 err = -ENOMEM;
5194                 goto out;
5195         }
5196
5197         if (n_ssids)
5198                 request->ssids = (void *)&request->channels[n_channels];
5199         request->n_ssids = n_ssids;
5200         if (ie_len) {
5201                 if (request->ssids)
5202                         request->ie = (void *)(request->ssids + n_ssids);
5203                 else
5204                         request->ie = (void *)(request->channels + n_channels);
5205         }
5206
5207         if (n_match_sets) {
5208                 if (request->ie)
5209                         request->match_sets = (void *)(request->ie + ie_len);
5210                 else if (request->ssids)
5211                         request->match_sets =
5212                                 (void *)(request->ssids + n_ssids);
5213                 else
5214                         request->match_sets =
5215                                 (void *)(request->channels + n_channels);
5216         }
5217         request->n_match_sets = n_match_sets;
5218
5219         i = 0;
5220         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5221                 /* user specified, bail out if channel not found */
5222                 nla_for_each_nested(attr,
5223                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
5224                                     tmp) {
5225                         struct ieee80211_channel *chan;
5226
5227                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5228
5229                         if (!chan) {
5230                                 err = -EINVAL;
5231                                 goto out_free;
5232                         }
5233
5234                         /* ignore disabled channels */
5235                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5236                                 continue;
5237
5238                         request->channels[i] = chan;
5239                         i++;
5240                 }
5241         } else {
5242                 /* all channels */
5243                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5244                         int j;
5245                         if (!wiphy->bands[band])
5246                                 continue;
5247                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5248                                 struct ieee80211_channel *chan;
5249
5250                                 chan = &wiphy->bands[band]->channels[j];
5251
5252                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5253                                         continue;
5254
5255                                 request->channels[i] = chan;
5256                                 i++;
5257                         }
5258                 }
5259         }
5260
5261         if (!i) {
5262                 err = -EINVAL;
5263                 goto out_free;
5264         }
5265
5266         request->n_channels = i;
5267
5268         i = 0;
5269         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5270                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5271                                     tmp) {
5272                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5273                                 err = -EINVAL;
5274                                 goto out_free;
5275                         }
5276                         request->ssids[i].ssid_len = nla_len(attr);
5277                         memcpy(request->ssids[i].ssid, nla_data(attr),
5278                                nla_len(attr));
5279                         i++;
5280                 }
5281         }
5282
5283         i = 0;
5284         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5285                 nla_for_each_nested(attr,
5286                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5287                                     tmp) {
5288                         struct nlattr *ssid, *rssi;
5289
5290                         nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5291                                   nla_data(attr), nla_len(attr),
5292                                   nl80211_match_policy);
5293                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
5294                         if (ssid) {
5295                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
5296                                         err = -EINVAL;
5297                                         goto out_free;
5298                                 }
5299                                 memcpy(request->match_sets[i].ssid.ssid,
5300                                        nla_data(ssid), nla_len(ssid));
5301                                 request->match_sets[i].ssid.ssid_len =
5302                                         nla_len(ssid);
5303                         }
5304                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5305                         if (rssi)
5306                                 request->rssi_thold = nla_get_u32(rssi);
5307                         else
5308                                 request->rssi_thold =
5309                                                    NL80211_SCAN_RSSI_THOLD_OFF;
5310                         i++;
5311                 }
5312         }
5313
5314         if (info->attrs[NL80211_ATTR_IE]) {
5315                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5316                 memcpy((void *)request->ie,
5317                        nla_data(info->attrs[NL80211_ATTR_IE]),
5318                        request->ie_len);
5319         }
5320
5321         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5322                 request->flags = nla_get_u32(
5323                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5324                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5325                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
5326                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
5327                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
5328                         err = -EOPNOTSUPP;
5329                         goto out_free;
5330                 }
5331         }
5332
5333         request->dev = dev;
5334         request->wiphy = &rdev->wiphy;
5335         request->interval = interval;
5336         request->scan_start = jiffies;
5337
5338         err = rdev_sched_scan_start(rdev, dev, request);
5339         if (!err) {
5340                 rdev->sched_scan_req = request;
5341                 nl80211_send_sched_scan(rdev, dev,
5342                                         NL80211_CMD_START_SCHED_SCAN);
5343                 goto out;
5344         }
5345
5346 out_free:
5347         kfree(request);
5348 out:
5349         mutex_unlock(&rdev->sched_scan_mtx);
5350         return err;
5351 }
5352
5353 static int nl80211_stop_sched_scan(struct sk_buff *skb,
5354                                    struct genl_info *info)
5355 {
5356         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5357         int err;
5358
5359         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5360             !rdev->ops->sched_scan_stop)
5361                 return -EOPNOTSUPP;
5362
5363         mutex_lock(&rdev->sched_scan_mtx);
5364         err = __cfg80211_stop_sched_scan(rdev, false);
5365         mutex_unlock(&rdev->sched_scan_mtx);
5366
5367         return err;
5368 }
5369
5370 static int nl80211_start_radar_detection(struct sk_buff *skb,
5371                                          struct genl_info *info)
5372 {
5373         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5374         struct net_device *dev = info->user_ptr[1];
5375         struct wireless_dev *wdev = dev->ieee80211_ptr;
5376         struct cfg80211_chan_def chandef;
5377         int err;
5378
5379         err = nl80211_parse_chandef(rdev, info, &chandef);
5380         if (err)
5381                 return err;
5382
5383         if (wdev->cac_started)
5384                 return -EBUSY;
5385
5386         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef);
5387         if (err < 0)
5388                 return err;
5389
5390         if (err == 0)
5391                 return -EINVAL;
5392
5393         if (chandef.chan->dfs_state != NL80211_DFS_USABLE)
5394                 return -EINVAL;
5395
5396         if (!rdev->ops->start_radar_detection)
5397                 return -EOPNOTSUPP;
5398
5399         mutex_lock(&rdev->devlist_mtx);
5400         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
5401                                            chandef.chan, CHAN_MODE_SHARED,
5402                                            BIT(chandef.width));
5403         if (err)
5404                 goto err_locked;
5405
5406         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef);
5407         if (!err) {
5408                 wdev->channel = chandef.chan;
5409                 wdev->cac_started = true;
5410                 wdev->cac_start_time = jiffies;
5411         }
5412 err_locked:
5413         mutex_unlock(&rdev->devlist_mtx);
5414
5415         return err;
5416 }
5417
5418 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
5419                             u32 seq, int flags,
5420                             struct cfg80211_registered_device *rdev,
5421                             struct wireless_dev *wdev,
5422                             struct cfg80211_internal_bss *intbss)
5423 {
5424         struct cfg80211_bss *res = &intbss->pub;
5425         const struct cfg80211_bss_ies *ies;
5426         void *hdr;
5427         struct nlattr *bss;
5428         bool tsf = false;
5429
5430         ASSERT_WDEV_LOCK(wdev);
5431
5432         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
5433                              NL80211_CMD_NEW_SCAN_RESULTS);
5434         if (!hdr)
5435                 return -1;
5436
5437         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
5438
5439         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation) ||
5440             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
5441                 goto nla_put_failure;
5442
5443         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
5444         if (!bss)
5445                 goto nla_put_failure;
5446         if ((!is_zero_ether_addr(res->bssid) &&
5447              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
5448                 goto nla_put_failure;
5449
5450         rcu_read_lock();
5451         ies = rcu_dereference(res->ies);
5452         if (ies) {
5453                 if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5454                         goto fail_unlock_rcu;
5455                 tsf = true;
5456                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
5457                                         ies->len, ies->data))
5458                         goto fail_unlock_rcu;
5459         }
5460         ies = rcu_dereference(res->beacon_ies);
5461         if (ies) {
5462                 if (!tsf && nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5463                         goto fail_unlock_rcu;
5464                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
5465                                         ies->len, ies->data))
5466                         goto fail_unlock_rcu;
5467         }
5468         rcu_read_unlock();
5469
5470         if (res->beacon_interval &&
5471             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
5472                 goto nla_put_failure;
5473         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
5474             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
5475             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
5476                         jiffies_to_msecs(jiffies - intbss->ts)))
5477                 goto nla_put_failure;
5478
5479         switch (rdev->wiphy.signal_type) {
5480         case CFG80211_SIGNAL_TYPE_MBM:
5481                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
5482                         goto nla_put_failure;
5483                 break;
5484         case CFG80211_SIGNAL_TYPE_UNSPEC:
5485                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
5486                         goto nla_put_failure;
5487                 break;
5488         default:
5489                 break;
5490         }
5491
5492         switch (wdev->iftype) {
5493         case NL80211_IFTYPE_P2P_CLIENT:
5494         case NL80211_IFTYPE_STATION:
5495                 if (intbss == wdev->current_bss &&
5496                     nla_put_u32(msg, NL80211_BSS_STATUS,
5497                                 NL80211_BSS_STATUS_ASSOCIATED))
5498                         goto nla_put_failure;
5499                 break;
5500         case NL80211_IFTYPE_ADHOC:
5501                 if (intbss == wdev->current_bss &&
5502                     nla_put_u32(msg, NL80211_BSS_STATUS,
5503                                 NL80211_BSS_STATUS_IBSS_JOINED))
5504                         goto nla_put_failure;
5505                 break;
5506         default:
5507                 break;
5508         }
5509
5510         nla_nest_end(msg, bss);
5511
5512         return genlmsg_end(msg, hdr);
5513
5514  fail_unlock_rcu:
5515         rcu_read_unlock();
5516  nla_put_failure:
5517         genlmsg_cancel(msg, hdr);
5518         return -EMSGSIZE;
5519 }
5520
5521 static int nl80211_dump_scan(struct sk_buff *skb,
5522                              struct netlink_callback *cb)
5523 {
5524         struct cfg80211_registered_device *rdev;
5525         struct net_device *dev;
5526         struct cfg80211_internal_bss *scan;
5527         struct wireless_dev *wdev;
5528         int start = cb->args[1], idx = 0;
5529         int err;
5530
5531         err = nl80211_prepare_netdev_dump(skb, cb, &rdev, &dev);
5532         if (err)
5533                 return err;
5534
5535         wdev = dev->ieee80211_ptr;
5536
5537         wdev_lock(wdev);
5538         spin_lock_bh(&rdev->bss_lock);
5539         cfg80211_bss_expire(rdev);
5540
5541         cb->seq = rdev->bss_generation;
5542
5543         list_for_each_entry(scan, &rdev->bss_list, list) {
5544                 if (++idx <= start)
5545                         continue;
5546                 if (nl80211_send_bss(skb, cb,
5547                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5548                                 rdev, wdev, scan) < 0) {
5549                         idx--;
5550                         break;
5551                 }
5552         }
5553
5554         spin_unlock_bh(&rdev->bss_lock);
5555         wdev_unlock(wdev);
5556
5557         cb->args[1] = idx;
5558         nl80211_finish_netdev_dump(rdev);
5559
5560         return skb->len;
5561 }
5562
5563 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
5564                                 int flags, struct net_device *dev,
5565                                 struct survey_info *survey)
5566 {
5567         void *hdr;
5568         struct nlattr *infoattr;
5569
5570         hdr = nl80211hdr_put(msg, portid, seq, flags,
5571                              NL80211_CMD_NEW_SURVEY_RESULTS);
5572         if (!hdr)
5573                 return -ENOMEM;
5574
5575         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
5576                 goto nla_put_failure;
5577
5578         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
5579         if (!infoattr)
5580                 goto nla_put_failure;
5581
5582         if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
5583                         survey->channel->center_freq))
5584                 goto nla_put_failure;
5585
5586         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
5587             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
5588                 goto nla_put_failure;
5589         if ((survey->filled & SURVEY_INFO_IN_USE) &&
5590             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
5591                 goto nla_put_failure;
5592         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
5593             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
5594                         survey->channel_time))
5595                 goto nla_put_failure;
5596         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
5597             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
5598                         survey->channel_time_busy))
5599                 goto nla_put_failure;
5600         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
5601             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
5602                         survey->channel_time_ext_busy))
5603                 goto nla_put_failure;
5604         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
5605             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
5606                         survey->channel_time_rx))
5607                 goto nla_put_failure;
5608         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
5609             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
5610                         survey->channel_time_tx))
5611                 goto nla_put_failure;
5612
5613         nla_nest_end(msg, infoattr);
5614
5615         return genlmsg_end(msg, hdr);
5616
5617  nla_put_failure:
5618         genlmsg_cancel(msg, hdr);
5619         return -EMSGSIZE;
5620 }
5621
5622 static int nl80211_dump_survey(struct sk_buff *skb,
5623                         struct netlink_callback *cb)
5624 {
5625         struct survey_info survey;
5626         struct cfg80211_registered_device *dev;
5627         struct net_device *netdev;
5628         int survey_idx = cb->args[1];
5629         int res;
5630
5631         res = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
5632         if (res)
5633                 return res;
5634
5635         if (!dev->ops->dump_survey) {
5636                 res = -EOPNOTSUPP;
5637                 goto out_err;
5638         }
5639
5640         while (1) {
5641                 struct ieee80211_channel *chan;
5642
5643                 res = rdev_dump_survey(dev, netdev, survey_idx, &survey);
5644                 if (res == -ENOENT)
5645                         break;
5646                 if (res)
5647                         goto out_err;
5648
5649                 /* Survey without a channel doesn't make sense */
5650                 if (!survey.channel) {
5651                         res = -EINVAL;
5652                         goto out;
5653                 }
5654
5655                 chan = ieee80211_get_channel(&dev->wiphy,
5656                                              survey.channel->center_freq);
5657                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
5658                         survey_idx++;
5659                         continue;
5660                 }
5661
5662                 if (nl80211_send_survey(skb,
5663                                 NETLINK_CB(cb->skb).portid,
5664                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5665                                 netdev,
5666                                 &survey) < 0)
5667                         goto out;
5668                 survey_idx++;
5669         }
5670
5671  out:
5672         cb->args[1] = survey_idx;
5673         res = skb->len;
5674  out_err:
5675         nl80211_finish_netdev_dump(dev);
5676         return res;
5677 }
5678
5679 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
5680 {
5681         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
5682                                   NL80211_WPA_VERSION_2));
5683 }
5684
5685 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
5686 {
5687         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5688         struct net_device *dev = info->user_ptr[1];
5689         struct ieee80211_channel *chan;
5690         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
5691         int err, ssid_len, ie_len = 0, sae_data_len = 0;
5692         enum nl80211_auth_type auth_type;
5693         struct key_parse key;
5694         bool local_state_change;
5695
5696         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5697                 return -EINVAL;
5698
5699         if (!info->attrs[NL80211_ATTR_MAC])
5700                 return -EINVAL;
5701
5702         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
5703                 return -EINVAL;
5704
5705         if (!info->attrs[NL80211_ATTR_SSID])
5706                 return -EINVAL;
5707
5708         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
5709                 return -EINVAL;
5710
5711         err = nl80211_parse_key(info, &key);
5712         if (err)
5713                 return err;
5714
5715         if (key.idx >= 0) {
5716                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
5717                         return -EINVAL;
5718                 if (!key.p.key || !key.p.key_len)
5719                         return -EINVAL;
5720                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
5721                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
5722                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
5723                      key.p.key_len != WLAN_KEY_LEN_WEP104))
5724                         return -EINVAL;
5725                 if (key.idx > 4)
5726                         return -EINVAL;
5727         } else {
5728                 key.p.key_len = 0;
5729                 key.p.key = NULL;
5730         }
5731
5732         if (key.idx >= 0) {
5733                 int i;
5734                 bool ok = false;
5735                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
5736                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
5737                                 ok = true;
5738                                 break;
5739                         }
5740                 }
5741                 if (!ok)
5742                         return -EINVAL;
5743         }
5744
5745         if (!rdev->ops->auth)
5746                 return -EOPNOTSUPP;
5747
5748         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5749             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5750                 return -EOPNOTSUPP;
5751
5752         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5753         chan = ieee80211_get_channel(&rdev->wiphy,
5754                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5755         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
5756                 return -EINVAL;
5757
5758         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5759         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5760
5761         if (info->attrs[NL80211_ATTR_IE]) {
5762                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5763                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5764         }
5765
5766         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
5767         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
5768                 return -EINVAL;
5769
5770         if (auth_type == NL80211_AUTHTYPE_SAE &&
5771             !info->attrs[NL80211_ATTR_SAE_DATA])
5772                 return -EINVAL;
5773
5774         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
5775                 if (auth_type != NL80211_AUTHTYPE_SAE)
5776                         return -EINVAL;
5777                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
5778                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
5779                 /* need to include at least Auth Transaction and Status Code */
5780                 if (sae_data_len < 4)
5781                         return -EINVAL;
5782         }
5783
5784         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5785
5786         /*
5787          * Since we no longer track auth state, ignore
5788          * requests to only change local state.
5789          */
5790         if (local_state_change)
5791                 return 0;
5792
5793         return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
5794                                   ssid, ssid_len, ie, ie_len,
5795                                   key.p.key, key.p.key_len, key.idx,
5796                                   sae_data, sae_data_len);
5797 }
5798
5799 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
5800                                    struct genl_info *info,
5801                                    struct cfg80211_crypto_settings *settings,
5802                                    int cipher_limit)
5803 {
5804         memset(settings, 0, sizeof(*settings));
5805
5806         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
5807
5808         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
5809                 u16 proto;
5810                 proto = nla_get_u16(
5811                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
5812                 settings->control_port_ethertype = cpu_to_be16(proto);
5813                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
5814                     proto != ETH_P_PAE)
5815                         return -EINVAL;
5816                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
5817                         settings->control_port_no_encrypt = true;
5818         } else
5819                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
5820
5821         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
5822                 void *data;
5823                 int len, i;
5824
5825                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5826                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5827                 settings->n_ciphers_pairwise = len / sizeof(u32);
5828
5829                 if (len % sizeof(u32))
5830                         return -EINVAL;
5831
5832                 if (settings->n_ciphers_pairwise > cipher_limit)
5833                         return -EINVAL;
5834
5835                 memcpy(settings->ciphers_pairwise, data, len);
5836
5837                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
5838                         if (!cfg80211_supported_cipher_suite(
5839                                         &rdev->wiphy,
5840                                         settings->ciphers_pairwise[i]))
5841                                 return -EINVAL;
5842         }
5843
5844         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
5845                 settings->cipher_group =
5846                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
5847                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
5848                                                      settings->cipher_group))
5849                         return -EINVAL;
5850         }
5851
5852         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
5853                 settings->wpa_versions =
5854                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
5855                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
5856                         return -EINVAL;
5857         }
5858
5859         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
5860                 void *data;
5861                 int len;
5862
5863                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
5864                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
5865                 settings->n_akm_suites = len / sizeof(u32);
5866
5867                 if (len % sizeof(u32))
5868                         return -EINVAL;
5869
5870                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
5871                         return -EINVAL;
5872
5873                 memcpy(settings->akm_suites, data, len);
5874         }
5875
5876         return 0;
5877 }
5878
5879 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
5880 {
5881         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5882         struct net_device *dev = info->user_ptr[1];
5883         struct cfg80211_crypto_settings crypto;
5884         struct ieee80211_channel *chan;
5885         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
5886         int err, ssid_len, ie_len = 0;
5887         bool use_mfp = false;
5888         u32 flags = 0;
5889         struct ieee80211_ht_cap *ht_capa = NULL;
5890         struct ieee80211_ht_cap *ht_capa_mask = NULL;
5891
5892         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5893                 return -EINVAL;
5894
5895         if (!info->attrs[NL80211_ATTR_MAC] ||
5896             !info->attrs[NL80211_ATTR_SSID] ||
5897             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
5898                 return -EINVAL;
5899
5900         if (!rdev->ops->assoc)
5901                 return -EOPNOTSUPP;
5902
5903         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5904             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5905                 return -EOPNOTSUPP;
5906
5907         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5908
5909         chan = ieee80211_get_channel(&rdev->wiphy,
5910                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5911         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
5912                 return -EINVAL;
5913
5914         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5915         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5916
5917         if (info->attrs[NL80211_ATTR_IE]) {
5918                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5919                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5920         }
5921
5922         if (info->attrs[NL80211_ATTR_USE_MFP]) {
5923                 enum nl80211_mfp mfp =
5924                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
5925                 if (mfp == NL80211_MFP_REQUIRED)
5926                         use_mfp = true;
5927                 else if (mfp != NL80211_MFP_NO)
5928                         return -EINVAL;
5929         }
5930
5931         if (info->attrs[NL80211_ATTR_PREV_BSSID])
5932                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
5933
5934         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
5935                 flags |= ASSOC_REQ_DISABLE_HT;
5936
5937         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
5938                 ht_capa_mask =
5939                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]);
5940
5941         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
5942                 if (!ht_capa_mask)
5943                         return -EINVAL;
5944                 ht_capa = nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5945         }
5946
5947         err = nl80211_crypto_settings(rdev, info, &crypto, 1);
5948         if (!err)
5949                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
5950                                           ssid, ssid_len, ie, ie_len, use_mfp,
5951                                           &crypto, flags, ht_capa,
5952                                           ht_capa_mask);
5953
5954         return err;
5955 }
5956
5957 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
5958 {
5959         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5960         struct net_device *dev = info->user_ptr[1];
5961         const u8 *ie = NULL, *bssid;
5962         int ie_len = 0;
5963         u16 reason_code;
5964         bool local_state_change;
5965
5966         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5967                 return -EINVAL;
5968
5969         if (!info->attrs[NL80211_ATTR_MAC])
5970                 return -EINVAL;
5971
5972         if (!info->attrs[NL80211_ATTR_REASON_CODE])
5973                 return -EINVAL;
5974
5975         if (!rdev->ops->deauth)
5976                 return -EOPNOTSUPP;
5977
5978         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5979             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5980                 return -EOPNOTSUPP;
5981
5982         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5983
5984         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5985         if (reason_code == 0) {
5986                 /* Reason Code 0 is reserved */
5987                 return -EINVAL;
5988         }
5989
5990         if (info->attrs[NL80211_ATTR_IE]) {
5991                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5992                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5993         }
5994
5995         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5996
5997         return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
5998                                     local_state_change);
5999 }
6000
6001 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
6002 {
6003         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6004         struct net_device *dev = info->user_ptr[1];
6005         const u8 *ie = NULL, *bssid;
6006         int ie_len = 0;
6007         u16 reason_code;
6008         bool local_state_change;
6009
6010         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6011                 return -EINVAL;
6012
6013         if (!info->attrs[NL80211_ATTR_MAC])
6014                 return -EINVAL;
6015
6016         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6017                 return -EINVAL;
6018
6019         if (!rdev->ops->disassoc)
6020                 return -EOPNOTSUPP;
6021
6022         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6023             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6024                 return -EOPNOTSUPP;
6025
6026         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6027
6028         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6029         if (reason_code == 0) {
6030                 /* Reason Code 0 is reserved */
6031                 return -EINVAL;
6032         }
6033
6034         if (info->attrs[NL80211_ATTR_IE]) {
6035                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6036                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6037         }
6038
6039         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6040
6041         return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
6042                                       local_state_change);
6043 }
6044
6045 static bool
6046 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
6047                          int mcast_rate[IEEE80211_NUM_BANDS],
6048                          int rateval)
6049 {
6050         struct wiphy *wiphy = &rdev->wiphy;
6051         bool found = false;
6052         int band, i;
6053
6054         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
6055                 struct ieee80211_supported_band *sband;
6056
6057                 sband = wiphy->bands[band];
6058                 if (!sband)
6059                         continue;
6060
6061                 for (i = 0; i < sband->n_bitrates; i++) {
6062                         if (sband->bitrates[i].bitrate == rateval) {
6063                                 mcast_rate[band] = i + 1;
6064                                 found = true;
6065                                 break;
6066                         }
6067                 }
6068         }
6069
6070         return found;
6071 }
6072
6073 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
6074 {
6075         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6076         struct net_device *dev = info->user_ptr[1];
6077         struct cfg80211_ibss_params ibss;
6078         struct wiphy *wiphy;
6079         struct cfg80211_cached_keys *connkeys = NULL;
6080         int err;
6081
6082         memset(&ibss, 0, sizeof(ibss));
6083
6084         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6085                 return -EINVAL;
6086
6087         if (!info->attrs[NL80211_ATTR_SSID] ||
6088             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6089                 return -EINVAL;
6090
6091         ibss.beacon_interval = 100;
6092
6093         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
6094                 ibss.beacon_interval =
6095                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
6096                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
6097                         return -EINVAL;
6098         }
6099
6100         if (!rdev->ops->join_ibss)
6101                 return -EOPNOTSUPP;
6102
6103         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6104                 return -EOPNOTSUPP;
6105
6106         wiphy = &rdev->wiphy;
6107
6108         if (info->attrs[NL80211_ATTR_MAC]) {
6109                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6110
6111                 if (!is_valid_ether_addr(ibss.bssid))
6112                         return -EINVAL;
6113         }
6114         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6115         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6116
6117         if (info->attrs[NL80211_ATTR_IE]) {
6118                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6119                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6120         }
6121
6122         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
6123         if (err)
6124                 return err;
6125
6126         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef))
6127                 return -EINVAL;
6128
6129         if (ibss.chandef.width > NL80211_CHAN_WIDTH_40)
6130                 return -EINVAL;
6131         if (ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
6132             !(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
6133                 return -EINVAL;
6134
6135         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
6136         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
6137
6138         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
6139                 u8 *rates =
6140                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6141                 int n_rates =
6142                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6143                 struct ieee80211_supported_band *sband =
6144                         wiphy->bands[ibss.chandef.chan->band];
6145
6146                 err = ieee80211_get_ratemask(sband, rates, n_rates,
6147                                              &ibss.basic_rates);
6148                 if (err)
6149                         return err;
6150         }
6151
6152         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
6153             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
6154                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
6155                 return -EINVAL;
6156
6157         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6158                 bool no_ht = false;
6159
6160                 connkeys = nl80211_parse_connkeys(rdev,
6161                                           info->attrs[NL80211_ATTR_KEYS],
6162                                           &no_ht);
6163                 if (IS_ERR(connkeys))
6164                         return PTR_ERR(connkeys);
6165
6166                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
6167                     no_ht) {
6168                         kfree(connkeys);
6169                         return -EINVAL;
6170                 }
6171         }
6172
6173         ibss.control_port =
6174                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
6175
6176         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
6177         if (err)
6178                 kfree(connkeys);
6179         return err;
6180 }
6181
6182 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
6183 {
6184         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6185         struct net_device *dev = info->user_ptr[1];
6186
6187         if (!rdev->ops->leave_ibss)
6188                 return -EOPNOTSUPP;
6189
6190         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6191                 return -EOPNOTSUPP;
6192
6193         return cfg80211_leave_ibss(rdev, dev, false);
6194 }
6195
6196 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
6197 {
6198         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6199         struct net_device *dev = info->user_ptr[1];
6200         int mcast_rate[IEEE80211_NUM_BANDS];
6201         u32 nla_rate;
6202         int err;
6203
6204         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
6205             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6206                 return -EOPNOTSUPP;
6207
6208         if (!rdev->ops->set_mcast_rate)
6209                 return -EOPNOTSUPP;
6210
6211         memset(mcast_rate, 0, sizeof(mcast_rate));
6212
6213         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
6214                 return -EINVAL;
6215
6216         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
6217         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
6218                 return -EINVAL;
6219
6220         err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
6221
6222         return err;
6223 }
6224
6225
6226 #ifdef CONFIG_NL80211_TESTMODE
6227 static struct genl_multicast_group nl80211_testmode_mcgrp = {
6228         .name = "testmode",
6229 };
6230
6231 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
6232 {
6233         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6234         int err;
6235
6236         if (!info->attrs[NL80211_ATTR_TESTDATA])
6237                 return -EINVAL;
6238
6239         err = -EOPNOTSUPP;
6240         if (rdev->ops->testmode_cmd) {
6241                 rdev->testmode_info = info;
6242                 err = rdev_testmode_cmd(rdev,
6243                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
6244                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
6245                 rdev->testmode_info = NULL;
6246         }
6247
6248         return err;
6249 }
6250
6251 static int nl80211_testmode_dump(struct sk_buff *skb,
6252                                  struct netlink_callback *cb)
6253 {
6254         struct cfg80211_registered_device *rdev;
6255         int err;
6256         long phy_idx;
6257         void *data = NULL;
6258         int data_len = 0;
6259
6260         if (cb->args[0]) {
6261                 /*
6262                  * 0 is a valid index, but not valid for args[0],
6263                  * so we need to offset by 1.
6264                  */
6265                 phy_idx = cb->args[0] - 1;
6266         } else {
6267                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
6268                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
6269                                   nl80211_policy);
6270                 if (err)
6271                         return err;
6272
6273                 mutex_lock(&cfg80211_mutex);
6274                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
6275                                                   nl80211_fam.attrbuf);
6276                 if (IS_ERR(rdev)) {
6277                         mutex_unlock(&cfg80211_mutex);
6278                         return PTR_ERR(rdev);
6279                 }
6280                 phy_idx = rdev->wiphy_idx;
6281                 rdev = NULL;
6282                 mutex_unlock(&cfg80211_mutex);
6283
6284                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
6285                         cb->args[1] =
6286                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
6287         }
6288
6289         if (cb->args[1]) {
6290                 data = nla_data((void *)cb->args[1]);
6291                 data_len = nla_len((void *)cb->args[1]);
6292         }
6293
6294         mutex_lock(&cfg80211_mutex);
6295         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
6296         if (!rdev) {
6297                 mutex_unlock(&cfg80211_mutex);
6298                 return -ENOENT;
6299         }
6300         cfg80211_lock_rdev(rdev);
6301         mutex_unlock(&cfg80211_mutex);
6302
6303         if (!rdev->ops->testmode_dump) {
6304                 err = -EOPNOTSUPP;
6305                 goto out_err;
6306         }
6307
6308         while (1) {
6309                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
6310                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
6311                                            NL80211_CMD_TESTMODE);
6312                 struct nlattr *tmdata;
6313
6314                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
6315                         genlmsg_cancel(skb, hdr);
6316                         break;
6317                 }
6318
6319                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6320                 if (!tmdata) {
6321                         genlmsg_cancel(skb, hdr);
6322                         break;
6323                 }
6324                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
6325                 nla_nest_end(skb, tmdata);
6326
6327                 if (err == -ENOBUFS || err == -ENOENT) {
6328                         genlmsg_cancel(skb, hdr);
6329                         break;
6330                 } else if (err) {
6331                         genlmsg_cancel(skb, hdr);
6332                         goto out_err;
6333                 }
6334
6335                 genlmsg_end(skb, hdr);
6336         }
6337
6338         err = skb->len;
6339         /* see above */
6340         cb->args[0] = phy_idx + 1;
6341  out_err:
6342         cfg80211_unlock_rdev(rdev);
6343         return err;
6344 }
6345
6346 static struct sk_buff *
6347 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
6348                               int approxlen, u32 portid, u32 seq, gfp_t gfp)
6349 {
6350         struct sk_buff *skb;
6351         void *hdr;
6352         struct nlattr *data;
6353
6354         skb = nlmsg_new(approxlen + 100, gfp);
6355         if (!skb)
6356                 return NULL;
6357
6358         hdr = nl80211hdr_put(skb, portid, seq, 0, NL80211_CMD_TESTMODE);
6359         if (!hdr) {
6360                 kfree_skb(skb);
6361                 return NULL;
6362         }
6363
6364         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
6365                 goto nla_put_failure;
6366         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6367
6368         ((void **)skb->cb)[0] = rdev;
6369         ((void **)skb->cb)[1] = hdr;
6370         ((void **)skb->cb)[2] = data;
6371
6372         return skb;
6373
6374  nla_put_failure:
6375         kfree_skb(skb);
6376         return NULL;
6377 }
6378
6379 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
6380                                                   int approxlen)
6381 {
6382         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6383
6384         if (WARN_ON(!rdev->testmode_info))
6385                 return NULL;
6386
6387         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
6388                                 rdev->testmode_info->snd_portid,
6389                                 rdev->testmode_info->snd_seq,
6390                                 GFP_KERNEL);
6391 }
6392 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
6393
6394 int cfg80211_testmode_reply(struct sk_buff *skb)
6395 {
6396         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
6397         void *hdr = ((void **)skb->cb)[1];
6398         struct nlattr *data = ((void **)skb->cb)[2];
6399
6400         if (WARN_ON(!rdev->testmode_info)) {
6401                 kfree_skb(skb);
6402                 return -EINVAL;
6403         }
6404
6405         nla_nest_end(skb, data);
6406         genlmsg_end(skb, hdr);
6407         return genlmsg_reply(skb, rdev->testmode_info);
6408 }
6409 EXPORT_SYMBOL(cfg80211_testmode_reply);
6410
6411 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
6412                                                   int approxlen, gfp_t gfp)
6413 {
6414         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6415
6416         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
6417 }
6418 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
6419
6420 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
6421 {
6422         void *hdr = ((void **)skb->cb)[1];
6423         struct nlattr *data = ((void **)skb->cb)[2];
6424
6425         nla_nest_end(skb, data);
6426         genlmsg_end(skb, hdr);
6427         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
6428 }
6429 EXPORT_SYMBOL(cfg80211_testmode_event);
6430 #endif
6431
6432 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
6433 {
6434         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6435         struct net_device *dev = info->user_ptr[1];
6436         struct cfg80211_connect_params connect;
6437         struct wiphy *wiphy;
6438         struct cfg80211_cached_keys *connkeys = NULL;
6439         int err;
6440
6441         memset(&connect, 0, sizeof(connect));
6442
6443         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6444                 return -EINVAL;
6445
6446         if (!info->attrs[NL80211_ATTR_SSID] ||
6447             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6448                 return -EINVAL;
6449
6450         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
6451                 connect.auth_type =
6452                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6453                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
6454                                              NL80211_CMD_CONNECT))
6455                         return -EINVAL;
6456         } else
6457                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
6458
6459         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
6460
6461         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
6462                                       NL80211_MAX_NR_CIPHER_SUITES);
6463         if (err)
6464                 return err;
6465
6466         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6467             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6468                 return -EOPNOTSUPP;
6469
6470         wiphy = &rdev->wiphy;
6471
6472         connect.bg_scan_period = -1;
6473         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
6474                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
6475                 connect.bg_scan_period =
6476                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
6477         }
6478
6479         if (info->attrs[NL80211_ATTR_MAC])
6480                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6481         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6482         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6483
6484         if (info->attrs[NL80211_ATTR_IE]) {
6485                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6486                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6487         }
6488
6489         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6490                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6491                 if (connect.mfp != NL80211_MFP_REQUIRED &&
6492                     connect.mfp != NL80211_MFP_NO)
6493                         return -EINVAL;
6494         } else {
6495                 connect.mfp = NL80211_MFP_NO;
6496         }
6497
6498         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6499                 connect.channel =
6500                         ieee80211_get_channel(wiphy,
6501                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6502                 if (!connect.channel ||
6503                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
6504                         return -EINVAL;
6505         }
6506
6507         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6508                 connkeys = nl80211_parse_connkeys(rdev,
6509                                           info->attrs[NL80211_ATTR_KEYS], NULL);
6510                 if (IS_ERR(connkeys))
6511                         return PTR_ERR(connkeys);
6512         }
6513
6514         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6515                 connect.flags |= ASSOC_REQ_DISABLE_HT;
6516
6517         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6518                 memcpy(&connect.ht_capa_mask,
6519                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6520                        sizeof(connect.ht_capa_mask));
6521
6522         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6523                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
6524                         kfree(connkeys);
6525                         return -EINVAL;
6526                 }
6527                 memcpy(&connect.ht_capa,
6528                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6529                        sizeof(connect.ht_capa));
6530         }
6531
6532         err = cfg80211_connect(rdev, dev, &connect, connkeys);
6533         if (err)
6534                 kfree(connkeys);
6535         return err;
6536 }
6537
6538 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
6539 {
6540         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6541         struct net_device *dev = info->user_ptr[1];
6542         u16 reason;
6543
6544         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6545                 reason = WLAN_REASON_DEAUTH_LEAVING;
6546         else
6547                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6548
6549         if (reason == 0)
6550                 return -EINVAL;
6551
6552         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6553             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6554                 return -EOPNOTSUPP;
6555
6556         return cfg80211_disconnect(rdev, dev, reason, true);
6557 }
6558
6559 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
6560 {
6561         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6562         struct net *net;
6563         int err;
6564         u32 pid;
6565
6566         if (!info->attrs[NL80211_ATTR_PID])
6567                 return -EINVAL;
6568
6569         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
6570
6571         net = get_net_ns_by_pid(pid);
6572         if (IS_ERR(net))
6573                 return PTR_ERR(net);
6574
6575         err = 0;
6576
6577         /* check if anything to do */
6578         if (!net_eq(wiphy_net(&rdev->wiphy), net))
6579                 err = cfg80211_switch_netns(rdev, net);
6580
6581         put_net(net);
6582         return err;
6583 }
6584
6585 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
6586 {
6587         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6588         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
6589                         struct cfg80211_pmksa *pmksa) = NULL;
6590         struct net_device *dev = info->user_ptr[1];
6591         struct cfg80211_pmksa pmksa;
6592
6593         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
6594
6595         if (!info->attrs[NL80211_ATTR_MAC])
6596                 return -EINVAL;
6597
6598         if (!info->attrs[NL80211_ATTR_PMKID])
6599                 return -EINVAL;
6600
6601         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
6602         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6603
6604         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6605             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6606                 return -EOPNOTSUPP;
6607
6608         switch (info->genlhdr->cmd) {
6609         case NL80211_CMD_SET_PMKSA:
6610                 rdev_ops = rdev->ops->set_pmksa;
6611                 break;
6612         case NL80211_CMD_DEL_PMKSA:
6613                 rdev_ops = rdev->ops->del_pmksa;
6614                 break;
6615         default:
6616                 WARN_ON(1);
6617                 break;
6618         }
6619
6620         if (!rdev_ops)
6621                 return -EOPNOTSUPP;
6622
6623         return rdev_ops(&rdev->wiphy, dev, &pmksa);
6624 }
6625
6626 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
6627 {
6628         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6629         struct net_device *dev = info->user_ptr[1];
6630
6631         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6632             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6633                 return -EOPNOTSUPP;
6634
6635         if (!rdev->ops->flush_pmksa)
6636                 return -EOPNOTSUPP;
6637
6638         return rdev_flush_pmksa(rdev, dev);
6639 }
6640
6641 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
6642 {
6643         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6644         struct net_device *dev = info->user_ptr[1];
6645         u8 action_code, dialog_token;
6646         u16 status_code;
6647         u8 *peer;
6648
6649         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
6650             !rdev->ops->tdls_mgmt)
6651                 return -EOPNOTSUPP;
6652
6653         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
6654             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
6655             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
6656             !info->attrs[NL80211_ATTR_IE] ||
6657             !info->attrs[NL80211_ATTR_MAC])
6658                 return -EINVAL;
6659
6660         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
6661         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
6662         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
6663         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
6664
6665         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
6666                               dialog_token, status_code,
6667                               nla_data(info->attrs[NL80211_ATTR_IE]),
6668                               nla_len(info->attrs[NL80211_ATTR_IE]));
6669 }
6670
6671 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
6672 {
6673         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6674         struct net_device *dev = info->user_ptr[1];
6675         enum nl80211_tdls_operation operation;
6676         u8 *peer;
6677
6678         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
6679             !rdev->ops->tdls_oper)
6680                 return -EOPNOTSUPP;
6681
6682         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
6683             !info->attrs[NL80211_ATTR_MAC])
6684                 return -EINVAL;
6685
6686         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
6687         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
6688
6689         return rdev_tdls_oper(rdev, dev, peer, operation);
6690 }
6691
6692 static int nl80211_remain_on_channel(struct sk_buff *skb,
6693                                      struct genl_info *info)
6694 {
6695         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6696         struct wireless_dev *wdev = info->user_ptr[1];
6697         struct cfg80211_chan_def chandef;
6698         struct sk_buff *msg;
6699         void *hdr;
6700         u64 cookie;
6701         u32 duration;
6702         int err;
6703
6704         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
6705             !info->attrs[NL80211_ATTR_DURATION])
6706                 return -EINVAL;
6707
6708         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
6709
6710         if (!rdev->ops->remain_on_channel ||
6711             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
6712                 return -EOPNOTSUPP;
6713
6714         /*
6715          * We should be on that channel for at least a minimum amount of
6716          * time (10ms) but no longer than the driver supports.
6717          */
6718         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
6719             duration > rdev->wiphy.max_remain_on_channel_duration)
6720                 return -EINVAL;
6721
6722         err = nl80211_parse_chandef(rdev, info, &chandef);
6723         if (err)
6724                 return err;
6725
6726         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6727         if (!msg)
6728                 return -ENOMEM;
6729
6730         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6731                              NL80211_CMD_REMAIN_ON_CHANNEL);
6732
6733         if (IS_ERR(hdr)) {
6734                 err = PTR_ERR(hdr);
6735                 goto free_msg;
6736         }
6737
6738         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
6739                                      duration, &cookie);
6740
6741         if (err)
6742                 goto free_msg;
6743
6744         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6745                 goto nla_put_failure;
6746
6747         genlmsg_end(msg, hdr);
6748
6749         return genlmsg_reply(msg, info);
6750
6751  nla_put_failure:
6752         err = -ENOBUFS;
6753  free_msg:
6754         nlmsg_free(msg);
6755         return err;
6756 }
6757
6758 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
6759                                             struct genl_info *info)
6760 {
6761         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6762         struct wireless_dev *wdev = info->user_ptr[1];
6763         u64 cookie;
6764
6765         if (!info->attrs[NL80211_ATTR_COOKIE])
6766                 return -EINVAL;
6767
6768         if (!rdev->ops->cancel_remain_on_channel)
6769                 return -EOPNOTSUPP;
6770
6771         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
6772
6773         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
6774 }
6775
6776 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
6777                            u8 *rates, u8 rates_len)
6778 {
6779         u8 i;
6780         u32 mask = 0;
6781
6782         for (i = 0; i < rates_len; i++) {
6783                 int rate = (rates[i] & 0x7f) * 5;
6784                 int ridx;
6785                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
6786                         struct ieee80211_rate *srate =
6787                                 &sband->bitrates[ridx];
6788                         if (rate == srate->bitrate) {
6789                                 mask |= 1 << ridx;
6790                                 break;
6791                         }
6792                 }
6793                 if (ridx == sband->n_bitrates)
6794                         return 0; /* rate not found */
6795         }
6796
6797         return mask;
6798 }
6799
6800 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
6801                                u8 *rates, u8 rates_len,
6802                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
6803 {
6804         u8 i;
6805
6806         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
6807
6808         for (i = 0; i < rates_len; i++) {
6809                 int ridx, rbit;
6810
6811                 ridx = rates[i] / 8;
6812                 rbit = BIT(rates[i] % 8);
6813
6814                 /* check validity */
6815                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
6816                         return false;
6817
6818                 /* check availability */
6819                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
6820                         mcs[ridx] |= rbit;
6821                 else
6822                         return false;
6823         }
6824
6825         return true;
6826 }
6827
6828 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
6829         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
6830                                     .len = NL80211_MAX_SUPP_RATES },
6831         [NL80211_TXRATE_MCS] = { .type = NLA_BINARY,
6832                                  .len = NL80211_MAX_SUPP_HT_RATES },
6833 };
6834
6835 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
6836                                        struct genl_info *info)
6837 {
6838         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
6839         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6840         struct cfg80211_bitrate_mask mask;
6841         int rem, i;
6842         struct net_device *dev = info->user_ptr[1];
6843         struct nlattr *tx_rates;
6844         struct ieee80211_supported_band *sband;
6845
6846         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
6847                 return -EINVAL;
6848
6849         if (!rdev->ops->set_bitrate_mask)
6850                 return -EOPNOTSUPP;
6851
6852         memset(&mask, 0, sizeof(mask));
6853         /* Default to all rates enabled */
6854         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
6855                 sband = rdev->wiphy.bands[i];
6856                 mask.control[i].legacy =
6857                         sband ? (1 << sband->n_bitrates) - 1 : 0;
6858                 if (sband)
6859                         memcpy(mask.control[i].mcs,
6860                                sband->ht_cap.mcs.rx_mask,
6861                                sizeof(mask.control[i].mcs));
6862                 else
6863                         memset(mask.control[i].mcs, 0,
6864                                sizeof(mask.control[i].mcs));
6865         }
6866
6867         /*
6868          * The nested attribute uses enum nl80211_band as the index. This maps
6869          * directly to the enum ieee80211_band values used in cfg80211.
6870          */
6871         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
6872         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
6873         {
6874                 enum ieee80211_band band = nla_type(tx_rates);
6875                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
6876                         return -EINVAL;
6877                 sband = rdev->wiphy.bands[band];
6878                 if (sband == NULL)
6879                         return -EINVAL;
6880                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
6881                           nla_len(tx_rates), nl80211_txattr_policy);
6882                 if (tb[NL80211_TXRATE_LEGACY]) {
6883                         mask.control[band].legacy = rateset_to_mask(
6884                                 sband,
6885                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
6886                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
6887                         if ((mask.control[band].legacy == 0) &&
6888                             nla_len(tb[NL80211_TXRATE_LEGACY]))
6889                                 return -EINVAL;
6890                 }
6891                 if (tb[NL80211_TXRATE_MCS]) {
6892                         if (!ht_rateset_to_mask(
6893                                         sband,
6894                                         nla_data(tb[NL80211_TXRATE_MCS]),
6895                                         nla_len(tb[NL80211_TXRATE_MCS]),
6896                                         mask.control[band].mcs))
6897                                 return -EINVAL;
6898                 }
6899
6900                 if (mask.control[band].legacy == 0) {
6901                         /* don't allow empty legacy rates if HT
6902                          * is not even supported. */
6903                         if (!rdev->wiphy.bands[band]->ht_cap.ht_supported)
6904                                 return -EINVAL;
6905
6906                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
6907                                 if (mask.control[band].mcs[i])
6908                                         break;
6909
6910                         /* legacy and mcs rates may not be both empty */
6911                         if (i == IEEE80211_HT_MCS_MASK_LEN)
6912                                 return -EINVAL;
6913                 }
6914         }
6915
6916         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
6917 }
6918
6919 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
6920 {
6921         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6922         struct wireless_dev *wdev = info->user_ptr[1];
6923         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
6924
6925         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
6926                 return -EINVAL;
6927
6928         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
6929                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
6930
6931         switch (wdev->iftype) {
6932         case NL80211_IFTYPE_STATION:
6933         case NL80211_IFTYPE_ADHOC:
6934         case NL80211_IFTYPE_P2P_CLIENT:
6935         case NL80211_IFTYPE_AP:
6936         case NL80211_IFTYPE_AP_VLAN:
6937         case NL80211_IFTYPE_MESH_POINT:
6938         case NL80211_IFTYPE_P2P_GO:
6939         case NL80211_IFTYPE_P2P_DEVICE:
6940                 break;
6941         default:
6942                 return -EOPNOTSUPP;
6943         }
6944
6945         /* not much point in registering if we can't reply */
6946         if (!rdev->ops->mgmt_tx)
6947                 return -EOPNOTSUPP;
6948
6949         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
6950                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
6951                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
6952 }
6953
6954 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
6955 {
6956         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6957         struct wireless_dev *wdev = info->user_ptr[1];
6958         struct cfg80211_chan_def chandef;
6959         int err;
6960         void *hdr = NULL;
6961         u64 cookie;
6962         struct sk_buff *msg = NULL;
6963         unsigned int wait = 0;
6964         bool offchan, no_cck, dont_wait_for_ack;
6965
6966         dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
6967
6968         if (!info->attrs[NL80211_ATTR_FRAME])
6969                 return -EINVAL;
6970
6971         if (!rdev->ops->mgmt_tx)
6972                 return -EOPNOTSUPP;
6973
6974         switch (wdev->iftype) {
6975         case NL80211_IFTYPE_STATION:
6976         case NL80211_IFTYPE_ADHOC:
6977         case NL80211_IFTYPE_P2P_CLIENT:
6978         case NL80211_IFTYPE_AP:
6979         case NL80211_IFTYPE_AP_VLAN:
6980         case NL80211_IFTYPE_MESH_POINT:
6981         case NL80211_IFTYPE_P2P_GO:
6982         case NL80211_IFTYPE_P2P_DEVICE:
6983                 break;
6984         default:
6985                 return -EOPNOTSUPP;
6986         }
6987
6988         if (info->attrs[NL80211_ATTR_DURATION]) {
6989                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
6990                         return -EINVAL;
6991                 wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
6992
6993                 /*
6994                  * We should wait on the channel for at least a minimum amount
6995                  * of time (10ms) but no longer than the driver supports.
6996                  */
6997                 if (wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
6998                     wait > rdev->wiphy.max_remain_on_channel_duration)
6999                         return -EINVAL;
7000
7001         }
7002
7003         offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
7004
7005         if (offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7006                 return -EINVAL;
7007
7008         no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7009
7010         err = nl80211_parse_chandef(rdev, info, &chandef);
7011         if (err)
7012                 return err;
7013
7014         if (!dont_wait_for_ack) {
7015                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7016                 if (!msg)
7017                         return -ENOMEM;
7018
7019                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7020                                      NL80211_CMD_FRAME);
7021
7022                 if (IS_ERR(hdr)) {
7023                         err = PTR_ERR(hdr);
7024                         goto free_msg;
7025                 }
7026         }
7027
7028         err = cfg80211_mlme_mgmt_tx(rdev, wdev, chandef.chan, offchan, wait,
7029                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
7030                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
7031                                     no_cck, dont_wait_for_ack, &cookie);
7032         if (err)
7033                 goto free_msg;
7034
7035         if (msg) {
7036                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7037                         goto nla_put_failure;
7038
7039                 genlmsg_end(msg, hdr);
7040                 return genlmsg_reply(msg, info);
7041         }
7042
7043         return 0;
7044
7045  nla_put_failure:
7046         err = -ENOBUFS;
7047  free_msg:
7048         nlmsg_free(msg);
7049         return err;
7050 }
7051
7052 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
7053 {
7054         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7055         struct wireless_dev *wdev = info->user_ptr[1];
7056         u64 cookie;
7057
7058         if (!info->attrs[NL80211_ATTR_COOKIE])
7059                 return -EINVAL;
7060
7061         if (!rdev->ops->mgmt_tx_cancel_wait)
7062                 return -EOPNOTSUPP;
7063
7064         switch (wdev->iftype) {
7065         case NL80211_IFTYPE_STATION:
7066         case NL80211_IFTYPE_ADHOC:
7067         case NL80211_IFTYPE_P2P_CLIENT:
7068         case NL80211_IFTYPE_AP:
7069         case NL80211_IFTYPE_AP_VLAN:
7070         case NL80211_IFTYPE_P2P_GO:
7071         case NL80211_IFTYPE_P2P_DEVICE:
7072                 break;
7073         default:
7074                 return -EOPNOTSUPP;
7075         }
7076
7077         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7078
7079         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
7080 }
7081
7082 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
7083 {
7084         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7085         struct wireless_dev *wdev;
7086         struct net_device *dev = info->user_ptr[1];
7087         u8 ps_state;
7088         bool state;
7089         int err;
7090
7091         if (!info->attrs[NL80211_ATTR_PS_STATE])
7092                 return -EINVAL;
7093
7094         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
7095
7096         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
7097                 return -EINVAL;
7098
7099         wdev = dev->ieee80211_ptr;
7100
7101         if (!rdev->ops->set_power_mgmt)
7102                 return -EOPNOTSUPP;
7103
7104         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
7105
7106         if (state == wdev->ps)
7107                 return 0;
7108
7109         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
7110         if (!err)
7111                 wdev->ps = state;
7112         return err;
7113 }
7114
7115 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
7116 {
7117         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7118         enum nl80211_ps_state ps_state;
7119         struct wireless_dev *wdev;
7120         struct net_device *dev = info->user_ptr[1];
7121         struct sk_buff *msg;
7122         void *hdr;
7123         int err;
7124
7125         wdev = dev->ieee80211_ptr;
7126
7127         if (!rdev->ops->set_power_mgmt)
7128                 return -EOPNOTSUPP;
7129
7130         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7131         if (!msg)
7132                 return -ENOMEM;
7133
7134         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7135                              NL80211_CMD_GET_POWER_SAVE);
7136         if (!hdr) {
7137                 err = -ENOBUFS;
7138                 goto free_msg;
7139         }
7140
7141         if (wdev->ps)
7142                 ps_state = NL80211_PS_ENABLED;
7143         else
7144                 ps_state = NL80211_PS_DISABLED;
7145
7146         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
7147                 goto nla_put_failure;
7148
7149         genlmsg_end(msg, hdr);
7150         return genlmsg_reply(msg, info);
7151
7152  nla_put_failure:
7153         err = -ENOBUFS;
7154  free_msg:
7155         nlmsg_free(msg);
7156         return err;
7157 }
7158
7159 static struct nla_policy
7160 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
7161         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
7162         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
7163         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
7164         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
7165         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
7166         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
7167 };
7168
7169 static int nl80211_set_cqm_txe(struct genl_info *info,
7170                                u32 rate, u32 pkts, u32 intvl)
7171 {
7172         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7173         struct wireless_dev *wdev;
7174         struct net_device *dev = info->user_ptr[1];
7175
7176         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
7177                 return -EINVAL;
7178
7179         wdev = dev->ieee80211_ptr;
7180
7181         if (!rdev->ops->set_cqm_txe_config)
7182                 return -EOPNOTSUPP;
7183
7184         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7185             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7186                 return -EOPNOTSUPP;
7187
7188         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
7189 }
7190
7191 static int nl80211_set_cqm_rssi(struct genl_info *info,
7192                                 s32 threshold, u32 hysteresis)
7193 {
7194         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7195         struct wireless_dev *wdev;
7196         struct net_device *dev = info->user_ptr[1];
7197
7198         if (threshold > 0)
7199                 return -EINVAL;
7200
7201         wdev = dev->ieee80211_ptr;
7202
7203         if (!rdev->ops->set_cqm_rssi_config)
7204                 return -EOPNOTSUPP;
7205
7206         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7207             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7208                 return -EOPNOTSUPP;
7209
7210         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
7211 }
7212
7213 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
7214 {
7215         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
7216         struct nlattr *cqm;
7217         int err;
7218
7219         cqm = info->attrs[NL80211_ATTR_CQM];
7220         if (!cqm) {
7221                 err = -EINVAL;
7222                 goto out;
7223         }
7224
7225         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
7226                                nl80211_attr_cqm_policy);
7227         if (err)
7228                 goto out;
7229
7230         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
7231             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
7232                 s32 threshold;
7233                 u32 hysteresis;
7234                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
7235                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
7236                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
7237         } else if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
7238                    attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
7239                    attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
7240                 u32 rate, pkts, intvl;
7241                 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
7242                 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
7243                 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
7244                 err = nl80211_set_cqm_txe(info, rate, pkts, intvl);
7245         } else
7246                 err = -EINVAL;
7247
7248 out:
7249         return err;
7250 }
7251
7252 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
7253 {
7254         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7255         struct net_device *dev = info->user_ptr[1];
7256         struct mesh_config cfg;
7257         struct mesh_setup setup;
7258         int err;
7259
7260         /* start with default */
7261         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
7262         memcpy(&setup, &default_mesh_setup, sizeof(setup));
7263
7264         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
7265                 /* and parse parameters if given */
7266                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
7267                 if (err)
7268                         return err;
7269         }
7270
7271         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
7272             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
7273                 return -EINVAL;
7274
7275         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
7276         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
7277
7278         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
7279             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
7280                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
7281                         return -EINVAL;
7282
7283         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
7284                 setup.beacon_interval =
7285                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
7286                 if (setup.beacon_interval < 10 ||
7287                     setup.beacon_interval > 10000)
7288                         return -EINVAL;
7289         }
7290
7291         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
7292                 setup.dtim_period =
7293                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
7294                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
7295                         return -EINVAL;
7296         }
7297
7298         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
7299                 /* parse additional setup parameters if given */
7300                 err = nl80211_parse_mesh_setup(info, &setup);
7301                 if (err)
7302                         return err;
7303         }
7304
7305         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7306                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
7307                 if (err)
7308                         return err;
7309         } else {
7310                 /* cfg80211_join_mesh() will sort it out */
7311                 setup.chandef.chan = NULL;
7312         }
7313
7314         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
7315 }
7316
7317 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
7318 {
7319         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7320         struct net_device *dev = info->user_ptr[1];
7321
7322         return cfg80211_leave_mesh(rdev, dev);
7323 }
7324
7325 #ifdef CONFIG_PM
7326 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
7327                                         struct cfg80211_registered_device *rdev)
7328 {
7329         struct nlattr *nl_pats, *nl_pat;
7330         int i, pat_len;
7331
7332         if (!rdev->wowlan->n_patterns)
7333                 return 0;
7334
7335         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
7336         if (!nl_pats)
7337                 return -ENOBUFS;
7338
7339         for (i = 0; i < rdev->wowlan->n_patterns; i++) {
7340                 nl_pat = nla_nest_start(msg, i + 1);
7341                 if (!nl_pat)
7342                         return -ENOBUFS;
7343                 pat_len = rdev->wowlan->patterns[i].pattern_len;
7344                 if (nla_put(msg, NL80211_WOWLAN_PKTPAT_MASK,
7345                             DIV_ROUND_UP(pat_len, 8),
7346                             rdev->wowlan->patterns[i].mask) ||
7347                     nla_put(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
7348                             pat_len, rdev->wowlan->patterns[i].pattern) ||
7349                     nla_put_u32(msg, NL80211_WOWLAN_PKTPAT_OFFSET,
7350                                 rdev->wowlan->patterns[i].pkt_offset))
7351                         return -ENOBUFS;
7352                 nla_nest_end(msg, nl_pat);
7353         }
7354         nla_nest_end(msg, nl_pats);
7355
7356         return 0;
7357 }
7358
7359 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
7360                                    struct cfg80211_wowlan_tcp *tcp)
7361 {
7362         struct nlattr *nl_tcp;
7363
7364         if (!tcp)
7365                 return 0;
7366
7367         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
7368         if (!nl_tcp)
7369                 return -ENOBUFS;
7370
7371         if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
7372             nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
7373             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
7374             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
7375             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
7376             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
7377                     tcp->payload_len, tcp->payload) ||
7378             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
7379                         tcp->data_interval) ||
7380             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
7381                     tcp->wake_len, tcp->wake_data) ||
7382             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
7383                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
7384                 return -ENOBUFS;
7385
7386         if (tcp->payload_seq.len &&
7387             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
7388                     sizeof(tcp->payload_seq), &tcp->payload_seq))
7389                 return -ENOBUFS;
7390
7391         if (tcp->payload_tok.len &&
7392             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
7393                     sizeof(tcp->payload_tok) + tcp->tokens_size,
7394                     &tcp->payload_tok))
7395                 return -ENOBUFS;
7396
7397         return 0;
7398 }
7399
7400 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
7401 {
7402         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7403         struct sk_buff *msg;
7404         void *hdr;
7405         u32 size = NLMSG_DEFAULT_SIZE;
7406
7407         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns &&
7408             !rdev->wiphy.wowlan.tcp)
7409                 return -EOPNOTSUPP;
7410
7411         if (rdev->wowlan && rdev->wowlan->tcp) {
7412                 /* adjust size to have room for all the data */
7413                 size += rdev->wowlan->tcp->tokens_size +
7414                         rdev->wowlan->tcp->payload_len +
7415                         rdev->wowlan->tcp->wake_len +
7416                         rdev->wowlan->tcp->wake_len / 8;
7417         }
7418
7419         msg = nlmsg_new(size, GFP_KERNEL);
7420         if (!msg)
7421                 return -ENOMEM;
7422
7423         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7424                              NL80211_CMD_GET_WOWLAN);
7425         if (!hdr)
7426                 goto nla_put_failure;
7427
7428         if (rdev->wowlan) {
7429                 struct nlattr *nl_wowlan;
7430
7431                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
7432                 if (!nl_wowlan)
7433                         goto nla_put_failure;
7434
7435                 if ((rdev->wowlan->any &&
7436                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
7437                     (rdev->wowlan->disconnect &&
7438                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
7439                     (rdev->wowlan->magic_pkt &&
7440                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
7441                     (rdev->wowlan->gtk_rekey_failure &&
7442                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
7443                     (rdev->wowlan->eap_identity_req &&
7444                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
7445                     (rdev->wowlan->four_way_handshake &&
7446                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
7447                     (rdev->wowlan->rfkill_release &&
7448                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
7449                         goto nla_put_failure;
7450
7451                 if (nl80211_send_wowlan_patterns(msg, rdev))
7452                         goto nla_put_failure;
7453
7454                 if (nl80211_send_wowlan_tcp(msg, rdev->wowlan->tcp))
7455                         goto nla_put_failure;
7456
7457                 nla_nest_end(msg, nl_wowlan);
7458         }
7459
7460         genlmsg_end(msg, hdr);
7461         return genlmsg_reply(msg, info);
7462
7463 nla_put_failure:
7464         nlmsg_free(msg);
7465         return -ENOBUFS;
7466 }
7467
7468 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
7469                                     struct nlattr *attr,
7470                                     struct cfg80211_wowlan *trig)
7471 {
7472         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
7473         struct cfg80211_wowlan_tcp *cfg;
7474         struct nl80211_wowlan_tcp_data_token *tok = NULL;
7475         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
7476         u32 size;
7477         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
7478         int err, port;
7479
7480         if (!rdev->wiphy.wowlan.tcp)
7481                 return -EINVAL;
7482
7483         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
7484                         nla_data(attr), nla_len(attr),
7485                         nl80211_wowlan_tcp_policy);
7486         if (err)
7487                 return err;
7488
7489         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
7490             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
7491             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
7492             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
7493             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
7494             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
7495             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
7496             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
7497                 return -EINVAL;
7498
7499         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
7500         if (data_size > rdev->wiphy.wowlan.tcp->data_payload_max)
7501                 return -EINVAL;
7502
7503         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
7504                         rdev->wiphy.wowlan.tcp->data_interval_max)
7505                 return -EINVAL;
7506
7507         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
7508         if (wake_size > rdev->wiphy.wowlan.tcp->wake_payload_max)
7509                 return -EINVAL;
7510
7511         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
7512         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
7513                 return -EINVAL;
7514
7515         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
7516                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
7517
7518                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
7519                 tokens_size = tokln - sizeof(*tok);
7520
7521                 if (!tok->len || tokens_size % tok->len)
7522                         return -EINVAL;
7523                 if (!rdev->wiphy.wowlan.tcp->tok)
7524                         return -EINVAL;
7525                 if (tok->len > rdev->wiphy.wowlan.tcp->tok->max_len)
7526                         return -EINVAL;
7527                 if (tok->len < rdev->wiphy.wowlan.tcp->tok->min_len)
7528                         return -EINVAL;
7529                 if (tokens_size > rdev->wiphy.wowlan.tcp->tok->bufsize)
7530                         return -EINVAL;
7531                 if (tok->offset + tok->len > data_size)
7532                         return -EINVAL;
7533         }
7534
7535         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
7536                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
7537                 if (!rdev->wiphy.wowlan.tcp->seq)
7538                         return -EINVAL;
7539                 if (seq->len == 0 || seq->len > 4)
7540                         return -EINVAL;
7541                 if (seq->len + seq->offset > data_size)
7542                         return -EINVAL;
7543         }
7544
7545         size = sizeof(*cfg);
7546         size += data_size;
7547         size += wake_size + wake_mask_size;
7548         size += tokens_size;
7549
7550         cfg = kzalloc(size, GFP_KERNEL);
7551         if (!cfg)
7552                 return -ENOMEM;
7553         cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
7554         cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
7555         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
7556                ETH_ALEN);
7557         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
7558                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
7559         else
7560                 port = 0;
7561 #ifdef CONFIG_INET
7562         /* allocate a socket and port for it and use it */
7563         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
7564                             IPPROTO_TCP, &cfg->sock, 1);
7565         if (err) {
7566                 kfree(cfg);
7567                 return err;
7568         }
7569         if (inet_csk_get_port(cfg->sock->sk, port)) {
7570                 sock_release(cfg->sock);
7571                 kfree(cfg);
7572                 return -EADDRINUSE;
7573         }
7574         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
7575 #else
7576         if (!port) {
7577                 kfree(cfg);
7578                 return -EINVAL;
7579         }
7580         cfg->src_port = port;
7581 #endif
7582
7583         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
7584         cfg->payload_len = data_size;
7585         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
7586         memcpy((void *)cfg->payload,
7587                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
7588                data_size);
7589         if (seq)
7590                 cfg->payload_seq = *seq;
7591         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
7592         cfg->wake_len = wake_size;
7593         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
7594         memcpy((void *)cfg->wake_data,
7595                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
7596                wake_size);
7597         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
7598                          data_size + wake_size;
7599         memcpy((void *)cfg->wake_mask,
7600                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
7601                wake_mask_size);
7602         if (tok) {
7603                 cfg->tokens_size = tokens_size;
7604                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
7605         }
7606
7607         trig->tcp = cfg;
7608
7609         return 0;
7610 }
7611
7612 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
7613 {
7614         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7615         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
7616         struct cfg80211_wowlan new_triggers = {};
7617         struct cfg80211_wowlan *ntrig;
7618         struct wiphy_wowlan_support *wowlan = &rdev->wiphy.wowlan;
7619         int err, i;
7620         bool prev_enabled = rdev->wowlan;
7621
7622         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns &&
7623             !rdev->wiphy.wowlan.tcp)
7624                 return -EOPNOTSUPP;
7625
7626         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
7627                 cfg80211_rdev_free_wowlan(rdev);
7628                 rdev->wowlan = NULL;
7629                 goto set_wakeup;
7630         }
7631
7632         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
7633                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
7634                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
7635                         nl80211_wowlan_policy);
7636         if (err)
7637                 return err;
7638
7639         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
7640                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
7641                         return -EINVAL;
7642                 new_triggers.any = true;
7643         }
7644
7645         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
7646                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
7647                         return -EINVAL;
7648                 new_triggers.disconnect = true;
7649         }
7650
7651         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
7652                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
7653                         return -EINVAL;
7654                 new_triggers.magic_pkt = true;
7655         }
7656
7657         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
7658                 return -EINVAL;
7659
7660         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
7661                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
7662                         return -EINVAL;
7663                 new_triggers.gtk_rekey_failure = true;
7664         }
7665
7666         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
7667                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
7668                         return -EINVAL;
7669                 new_triggers.eap_identity_req = true;
7670         }
7671
7672         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
7673                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
7674                         return -EINVAL;
7675                 new_triggers.four_way_handshake = true;
7676         }
7677
7678         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
7679                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
7680                         return -EINVAL;
7681                 new_triggers.rfkill_release = true;
7682         }
7683
7684         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
7685                 struct nlattr *pat;
7686                 int n_patterns = 0;
7687                 int rem, pat_len, mask_len, pkt_offset;
7688                 struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
7689
7690                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
7691                                     rem)
7692                         n_patterns++;
7693                 if (n_patterns > wowlan->n_patterns)
7694                         return -EINVAL;
7695
7696                 new_triggers.patterns = kcalloc(n_patterns,
7697                                                 sizeof(new_triggers.patterns[0]),
7698                                                 GFP_KERNEL);
7699                 if (!new_triggers.patterns)
7700                         return -ENOMEM;
7701
7702                 new_triggers.n_patterns = n_patterns;
7703                 i = 0;
7704
7705                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
7706                                     rem) {
7707                         nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
7708                                   nla_data(pat), nla_len(pat), NULL);
7709                         err = -EINVAL;
7710                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
7711                             !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
7712                                 goto error;
7713                         pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
7714                         mask_len = DIV_ROUND_UP(pat_len, 8);
7715                         if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
7716                             mask_len)
7717                                 goto error;
7718                         if (pat_len > wowlan->pattern_max_len ||
7719                             pat_len < wowlan->pattern_min_len)
7720                                 goto error;
7721
7722                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET])
7723                                 pkt_offset = 0;
7724                         else
7725                                 pkt_offset = nla_get_u32(
7726                                         pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET]);
7727                         if (pkt_offset > wowlan->max_pkt_offset)
7728                                 goto error;
7729                         new_triggers.patterns[i].pkt_offset = pkt_offset;
7730
7731                         new_triggers.patterns[i].mask =
7732                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
7733                         if (!new_triggers.patterns[i].mask) {
7734                                 err = -ENOMEM;
7735                                 goto error;
7736                         }
7737                         new_triggers.patterns[i].pattern =
7738                                 new_triggers.patterns[i].mask + mask_len;
7739                         memcpy(new_triggers.patterns[i].mask,
7740                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
7741                                mask_len);
7742                         new_triggers.patterns[i].pattern_len = pat_len;
7743                         memcpy(new_triggers.patterns[i].pattern,
7744                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
7745                                pat_len);
7746                         i++;
7747                 }
7748         }
7749
7750         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
7751                 err = nl80211_parse_wowlan_tcp(
7752                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
7753                         &new_triggers);
7754                 if (err)
7755                         goto error;
7756         }
7757
7758         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
7759         if (!ntrig) {
7760                 err = -ENOMEM;
7761                 goto error;
7762         }
7763         cfg80211_rdev_free_wowlan(rdev);
7764         rdev->wowlan = ntrig;
7765
7766  set_wakeup:
7767         if (rdev->ops->set_wakeup && prev_enabled != !!rdev->wowlan)
7768                 rdev_set_wakeup(rdev, rdev->wowlan);
7769
7770         return 0;
7771  error:
7772         for (i = 0; i < new_triggers.n_patterns; i++)
7773                 kfree(new_triggers.patterns[i].mask);
7774         kfree(new_triggers.patterns);
7775         if (new_triggers.tcp && new_triggers.tcp->sock)
7776                 sock_release(new_triggers.tcp->sock);
7777         kfree(new_triggers.tcp);
7778         return err;
7779 }
7780 #endif
7781
7782 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
7783 {
7784         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7785         struct net_device *dev = info->user_ptr[1];
7786         struct wireless_dev *wdev = dev->ieee80211_ptr;
7787         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
7788         struct cfg80211_gtk_rekey_data rekey_data;
7789         int err;
7790
7791         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
7792                 return -EINVAL;
7793
7794         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
7795                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
7796                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
7797                         nl80211_rekey_policy);
7798         if (err)
7799                 return err;
7800
7801         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
7802                 return -ERANGE;
7803         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
7804                 return -ERANGE;
7805         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
7806                 return -ERANGE;
7807
7808         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
7809                NL80211_KEK_LEN);
7810         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
7811                NL80211_KCK_LEN);
7812         memcpy(rekey_data.replay_ctr,
7813                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
7814                NL80211_REPLAY_CTR_LEN);
7815
7816         wdev_lock(wdev);
7817         if (!wdev->current_bss) {
7818                 err = -ENOTCONN;
7819                 goto out;
7820         }
7821
7822         if (!rdev->ops->set_rekey_data) {
7823                 err = -EOPNOTSUPP;
7824                 goto out;
7825         }
7826
7827         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
7828  out:
7829         wdev_unlock(wdev);
7830         return err;
7831 }
7832
7833 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
7834                                              struct genl_info *info)
7835 {
7836         struct net_device *dev = info->user_ptr[1];
7837         struct wireless_dev *wdev = dev->ieee80211_ptr;
7838
7839         if (wdev->iftype != NL80211_IFTYPE_AP &&
7840             wdev->iftype != NL80211_IFTYPE_P2P_GO)
7841                 return -EINVAL;
7842
7843         if (wdev->ap_unexpected_nlportid)
7844                 return -EBUSY;
7845
7846         wdev->ap_unexpected_nlportid = info->snd_portid;
7847         return 0;
7848 }
7849
7850 static int nl80211_probe_client(struct sk_buff *skb,
7851                                 struct genl_info *info)
7852 {
7853         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7854         struct net_device *dev = info->user_ptr[1];
7855         struct wireless_dev *wdev = dev->ieee80211_ptr;
7856         struct sk_buff *msg;
7857         void *hdr;
7858         const u8 *addr;
7859         u64 cookie;
7860         int err;
7861
7862         if (wdev->iftype != NL80211_IFTYPE_AP &&
7863             wdev->iftype != NL80211_IFTYPE_P2P_GO)
7864                 return -EOPNOTSUPP;
7865
7866         if (!info->attrs[NL80211_ATTR_MAC])
7867                 return -EINVAL;
7868
7869         if (!rdev->ops->probe_client)
7870                 return -EOPNOTSUPP;
7871
7872         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7873         if (!msg)
7874                 return -ENOMEM;
7875
7876         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7877                              NL80211_CMD_PROBE_CLIENT);
7878
7879         if (IS_ERR(hdr)) {
7880                 err = PTR_ERR(hdr);
7881                 goto free_msg;
7882         }
7883
7884         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7885
7886         err = rdev_probe_client(rdev, dev, addr, &cookie);
7887         if (err)
7888                 goto free_msg;
7889
7890         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7891                 goto nla_put_failure;
7892
7893         genlmsg_end(msg, hdr);
7894
7895         return genlmsg_reply(msg, info);
7896
7897  nla_put_failure:
7898         err = -ENOBUFS;
7899  free_msg:
7900         nlmsg_free(msg);
7901         return err;
7902 }
7903
7904 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
7905 {
7906         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7907         struct cfg80211_beacon_registration *reg, *nreg;
7908         int rv;
7909
7910         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
7911                 return -EOPNOTSUPP;
7912
7913         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
7914         if (!nreg)
7915                 return -ENOMEM;
7916
7917         /* First, check if already registered. */
7918         spin_lock_bh(&rdev->beacon_registrations_lock);
7919         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
7920                 if (reg->nlportid == info->snd_portid) {
7921                         rv = -EALREADY;
7922                         goto out_err;
7923                 }
7924         }
7925         /* Add it to the list */
7926         nreg->nlportid = info->snd_portid;
7927         list_add(&nreg->list, &rdev->beacon_registrations);
7928
7929         spin_unlock_bh(&rdev->beacon_registrations_lock);
7930
7931         return 0;
7932 out_err:
7933         spin_unlock_bh(&rdev->beacon_registrations_lock);
7934         kfree(nreg);
7935         return rv;
7936 }
7937
7938 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
7939 {
7940         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7941         struct wireless_dev *wdev = info->user_ptr[1];
7942         int err;
7943
7944         if (!rdev->ops->start_p2p_device)
7945                 return -EOPNOTSUPP;
7946
7947         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
7948                 return -EOPNOTSUPP;
7949
7950         if (wdev->p2p_started)
7951                 return 0;
7952
7953         mutex_lock(&rdev->devlist_mtx);
7954         err = cfg80211_can_add_interface(rdev, wdev->iftype);
7955         mutex_unlock(&rdev->devlist_mtx);
7956         if (err)
7957                 return err;
7958
7959         err = rdev_start_p2p_device(rdev, wdev);
7960         if (err)
7961                 return err;
7962
7963         wdev->p2p_started = true;
7964         mutex_lock(&rdev->devlist_mtx);
7965         rdev->opencount++;
7966         mutex_unlock(&rdev->devlist_mtx);
7967
7968         return 0;
7969 }
7970
7971 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
7972 {
7973         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7974         struct wireless_dev *wdev = info->user_ptr[1];
7975
7976         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
7977                 return -EOPNOTSUPP;
7978
7979         if (!rdev->ops->stop_p2p_device)
7980                 return -EOPNOTSUPP;
7981
7982         if (!wdev->p2p_started)
7983                 return 0;
7984
7985         rdev_stop_p2p_device(rdev, wdev);
7986         wdev->p2p_started = false;
7987
7988         mutex_lock(&rdev->devlist_mtx);
7989         rdev->opencount--;
7990         mutex_unlock(&rdev->devlist_mtx);
7991
7992         if (WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev)) {
7993                 rdev->scan_req->aborted = true;
7994                 ___cfg80211_scan_done(rdev, true);
7995         }
7996
7997         return 0;
7998 }
7999
8000 static int nl80211_get_protocol_features(struct sk_buff *skb,
8001                                          struct genl_info *info)
8002 {
8003         void *hdr;
8004         struct sk_buff *msg;
8005
8006         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8007         if (!msg)
8008                 return -ENOMEM;
8009
8010         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8011                              NL80211_CMD_GET_PROTOCOL_FEATURES);
8012         if (!hdr)
8013                 goto nla_put_failure;
8014
8015         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
8016                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
8017                 goto nla_put_failure;
8018
8019         genlmsg_end(msg, hdr);
8020         return genlmsg_reply(msg, info);
8021
8022  nla_put_failure:
8023         kfree_skb(msg);
8024         return -ENOBUFS;
8025 }
8026
8027 #define NL80211_FLAG_NEED_WIPHY         0x01
8028 #define NL80211_FLAG_NEED_NETDEV        0x02
8029 #define NL80211_FLAG_NEED_RTNL          0x04
8030 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
8031 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
8032                                          NL80211_FLAG_CHECK_NETDEV_UP)
8033 #define NL80211_FLAG_NEED_WDEV          0x10
8034 /* If a netdev is associated, it must be UP, P2P must be started */
8035 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
8036                                          NL80211_FLAG_CHECK_NETDEV_UP)
8037
8038 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
8039                             struct genl_info *info)
8040 {
8041         struct cfg80211_registered_device *rdev;
8042         struct wireless_dev *wdev;
8043         struct net_device *dev;
8044         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
8045
8046         if (rtnl)
8047                 rtnl_lock();
8048
8049         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
8050                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
8051                 if (IS_ERR(rdev)) {
8052                         if (rtnl)
8053                                 rtnl_unlock();
8054                         return PTR_ERR(rdev);
8055                 }
8056                 info->user_ptr[0] = rdev;
8057         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
8058                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
8059                 mutex_lock(&cfg80211_mutex);
8060                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
8061                                                   info->attrs);
8062                 if (IS_ERR(wdev)) {
8063                         mutex_unlock(&cfg80211_mutex);
8064                         if (rtnl)
8065                                 rtnl_unlock();
8066                         return PTR_ERR(wdev);
8067                 }
8068
8069                 dev = wdev->netdev;
8070                 rdev = wiphy_to_dev(wdev->wiphy);
8071
8072                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
8073                         if (!dev) {
8074                                 mutex_unlock(&cfg80211_mutex);
8075                                 if (rtnl)
8076                                         rtnl_unlock();
8077                                 return -EINVAL;
8078                         }
8079
8080                         info->user_ptr[1] = dev;
8081                 } else {
8082                         info->user_ptr[1] = wdev;
8083                 }
8084
8085                 if (dev) {
8086                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
8087                             !netif_running(dev)) {
8088                                 mutex_unlock(&cfg80211_mutex);
8089                                 if (rtnl)
8090                                         rtnl_unlock();
8091                                 return -ENETDOWN;
8092                         }
8093
8094                         dev_hold(dev);
8095                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
8096                         if (!wdev->p2p_started) {
8097                                 mutex_unlock(&cfg80211_mutex);
8098                                 if (rtnl)
8099                                         rtnl_unlock();
8100                                 return -ENETDOWN;
8101                         }
8102                 }
8103
8104                 cfg80211_lock_rdev(rdev);
8105
8106                 mutex_unlock(&cfg80211_mutex);
8107
8108                 info->user_ptr[0] = rdev;
8109         }
8110
8111         return 0;
8112 }
8113
8114 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
8115                               struct genl_info *info)
8116 {
8117         if (info->user_ptr[0])
8118                 cfg80211_unlock_rdev(info->user_ptr[0]);
8119         if (info->user_ptr[1]) {
8120                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
8121                         struct wireless_dev *wdev = info->user_ptr[1];
8122
8123                         if (wdev->netdev)
8124                                 dev_put(wdev->netdev);
8125                 } else {
8126                         dev_put(info->user_ptr[1]);
8127                 }
8128         }
8129         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
8130                 rtnl_unlock();
8131 }
8132
8133 static struct genl_ops nl80211_ops[] = {
8134         {
8135                 .cmd = NL80211_CMD_GET_WIPHY,
8136                 .doit = nl80211_get_wiphy,
8137                 .dumpit = nl80211_dump_wiphy,
8138                 .policy = nl80211_policy,
8139                 /* can be retrieved by unprivileged users */
8140                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
8141         },
8142         {
8143                 .cmd = NL80211_CMD_SET_WIPHY,
8144                 .doit = nl80211_set_wiphy,
8145                 .policy = nl80211_policy,
8146                 .flags = GENL_ADMIN_PERM,
8147                 .internal_flags = NL80211_FLAG_NEED_RTNL,
8148         },
8149         {
8150                 .cmd = NL80211_CMD_GET_INTERFACE,
8151                 .doit = nl80211_get_interface,
8152                 .dumpit = nl80211_dump_interface,
8153                 .policy = nl80211_policy,
8154                 /* can be retrieved by unprivileged users */
8155                 .internal_flags = NL80211_FLAG_NEED_WDEV,
8156         },
8157         {
8158                 .cmd = NL80211_CMD_SET_INTERFACE,
8159                 .doit = nl80211_set_interface,
8160                 .policy = nl80211_policy,
8161                 .flags = GENL_ADMIN_PERM,
8162                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8163                                   NL80211_FLAG_NEED_RTNL,
8164         },
8165         {
8166                 .cmd = NL80211_CMD_NEW_INTERFACE,
8167                 .doit = nl80211_new_interface,
8168                 .policy = nl80211_policy,
8169                 .flags = GENL_ADMIN_PERM,
8170                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8171                                   NL80211_FLAG_NEED_RTNL,
8172         },
8173         {
8174                 .cmd = NL80211_CMD_DEL_INTERFACE,
8175                 .doit = nl80211_del_interface,
8176                 .policy = nl80211_policy,
8177                 .flags = GENL_ADMIN_PERM,
8178                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8179                                   NL80211_FLAG_NEED_RTNL,
8180         },
8181         {
8182                 .cmd = NL80211_CMD_GET_KEY,
8183                 .doit = nl80211_get_key,
8184                 .policy = nl80211_policy,
8185                 .flags = GENL_ADMIN_PERM,
8186                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8187                                   NL80211_FLAG_NEED_RTNL,
8188         },
8189         {
8190                 .cmd = NL80211_CMD_SET_KEY,
8191                 .doit = nl80211_set_key,
8192                 .policy = nl80211_policy,
8193                 .flags = GENL_ADMIN_PERM,
8194                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8195                                   NL80211_FLAG_NEED_RTNL,
8196         },
8197         {
8198                 .cmd = NL80211_CMD_NEW_KEY,
8199                 .doit = nl80211_new_key,
8200                 .policy = nl80211_policy,
8201                 .flags = GENL_ADMIN_PERM,
8202                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8203                                   NL80211_FLAG_NEED_RTNL,
8204         },
8205         {
8206                 .cmd = NL80211_CMD_DEL_KEY,
8207                 .doit = nl80211_del_key,
8208                 .policy = nl80211_policy,
8209                 .flags = GENL_ADMIN_PERM,
8210                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8211                                   NL80211_FLAG_NEED_RTNL,
8212         },
8213         {
8214                 .cmd = NL80211_CMD_SET_BEACON,
8215                 .policy = nl80211_policy,
8216                 .flags = GENL_ADMIN_PERM,
8217                 .doit = nl80211_set_beacon,
8218                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8219                                   NL80211_FLAG_NEED_RTNL,
8220         },
8221         {
8222                 .cmd = NL80211_CMD_START_AP,
8223                 .policy = nl80211_policy,
8224                 .flags = GENL_ADMIN_PERM,
8225                 .doit = nl80211_start_ap,
8226                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8227                                   NL80211_FLAG_NEED_RTNL,
8228         },
8229         {
8230                 .cmd = NL80211_CMD_STOP_AP,
8231                 .policy = nl80211_policy,
8232                 .flags = GENL_ADMIN_PERM,
8233                 .doit = nl80211_stop_ap,
8234                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8235                                   NL80211_FLAG_NEED_RTNL,
8236         },
8237         {
8238                 .cmd = NL80211_CMD_GET_STATION,
8239                 .doit = nl80211_get_station,
8240                 .dumpit = nl80211_dump_station,
8241                 .policy = nl80211_policy,
8242                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8243                                   NL80211_FLAG_NEED_RTNL,
8244         },
8245         {
8246                 .cmd = NL80211_CMD_SET_STATION,
8247                 .doit = nl80211_set_station,
8248                 .policy = nl80211_policy,
8249                 .flags = GENL_ADMIN_PERM,
8250                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8251                                   NL80211_FLAG_NEED_RTNL,
8252         },
8253         {
8254                 .cmd = NL80211_CMD_NEW_STATION,
8255                 .doit = nl80211_new_station,
8256                 .policy = nl80211_policy,
8257                 .flags = GENL_ADMIN_PERM,
8258                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8259                                   NL80211_FLAG_NEED_RTNL,
8260         },
8261         {
8262                 .cmd = NL80211_CMD_DEL_STATION,
8263                 .doit = nl80211_del_station,
8264                 .policy = nl80211_policy,
8265                 .flags = GENL_ADMIN_PERM,
8266                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8267                                   NL80211_FLAG_NEED_RTNL,
8268         },
8269         {
8270                 .cmd = NL80211_CMD_GET_MPATH,
8271                 .doit = nl80211_get_mpath,
8272                 .dumpit = nl80211_dump_mpath,
8273                 .policy = nl80211_policy,
8274                 .flags = GENL_ADMIN_PERM,
8275                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8276                                   NL80211_FLAG_NEED_RTNL,
8277         },
8278         {
8279                 .cmd = NL80211_CMD_SET_MPATH,
8280                 .doit = nl80211_set_mpath,
8281                 .policy = nl80211_policy,
8282                 .flags = GENL_ADMIN_PERM,
8283                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8284                                   NL80211_FLAG_NEED_RTNL,
8285         },
8286         {
8287                 .cmd = NL80211_CMD_NEW_MPATH,
8288                 .doit = nl80211_new_mpath,
8289                 .policy = nl80211_policy,
8290                 .flags = GENL_ADMIN_PERM,
8291                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8292                                   NL80211_FLAG_NEED_RTNL,
8293         },
8294         {
8295                 .cmd = NL80211_CMD_DEL_MPATH,
8296                 .doit = nl80211_del_mpath,
8297                 .policy = nl80211_policy,
8298                 .flags = GENL_ADMIN_PERM,
8299                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8300                                   NL80211_FLAG_NEED_RTNL,
8301         },
8302         {
8303                 .cmd = NL80211_CMD_SET_BSS,
8304                 .doit = nl80211_set_bss,
8305                 .policy = nl80211_policy,
8306                 .flags = GENL_ADMIN_PERM,
8307                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8308                                   NL80211_FLAG_NEED_RTNL,
8309         },
8310         {
8311                 .cmd = NL80211_CMD_GET_REG,
8312                 .doit = nl80211_get_reg,
8313                 .policy = nl80211_policy,
8314                 /* can be retrieved by unprivileged users */
8315         },
8316         {
8317                 .cmd = NL80211_CMD_SET_REG,
8318                 .doit = nl80211_set_reg,
8319                 .policy = nl80211_policy,
8320                 .flags = GENL_ADMIN_PERM,
8321         },
8322         {
8323                 .cmd = NL80211_CMD_REQ_SET_REG,
8324                 .doit = nl80211_req_set_reg,
8325                 .policy = nl80211_policy,
8326                 .flags = GENL_ADMIN_PERM,
8327         },
8328         {
8329                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
8330                 .doit = nl80211_get_mesh_config,
8331                 .policy = nl80211_policy,
8332                 /* can be retrieved by unprivileged users */
8333                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8334                                   NL80211_FLAG_NEED_RTNL,
8335         },
8336         {
8337                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
8338                 .doit = nl80211_update_mesh_config,
8339                 .policy = nl80211_policy,
8340                 .flags = GENL_ADMIN_PERM,
8341                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8342                                   NL80211_FLAG_NEED_RTNL,
8343         },
8344         {
8345                 .cmd = NL80211_CMD_TRIGGER_SCAN,
8346                 .doit = nl80211_trigger_scan,
8347                 .policy = nl80211_policy,
8348                 .flags = GENL_ADMIN_PERM,
8349                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8350                                   NL80211_FLAG_NEED_RTNL,
8351         },
8352         {
8353                 .cmd = NL80211_CMD_GET_SCAN,
8354                 .policy = nl80211_policy,
8355                 .dumpit = nl80211_dump_scan,
8356         },
8357         {
8358                 .cmd = NL80211_CMD_START_SCHED_SCAN,
8359                 .doit = nl80211_start_sched_scan,
8360                 .policy = nl80211_policy,
8361                 .flags = GENL_ADMIN_PERM,
8362                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8363                                   NL80211_FLAG_NEED_RTNL,
8364         },
8365         {
8366                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
8367                 .doit = nl80211_stop_sched_scan,
8368                 .policy = nl80211_policy,
8369                 .flags = GENL_ADMIN_PERM,
8370                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8371                                   NL80211_FLAG_NEED_RTNL,
8372         },
8373         {
8374                 .cmd = NL80211_CMD_AUTHENTICATE,
8375                 .doit = nl80211_authenticate,
8376                 .policy = nl80211_policy,
8377                 .flags = GENL_ADMIN_PERM,
8378                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8379                                   NL80211_FLAG_NEED_RTNL,
8380         },
8381         {
8382                 .cmd = NL80211_CMD_ASSOCIATE,
8383                 .doit = nl80211_associate,
8384                 .policy = nl80211_policy,
8385                 .flags = GENL_ADMIN_PERM,
8386                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8387                                   NL80211_FLAG_NEED_RTNL,
8388         },
8389         {
8390                 .cmd = NL80211_CMD_DEAUTHENTICATE,
8391                 .doit = nl80211_deauthenticate,
8392                 .policy = nl80211_policy,
8393                 .flags = GENL_ADMIN_PERM,
8394                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8395                                   NL80211_FLAG_NEED_RTNL,
8396         },
8397         {
8398                 .cmd = NL80211_CMD_DISASSOCIATE,
8399                 .doit = nl80211_disassociate,
8400                 .policy = nl80211_policy,
8401                 .flags = GENL_ADMIN_PERM,
8402                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8403                                   NL80211_FLAG_NEED_RTNL,
8404         },
8405         {
8406                 .cmd = NL80211_CMD_JOIN_IBSS,
8407                 .doit = nl80211_join_ibss,
8408                 .policy = nl80211_policy,
8409                 .flags = GENL_ADMIN_PERM,
8410                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8411                                   NL80211_FLAG_NEED_RTNL,
8412         },
8413         {
8414                 .cmd = NL80211_CMD_LEAVE_IBSS,
8415                 .doit = nl80211_leave_ibss,
8416                 .policy = nl80211_policy,
8417                 .flags = GENL_ADMIN_PERM,
8418                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8419                                   NL80211_FLAG_NEED_RTNL,
8420         },
8421 #ifdef CONFIG_NL80211_TESTMODE
8422         {
8423                 .cmd = NL80211_CMD_TESTMODE,
8424                 .doit = nl80211_testmode_do,
8425                 .dumpit = nl80211_testmode_dump,
8426                 .policy = nl80211_policy,
8427                 .flags = GENL_ADMIN_PERM,
8428                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8429                                   NL80211_FLAG_NEED_RTNL,
8430         },
8431 #endif
8432         {
8433                 .cmd = NL80211_CMD_CONNECT,
8434                 .doit = nl80211_connect,
8435                 .policy = nl80211_policy,
8436                 .flags = GENL_ADMIN_PERM,
8437                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8438                                   NL80211_FLAG_NEED_RTNL,
8439         },
8440         {
8441                 .cmd = NL80211_CMD_DISCONNECT,
8442                 .doit = nl80211_disconnect,
8443                 .policy = nl80211_policy,
8444                 .flags = GENL_ADMIN_PERM,
8445                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8446                                   NL80211_FLAG_NEED_RTNL,
8447         },
8448         {
8449                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
8450                 .doit = nl80211_wiphy_netns,
8451                 .policy = nl80211_policy,
8452                 .flags = GENL_ADMIN_PERM,
8453                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8454                                   NL80211_FLAG_NEED_RTNL,
8455         },
8456         {
8457                 .cmd = NL80211_CMD_GET_SURVEY,
8458                 .policy = nl80211_policy,
8459                 .dumpit = nl80211_dump_survey,
8460         },
8461         {
8462                 .cmd = NL80211_CMD_SET_PMKSA,
8463                 .doit = nl80211_setdel_pmksa,
8464                 .policy = nl80211_policy,
8465                 .flags = GENL_ADMIN_PERM,
8466                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8467                                   NL80211_FLAG_NEED_RTNL,
8468         },
8469         {
8470                 .cmd = NL80211_CMD_DEL_PMKSA,
8471                 .doit = nl80211_setdel_pmksa,
8472                 .policy = nl80211_policy,
8473                 .flags = GENL_ADMIN_PERM,
8474                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8475                                   NL80211_FLAG_NEED_RTNL,
8476         },
8477         {
8478                 .cmd = NL80211_CMD_FLUSH_PMKSA,
8479                 .doit = nl80211_flush_pmksa,
8480                 .policy = nl80211_policy,
8481                 .flags = GENL_ADMIN_PERM,
8482                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8483                                   NL80211_FLAG_NEED_RTNL,
8484         },
8485         {
8486                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
8487                 .doit = nl80211_remain_on_channel,
8488                 .policy = nl80211_policy,
8489                 .flags = GENL_ADMIN_PERM,
8490                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8491                                   NL80211_FLAG_NEED_RTNL,
8492         },
8493         {
8494                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
8495                 .doit = nl80211_cancel_remain_on_channel,
8496                 .policy = nl80211_policy,
8497                 .flags = GENL_ADMIN_PERM,
8498                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8499                                   NL80211_FLAG_NEED_RTNL,
8500         },
8501         {
8502                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
8503                 .doit = nl80211_set_tx_bitrate_mask,
8504                 .policy = nl80211_policy,
8505                 .flags = GENL_ADMIN_PERM,
8506                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8507                                   NL80211_FLAG_NEED_RTNL,
8508         },
8509         {
8510                 .cmd = NL80211_CMD_REGISTER_FRAME,
8511                 .doit = nl80211_register_mgmt,
8512                 .policy = nl80211_policy,
8513                 .flags = GENL_ADMIN_PERM,
8514                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8515                                   NL80211_FLAG_NEED_RTNL,
8516         },
8517         {
8518                 .cmd = NL80211_CMD_FRAME,
8519                 .doit = nl80211_tx_mgmt,
8520                 .policy = nl80211_policy,
8521                 .flags = GENL_ADMIN_PERM,
8522                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8523                                   NL80211_FLAG_NEED_RTNL,
8524         },
8525         {
8526                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
8527                 .doit = nl80211_tx_mgmt_cancel_wait,
8528                 .policy = nl80211_policy,
8529                 .flags = GENL_ADMIN_PERM,
8530                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8531                                   NL80211_FLAG_NEED_RTNL,
8532         },
8533         {
8534                 .cmd = NL80211_CMD_SET_POWER_SAVE,
8535                 .doit = nl80211_set_power_save,
8536                 .policy = nl80211_policy,
8537                 .flags = GENL_ADMIN_PERM,
8538                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8539                                   NL80211_FLAG_NEED_RTNL,
8540         },
8541         {
8542                 .cmd = NL80211_CMD_GET_POWER_SAVE,
8543                 .doit = nl80211_get_power_save,
8544                 .policy = nl80211_policy,
8545                 /* can be retrieved by unprivileged users */
8546                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8547                                   NL80211_FLAG_NEED_RTNL,
8548         },
8549         {
8550                 .cmd = NL80211_CMD_SET_CQM,
8551                 .doit = nl80211_set_cqm,
8552                 .policy = nl80211_policy,
8553                 .flags = GENL_ADMIN_PERM,
8554                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8555                                   NL80211_FLAG_NEED_RTNL,
8556         },
8557         {
8558                 .cmd = NL80211_CMD_SET_CHANNEL,
8559                 .doit = nl80211_set_channel,
8560                 .policy = nl80211_policy,
8561                 .flags = GENL_ADMIN_PERM,
8562                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8563                                   NL80211_FLAG_NEED_RTNL,
8564         },
8565         {
8566                 .cmd = NL80211_CMD_SET_WDS_PEER,
8567                 .doit = nl80211_set_wds_peer,
8568                 .policy = nl80211_policy,
8569                 .flags = GENL_ADMIN_PERM,
8570                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8571                                   NL80211_FLAG_NEED_RTNL,
8572         },
8573         {
8574                 .cmd = NL80211_CMD_JOIN_MESH,
8575                 .doit = nl80211_join_mesh,
8576                 .policy = nl80211_policy,
8577                 .flags = GENL_ADMIN_PERM,
8578                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8579                                   NL80211_FLAG_NEED_RTNL,
8580         },
8581         {
8582                 .cmd = NL80211_CMD_LEAVE_MESH,
8583                 .doit = nl80211_leave_mesh,
8584                 .policy = nl80211_policy,
8585                 .flags = GENL_ADMIN_PERM,
8586                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8587                                   NL80211_FLAG_NEED_RTNL,
8588         },
8589 #ifdef CONFIG_PM
8590         {
8591                 .cmd = NL80211_CMD_GET_WOWLAN,
8592                 .doit = nl80211_get_wowlan,
8593                 .policy = nl80211_policy,
8594                 /* can be retrieved by unprivileged users */
8595                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8596                                   NL80211_FLAG_NEED_RTNL,
8597         },
8598         {
8599                 .cmd = NL80211_CMD_SET_WOWLAN,
8600                 .doit = nl80211_set_wowlan,
8601                 .policy = nl80211_policy,
8602                 .flags = GENL_ADMIN_PERM,
8603                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8604                                   NL80211_FLAG_NEED_RTNL,
8605         },
8606 #endif
8607         {
8608                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
8609                 .doit = nl80211_set_rekey_data,
8610                 .policy = nl80211_policy,
8611                 .flags = GENL_ADMIN_PERM,
8612                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8613                                   NL80211_FLAG_NEED_RTNL,
8614         },
8615         {
8616                 .cmd = NL80211_CMD_TDLS_MGMT,
8617                 .doit = nl80211_tdls_mgmt,
8618                 .policy = nl80211_policy,
8619                 .flags = GENL_ADMIN_PERM,
8620                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8621                                   NL80211_FLAG_NEED_RTNL,
8622         },
8623         {
8624                 .cmd = NL80211_CMD_TDLS_OPER,
8625                 .doit = nl80211_tdls_oper,
8626                 .policy = nl80211_policy,
8627                 .flags = GENL_ADMIN_PERM,
8628                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8629                                   NL80211_FLAG_NEED_RTNL,
8630         },
8631         {
8632                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
8633                 .doit = nl80211_register_unexpected_frame,
8634                 .policy = nl80211_policy,
8635                 .flags = GENL_ADMIN_PERM,
8636                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8637                                   NL80211_FLAG_NEED_RTNL,
8638         },
8639         {
8640                 .cmd = NL80211_CMD_PROBE_CLIENT,
8641                 .doit = nl80211_probe_client,
8642                 .policy = nl80211_policy,
8643                 .flags = GENL_ADMIN_PERM,
8644                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8645                                   NL80211_FLAG_NEED_RTNL,
8646         },
8647         {
8648                 .cmd = NL80211_CMD_REGISTER_BEACONS,
8649                 .doit = nl80211_register_beacons,
8650                 .policy = nl80211_policy,
8651                 .flags = GENL_ADMIN_PERM,
8652                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8653                                   NL80211_FLAG_NEED_RTNL,
8654         },
8655         {
8656                 .cmd = NL80211_CMD_SET_NOACK_MAP,
8657                 .doit = nl80211_set_noack_map,
8658                 .policy = nl80211_policy,
8659                 .flags = GENL_ADMIN_PERM,
8660                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8661                                   NL80211_FLAG_NEED_RTNL,
8662         },
8663         {
8664                 .cmd = NL80211_CMD_START_P2P_DEVICE,
8665                 .doit = nl80211_start_p2p_device,
8666                 .policy = nl80211_policy,
8667                 .flags = GENL_ADMIN_PERM,
8668                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8669                                   NL80211_FLAG_NEED_RTNL,
8670         },
8671         {
8672                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
8673                 .doit = nl80211_stop_p2p_device,
8674                 .policy = nl80211_policy,
8675                 .flags = GENL_ADMIN_PERM,
8676                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8677                                   NL80211_FLAG_NEED_RTNL,
8678         },
8679         {
8680                 .cmd = NL80211_CMD_SET_MCAST_RATE,
8681                 .doit = nl80211_set_mcast_rate,
8682                 .policy = nl80211_policy,
8683                 .flags = GENL_ADMIN_PERM,
8684                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8685                                   NL80211_FLAG_NEED_RTNL,
8686         },
8687         {
8688                 .cmd = NL80211_CMD_SET_MAC_ACL,
8689                 .doit = nl80211_set_mac_acl,
8690                 .policy = nl80211_policy,
8691                 .flags = GENL_ADMIN_PERM,
8692                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8693                                   NL80211_FLAG_NEED_RTNL,
8694         },
8695         {
8696                 .cmd = NL80211_CMD_RADAR_DETECT,
8697                 .doit = nl80211_start_radar_detection,
8698                 .policy = nl80211_policy,
8699                 .flags = GENL_ADMIN_PERM,
8700                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8701                                   NL80211_FLAG_NEED_RTNL,
8702         },
8703         {
8704                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
8705                 .doit = nl80211_get_protocol_features,
8706                 .policy = nl80211_policy,
8707         },
8708 };
8709
8710 static struct genl_multicast_group nl80211_mlme_mcgrp = {
8711         .name = "mlme",
8712 };
8713
8714 /* multicast groups */
8715 static struct genl_multicast_group nl80211_config_mcgrp = {
8716         .name = "config",
8717 };
8718 static struct genl_multicast_group nl80211_scan_mcgrp = {
8719         .name = "scan",
8720 };
8721 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
8722         .name = "regulatory",
8723 };
8724
8725 /* notification functions */
8726
8727 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
8728 {
8729         struct sk_buff *msg;
8730
8731         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8732         if (!msg)
8733                 return;
8734
8735         if (nl80211_send_wiphy(rdev, msg, 0, 0, 0,
8736                                false, NULL, NULL, NULL) < 0) {
8737                 nlmsg_free(msg);
8738                 return;
8739         }
8740
8741         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8742                                 nl80211_config_mcgrp.id, GFP_KERNEL);
8743 }
8744
8745 static int nl80211_add_scan_req(struct sk_buff *msg,
8746                                 struct cfg80211_registered_device *rdev)
8747 {
8748         struct cfg80211_scan_request *req = rdev->scan_req;
8749         struct nlattr *nest;
8750         int i;
8751
8752         ASSERT_RDEV_LOCK(rdev);
8753
8754         if (WARN_ON(!req))
8755                 return 0;
8756
8757         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
8758         if (!nest)
8759                 goto nla_put_failure;
8760         for (i = 0; i < req->n_ssids; i++) {
8761                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
8762                         goto nla_put_failure;
8763         }
8764         nla_nest_end(msg, nest);
8765
8766         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
8767         if (!nest)
8768                 goto nla_put_failure;
8769         for (i = 0; i < req->n_channels; i++) {
8770                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
8771                         goto nla_put_failure;
8772         }
8773         nla_nest_end(msg, nest);
8774
8775         if (req->ie &&
8776             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
8777                 goto nla_put_failure;
8778
8779         if (req->flags)
8780                 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags);
8781
8782         return 0;
8783  nla_put_failure:
8784         return -ENOBUFS;
8785 }
8786
8787 static int nl80211_send_scan_msg(struct sk_buff *msg,
8788                                  struct cfg80211_registered_device *rdev,
8789                                  struct wireless_dev *wdev,
8790                                  u32 portid, u32 seq, int flags,
8791                                  u32 cmd)
8792 {
8793         void *hdr;
8794
8795         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
8796         if (!hdr)
8797                 return -1;
8798
8799         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8800             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
8801                                          wdev->netdev->ifindex)) ||
8802             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
8803                 goto nla_put_failure;
8804
8805         /* ignore errors and send incomplete event anyway */
8806         nl80211_add_scan_req(msg, rdev);
8807
8808         return genlmsg_end(msg, hdr);
8809
8810  nla_put_failure:
8811         genlmsg_cancel(msg, hdr);
8812         return -EMSGSIZE;
8813 }
8814
8815 static int
8816 nl80211_send_sched_scan_msg(struct sk_buff *msg,
8817                             struct cfg80211_registered_device *rdev,
8818                             struct net_device *netdev,
8819                             u32 portid, u32 seq, int flags, u32 cmd)
8820 {
8821         void *hdr;
8822
8823         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
8824         if (!hdr)
8825                 return -1;
8826
8827         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8828             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
8829                 goto nla_put_failure;
8830
8831         return genlmsg_end(msg, hdr);
8832
8833  nla_put_failure:
8834         genlmsg_cancel(msg, hdr);
8835         return -EMSGSIZE;
8836 }
8837
8838 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
8839                              struct wireless_dev *wdev)
8840 {
8841         struct sk_buff *msg;
8842
8843         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8844         if (!msg)
8845                 return;
8846
8847         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
8848                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
8849                 nlmsg_free(msg);
8850                 return;
8851         }
8852
8853         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8854                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
8855 }
8856
8857 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
8858                             struct wireless_dev *wdev)
8859 {
8860         struct sk_buff *msg;
8861
8862         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8863         if (!msg)
8864                 return;
8865
8866         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
8867                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
8868                 nlmsg_free(msg);
8869                 return;
8870         }
8871
8872         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8873                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
8874 }
8875
8876 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
8877                                struct wireless_dev *wdev)
8878 {
8879         struct sk_buff *msg;
8880
8881         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8882         if (!msg)
8883                 return;
8884
8885         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
8886                                   NL80211_CMD_SCAN_ABORTED) < 0) {
8887                 nlmsg_free(msg);
8888                 return;
8889         }
8890
8891         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8892                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
8893 }
8894
8895 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
8896                                      struct net_device *netdev)
8897 {
8898         struct sk_buff *msg;
8899
8900         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8901         if (!msg)
8902                 return;
8903
8904         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
8905                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
8906                 nlmsg_free(msg);
8907                 return;
8908         }
8909
8910         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8911                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
8912 }
8913
8914 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
8915                              struct net_device *netdev, u32 cmd)
8916 {
8917         struct sk_buff *msg;
8918
8919         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8920         if (!msg)
8921                 return;
8922
8923         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
8924                 nlmsg_free(msg);
8925                 return;
8926         }
8927
8928         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8929                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
8930 }
8931
8932 /*
8933  * This can happen on global regulatory changes or device specific settings
8934  * based on custom world regulatory domains.
8935  */
8936 void nl80211_send_reg_change_event(struct regulatory_request *request)
8937 {
8938         struct sk_buff *msg;
8939         void *hdr;
8940
8941         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8942         if (!msg)
8943                 return;
8944
8945         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
8946         if (!hdr) {
8947                 nlmsg_free(msg);
8948                 return;
8949         }
8950
8951         /* Userspace can always count this one always being set */
8952         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
8953                 goto nla_put_failure;
8954
8955         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
8956                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
8957                                NL80211_REGDOM_TYPE_WORLD))
8958                         goto nla_put_failure;
8959         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
8960                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
8961                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
8962                         goto nla_put_failure;
8963         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
8964                    request->intersect) {
8965                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
8966                                NL80211_REGDOM_TYPE_INTERSECTION))
8967                         goto nla_put_failure;
8968         } else {
8969                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
8970                                NL80211_REGDOM_TYPE_COUNTRY) ||
8971                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
8972                                    request->alpha2))
8973                         goto nla_put_failure;
8974         }
8975
8976         if (request->wiphy_idx != WIPHY_IDX_INVALID &&
8977             nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
8978                 goto nla_put_failure;
8979
8980         genlmsg_end(msg, hdr);
8981
8982         rcu_read_lock();
8983         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
8984                                 GFP_ATOMIC);
8985         rcu_read_unlock();
8986
8987         return;
8988
8989 nla_put_failure:
8990         genlmsg_cancel(msg, hdr);
8991         nlmsg_free(msg);
8992 }
8993
8994 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
8995                                     struct net_device *netdev,
8996                                     const u8 *buf, size_t len,
8997                                     enum nl80211_commands cmd, gfp_t gfp)
8998 {
8999         struct sk_buff *msg;
9000         void *hdr;
9001
9002         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9003         if (!msg)
9004                 return;
9005
9006         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9007         if (!hdr) {
9008                 nlmsg_free(msg);
9009                 return;
9010         }
9011
9012         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9013             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9014             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
9015                 goto nla_put_failure;
9016
9017         genlmsg_end(msg, hdr);
9018
9019         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9020                                 nl80211_mlme_mcgrp.id, gfp);
9021         return;
9022
9023  nla_put_failure:
9024         genlmsg_cancel(msg, hdr);
9025         nlmsg_free(msg);
9026 }
9027
9028 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
9029                           struct net_device *netdev, const u8 *buf,
9030                           size_t len, gfp_t gfp)
9031 {
9032         nl80211_send_mlme_event(rdev, netdev, buf, len,
9033                                 NL80211_CMD_AUTHENTICATE, gfp);
9034 }
9035
9036 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
9037                            struct net_device *netdev, const u8 *buf,
9038                            size_t len, gfp_t gfp)
9039 {
9040         nl80211_send_mlme_event(rdev, netdev, buf, len,
9041                                 NL80211_CMD_ASSOCIATE, gfp);
9042 }
9043
9044 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
9045                          struct net_device *netdev, const u8 *buf,
9046                          size_t len, gfp_t gfp)
9047 {
9048         nl80211_send_mlme_event(rdev, netdev, buf, len,
9049                                 NL80211_CMD_DEAUTHENTICATE, gfp);
9050 }
9051
9052 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
9053                            struct net_device *netdev, const u8 *buf,
9054                            size_t len, gfp_t gfp)
9055 {
9056         nl80211_send_mlme_event(rdev, netdev, buf, len,
9057                                 NL80211_CMD_DISASSOCIATE, gfp);
9058 }
9059
9060 void nl80211_send_unprot_deauth(struct cfg80211_registered_device *rdev,
9061                                 struct net_device *netdev, const u8 *buf,
9062                                 size_t len, gfp_t gfp)
9063 {
9064         nl80211_send_mlme_event(rdev, netdev, buf, len,
9065                                 NL80211_CMD_UNPROT_DEAUTHENTICATE, gfp);
9066 }
9067
9068 void nl80211_send_unprot_disassoc(struct cfg80211_registered_device *rdev,
9069                                   struct net_device *netdev, const u8 *buf,
9070                                   size_t len, gfp_t gfp)
9071 {
9072         nl80211_send_mlme_event(rdev, netdev, buf, len,
9073                                 NL80211_CMD_UNPROT_DISASSOCIATE, gfp);
9074 }
9075
9076 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
9077                                       struct net_device *netdev, int cmd,
9078                                       const u8 *addr, gfp_t gfp)
9079 {
9080         struct sk_buff *msg;
9081         void *hdr;
9082
9083         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9084         if (!msg)
9085                 return;
9086
9087         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9088         if (!hdr) {
9089                 nlmsg_free(msg);
9090                 return;
9091         }
9092
9093         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9094             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9095             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
9096             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
9097                 goto nla_put_failure;
9098
9099         genlmsg_end(msg, hdr);
9100
9101         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9102                                 nl80211_mlme_mcgrp.id, gfp);
9103         return;
9104
9105  nla_put_failure:
9106         genlmsg_cancel(msg, hdr);
9107         nlmsg_free(msg);
9108 }
9109
9110 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
9111                                struct net_device *netdev, const u8 *addr,
9112                                gfp_t gfp)
9113 {
9114         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
9115                                   addr, gfp);
9116 }
9117
9118 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
9119                                 struct net_device *netdev, const u8 *addr,
9120                                 gfp_t gfp)
9121 {
9122         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
9123                                   addr, gfp);
9124 }
9125
9126 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
9127                                  struct net_device *netdev, const u8 *bssid,
9128                                  const u8 *req_ie, size_t req_ie_len,
9129                                  const u8 *resp_ie, size_t resp_ie_len,
9130                                  u16 status, gfp_t gfp)
9131 {
9132         struct sk_buff *msg;
9133         void *hdr;
9134
9135         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9136         if (!msg)
9137                 return;
9138
9139         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
9140         if (!hdr) {
9141                 nlmsg_free(msg);
9142                 return;
9143         }
9144
9145         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9146             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9147             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
9148             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
9149             (req_ie &&
9150              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
9151             (resp_ie &&
9152              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
9153                 goto nla_put_failure;
9154
9155         genlmsg_end(msg, hdr);
9156
9157         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9158                                 nl80211_mlme_mcgrp.id, gfp);
9159         return;
9160
9161  nla_put_failure:
9162         genlmsg_cancel(msg, hdr);
9163         nlmsg_free(msg);
9164
9165 }
9166
9167 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
9168                          struct net_device *netdev, const u8 *bssid,
9169                          const u8 *req_ie, size_t req_ie_len,
9170                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
9171 {
9172         struct sk_buff *msg;
9173         void *hdr;
9174
9175         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9176         if (!msg)
9177                 return;
9178
9179         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
9180         if (!hdr) {
9181                 nlmsg_free(msg);
9182                 return;
9183         }
9184
9185         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9186             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9187             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
9188             (req_ie &&
9189              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
9190             (resp_ie &&
9191              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
9192                 goto nla_put_failure;
9193
9194         genlmsg_end(msg, hdr);
9195
9196         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9197                                 nl80211_mlme_mcgrp.id, gfp);
9198         return;
9199
9200  nla_put_failure:
9201         genlmsg_cancel(msg, hdr);
9202         nlmsg_free(msg);
9203
9204 }
9205
9206 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
9207                                struct net_device *netdev, u16 reason,
9208                                const u8 *ie, size_t ie_len, bool from_ap)
9209 {
9210         struct sk_buff *msg;
9211         void *hdr;
9212
9213         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9214         if (!msg)
9215                 return;
9216
9217         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
9218         if (!hdr) {
9219                 nlmsg_free(msg);
9220                 return;
9221         }
9222
9223         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9224             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9225             (from_ap && reason &&
9226              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
9227             (from_ap &&
9228              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
9229             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
9230                 goto nla_put_failure;
9231
9232         genlmsg_end(msg, hdr);
9233
9234         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9235                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
9236         return;
9237
9238  nla_put_failure:
9239         genlmsg_cancel(msg, hdr);
9240         nlmsg_free(msg);
9241
9242 }
9243
9244 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
9245                              struct net_device *netdev, const u8 *bssid,
9246                              gfp_t gfp)
9247 {
9248         struct sk_buff *msg;
9249         void *hdr;
9250
9251         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9252         if (!msg)
9253                 return;
9254
9255         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
9256         if (!hdr) {
9257                 nlmsg_free(msg);
9258                 return;
9259         }
9260
9261         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9262             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9263             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
9264                 goto nla_put_failure;
9265
9266         genlmsg_end(msg, hdr);
9267
9268         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9269                                 nl80211_mlme_mcgrp.id, gfp);
9270         return;
9271
9272  nla_put_failure:
9273         genlmsg_cancel(msg, hdr);
9274         nlmsg_free(msg);
9275 }
9276
9277 void nl80211_send_new_peer_candidate(struct cfg80211_registered_device *rdev,
9278                 struct net_device *netdev,
9279                 const u8 *macaddr, const u8* ie, u8 ie_len,
9280                 gfp_t gfp)
9281 {
9282         struct sk_buff *msg;
9283         void *hdr;
9284
9285         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9286         if (!msg)
9287                 return;
9288
9289         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
9290         if (!hdr) {
9291                 nlmsg_free(msg);
9292                 return;
9293         }
9294
9295         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9296             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9297             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, macaddr) ||
9298             (ie_len && ie &&
9299              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
9300                 goto nla_put_failure;
9301
9302         genlmsg_end(msg, hdr);
9303
9304         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9305                                 nl80211_mlme_mcgrp.id, gfp);
9306         return;
9307
9308  nla_put_failure:
9309         genlmsg_cancel(msg, hdr);
9310         nlmsg_free(msg);
9311 }
9312
9313 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
9314                                  struct net_device *netdev, const u8 *addr,
9315                                  enum nl80211_key_type key_type, int key_id,
9316                                  const u8 *tsc, gfp_t gfp)
9317 {
9318         struct sk_buff *msg;
9319         void *hdr;
9320
9321         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9322         if (!msg)
9323                 return;
9324
9325         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
9326         if (!hdr) {
9327                 nlmsg_free(msg);
9328                 return;
9329         }
9330
9331         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9332             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9333             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
9334             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
9335             (key_id != -1 &&
9336              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
9337             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
9338                 goto nla_put_failure;
9339
9340         genlmsg_end(msg, hdr);
9341
9342         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9343                                 nl80211_mlme_mcgrp.id, gfp);
9344         return;
9345
9346  nla_put_failure:
9347         genlmsg_cancel(msg, hdr);
9348         nlmsg_free(msg);
9349 }
9350
9351 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
9352                                     struct ieee80211_channel *channel_before,
9353                                     struct ieee80211_channel *channel_after)
9354 {
9355         struct sk_buff *msg;
9356         void *hdr;
9357         struct nlattr *nl_freq;
9358
9359         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
9360         if (!msg)
9361                 return;
9362
9363         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
9364         if (!hdr) {
9365                 nlmsg_free(msg);
9366                 return;
9367         }
9368
9369         /*
9370          * Since we are applying the beacon hint to a wiphy we know its
9371          * wiphy_idx is valid
9372          */
9373         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
9374                 goto nla_put_failure;
9375
9376         /* Before */
9377         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
9378         if (!nl_freq)
9379                 goto nla_put_failure;
9380         if (nl80211_msg_put_channel(msg, channel_before))
9381                 goto nla_put_failure;
9382         nla_nest_end(msg, nl_freq);
9383
9384         /* After */
9385         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
9386         if (!nl_freq)
9387                 goto nla_put_failure;
9388         if (nl80211_msg_put_channel(msg, channel_after))
9389                 goto nla_put_failure;
9390         nla_nest_end(msg, nl_freq);
9391
9392         genlmsg_end(msg, hdr);
9393
9394         rcu_read_lock();
9395         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
9396                                 GFP_ATOMIC);
9397         rcu_read_unlock();
9398
9399         return;
9400
9401 nla_put_failure:
9402         genlmsg_cancel(msg, hdr);
9403         nlmsg_free(msg);
9404 }
9405
9406 static void nl80211_send_remain_on_chan_event(
9407         int cmd, struct cfg80211_registered_device *rdev,
9408         struct wireless_dev *wdev, u64 cookie,
9409         struct ieee80211_channel *chan,
9410         unsigned int duration, gfp_t gfp)
9411 {
9412         struct sk_buff *msg;
9413         void *hdr;
9414
9415         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9416         if (!msg)
9417                 return;
9418
9419         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9420         if (!hdr) {
9421                 nlmsg_free(msg);
9422                 return;
9423         }
9424
9425         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9426             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9427                                          wdev->netdev->ifindex)) ||
9428             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
9429             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
9430             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
9431                         NL80211_CHAN_NO_HT) ||
9432             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
9433                 goto nla_put_failure;
9434
9435         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
9436             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
9437                 goto nla_put_failure;
9438
9439         genlmsg_end(msg, hdr);
9440
9441         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9442                                 nl80211_mlme_mcgrp.id, gfp);
9443         return;
9444
9445  nla_put_failure:
9446         genlmsg_cancel(msg, hdr);
9447         nlmsg_free(msg);
9448 }
9449
9450 void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
9451                                     struct wireless_dev *wdev, u64 cookie,
9452                                     struct ieee80211_channel *chan,
9453                                     unsigned int duration, gfp_t gfp)
9454 {
9455         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
9456                                           rdev, wdev, cookie, chan,
9457                                           duration, gfp);
9458 }
9459
9460 void nl80211_send_remain_on_channel_cancel(
9461         struct cfg80211_registered_device *rdev,
9462         struct wireless_dev *wdev,
9463         u64 cookie, struct ieee80211_channel *chan, gfp_t gfp)
9464 {
9465         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
9466                                           rdev, wdev, cookie, chan, 0, gfp);
9467 }
9468
9469 void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
9470                             struct net_device *dev, const u8 *mac_addr,
9471                             struct station_info *sinfo, gfp_t gfp)
9472 {
9473         struct sk_buff *msg;
9474
9475         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9476         if (!msg)
9477                 return;
9478
9479         if (nl80211_send_station(msg, 0, 0, 0,
9480                                  rdev, dev, mac_addr, sinfo) < 0) {
9481                 nlmsg_free(msg);
9482                 return;
9483         }
9484
9485         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9486                                 nl80211_mlme_mcgrp.id, gfp);
9487 }
9488
9489 void nl80211_send_sta_del_event(struct cfg80211_registered_device *rdev,
9490                                 struct net_device *dev, const u8 *mac_addr,
9491                                 gfp_t gfp)
9492 {
9493         struct sk_buff *msg;
9494         void *hdr;
9495
9496         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9497         if (!msg)
9498                 return;
9499
9500         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
9501         if (!hdr) {
9502                 nlmsg_free(msg);
9503                 return;
9504         }
9505
9506         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9507             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
9508                 goto nla_put_failure;
9509
9510         genlmsg_end(msg, hdr);
9511
9512         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9513                                 nl80211_mlme_mcgrp.id, gfp);
9514         return;
9515
9516  nla_put_failure:
9517         genlmsg_cancel(msg, hdr);
9518         nlmsg_free(msg);
9519 }
9520
9521 void nl80211_send_conn_failed_event(struct cfg80211_registered_device *rdev,
9522                                     struct net_device *dev, const u8 *mac_addr,
9523                                     enum nl80211_connect_failed_reason reason,
9524                                     gfp_t gfp)
9525 {
9526         struct sk_buff *msg;
9527         void *hdr;
9528
9529         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
9530         if (!msg)
9531                 return;
9532
9533         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
9534         if (!hdr) {
9535                 nlmsg_free(msg);
9536                 return;
9537         }
9538
9539         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9540             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
9541             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
9542                 goto nla_put_failure;
9543
9544         genlmsg_end(msg, hdr);
9545
9546         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9547                                 nl80211_mlme_mcgrp.id, gfp);
9548         return;
9549
9550  nla_put_failure:
9551         genlmsg_cancel(msg, hdr);
9552         nlmsg_free(msg);
9553 }
9554
9555 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
9556                                        const u8 *addr, gfp_t gfp)
9557 {
9558         struct wireless_dev *wdev = dev->ieee80211_ptr;
9559         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9560         struct sk_buff *msg;
9561         void *hdr;
9562         int err;
9563         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
9564
9565         if (!nlportid)
9566                 return false;
9567
9568         msg = nlmsg_new(100, gfp);
9569         if (!msg)
9570                 return true;
9571
9572         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9573         if (!hdr) {
9574                 nlmsg_free(msg);
9575                 return true;
9576         }
9577
9578         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9579             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9580             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
9581                 goto nla_put_failure;
9582
9583         err = genlmsg_end(msg, hdr);
9584         if (err < 0) {
9585                 nlmsg_free(msg);
9586                 return true;
9587         }
9588
9589         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
9590         return true;
9591
9592  nla_put_failure:
9593         genlmsg_cancel(msg, hdr);
9594         nlmsg_free(msg);
9595         return true;
9596 }
9597
9598 bool nl80211_unexpected_frame(struct net_device *dev, const u8 *addr, gfp_t gfp)
9599 {
9600         return __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
9601                                           addr, gfp);
9602 }
9603
9604 bool nl80211_unexpected_4addr_frame(struct net_device *dev,
9605                                     const u8 *addr, gfp_t gfp)
9606 {
9607         return __nl80211_unexpected_frame(dev,
9608                                           NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
9609                                           addr, gfp);
9610 }
9611
9612 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
9613                       struct wireless_dev *wdev, u32 nlportid,
9614                       int freq, int sig_dbm,
9615                       const u8 *buf, size_t len, gfp_t gfp)
9616 {
9617         struct net_device *netdev = wdev->netdev;
9618         struct sk_buff *msg;
9619         void *hdr;
9620
9621         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9622         if (!msg)
9623                 return -ENOMEM;
9624
9625         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
9626         if (!hdr) {
9627                 nlmsg_free(msg);
9628                 return -ENOMEM;
9629         }
9630
9631         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9632             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9633                                         netdev->ifindex)) ||
9634             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
9635             (sig_dbm &&
9636              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
9637             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
9638                 goto nla_put_failure;
9639
9640         genlmsg_end(msg, hdr);
9641
9642         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
9643
9644  nla_put_failure:
9645         genlmsg_cancel(msg, hdr);
9646         nlmsg_free(msg);
9647         return -ENOBUFS;
9648 }
9649
9650 void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
9651                                  struct wireless_dev *wdev, u64 cookie,
9652                                  const u8 *buf, size_t len, bool ack,
9653                                  gfp_t gfp)
9654 {
9655         struct net_device *netdev = wdev->netdev;
9656         struct sk_buff *msg;
9657         void *hdr;
9658
9659         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9660         if (!msg)
9661                 return;
9662
9663         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
9664         if (!hdr) {
9665                 nlmsg_free(msg);
9666                 return;
9667         }
9668
9669         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9670             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9671                                    netdev->ifindex)) ||
9672             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
9673             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
9674             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
9675                 goto nla_put_failure;
9676
9677         genlmsg_end(msg, hdr);
9678
9679         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
9680         return;
9681
9682  nla_put_failure:
9683         genlmsg_cancel(msg, hdr);
9684         nlmsg_free(msg);
9685 }
9686
9687 void
9688 nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
9689                              struct net_device *netdev,
9690                              enum nl80211_cqm_rssi_threshold_event rssi_event,
9691                              gfp_t gfp)
9692 {
9693         struct sk_buff *msg;
9694         struct nlattr *pinfoattr;
9695         void *hdr;
9696
9697         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9698         if (!msg)
9699                 return;
9700
9701         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
9702         if (!hdr) {
9703                 nlmsg_free(msg);
9704                 return;
9705         }
9706
9707         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9708             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
9709                 goto nla_put_failure;
9710
9711         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
9712         if (!pinfoattr)
9713                 goto nla_put_failure;
9714
9715         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
9716                         rssi_event))
9717                 goto nla_put_failure;
9718
9719         nla_nest_end(msg, pinfoattr);
9720
9721         genlmsg_end(msg, hdr);
9722
9723         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9724                                 nl80211_mlme_mcgrp.id, gfp);
9725         return;
9726
9727  nla_put_failure:
9728         genlmsg_cancel(msg, hdr);
9729         nlmsg_free(msg);
9730 }
9731
9732 void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
9733                               struct net_device *netdev, const u8 *bssid,
9734                               const u8 *replay_ctr, gfp_t gfp)
9735 {
9736         struct sk_buff *msg;
9737         struct nlattr *rekey_attr;
9738         void *hdr;
9739
9740         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9741         if (!msg)
9742                 return;
9743
9744         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
9745         if (!hdr) {
9746                 nlmsg_free(msg);
9747                 return;
9748         }
9749
9750         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9751             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9752             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
9753                 goto nla_put_failure;
9754
9755         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
9756         if (!rekey_attr)
9757                 goto nla_put_failure;
9758
9759         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
9760                     NL80211_REPLAY_CTR_LEN, replay_ctr))
9761                 goto nla_put_failure;
9762
9763         nla_nest_end(msg, rekey_attr);
9764
9765         genlmsg_end(msg, hdr);
9766
9767         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9768                                 nl80211_mlme_mcgrp.id, gfp);
9769         return;
9770
9771  nla_put_failure:
9772         genlmsg_cancel(msg, hdr);
9773         nlmsg_free(msg);
9774 }
9775
9776 void nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
9777                                     struct net_device *netdev, int index,
9778                                     const u8 *bssid, bool preauth, gfp_t gfp)
9779 {
9780         struct sk_buff *msg;
9781         struct nlattr *attr;
9782         void *hdr;
9783
9784         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9785         if (!msg)
9786                 return;
9787
9788         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
9789         if (!hdr) {
9790                 nlmsg_free(msg);
9791                 return;
9792         }
9793
9794         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9795             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
9796                 goto nla_put_failure;
9797
9798         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
9799         if (!attr)
9800                 goto nla_put_failure;
9801
9802         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
9803             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
9804             (preauth &&
9805              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
9806                 goto nla_put_failure;
9807
9808         nla_nest_end(msg, attr);
9809
9810         genlmsg_end(msg, hdr);
9811
9812         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9813                                 nl80211_mlme_mcgrp.id, gfp);
9814         return;
9815
9816  nla_put_failure:
9817         genlmsg_cancel(msg, hdr);
9818         nlmsg_free(msg);
9819 }
9820
9821 void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
9822                               struct net_device *netdev,
9823                               struct cfg80211_chan_def *chandef, gfp_t gfp)
9824 {
9825         struct sk_buff *msg;
9826         void *hdr;
9827
9828         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9829         if (!msg)
9830                 return;
9831
9832         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
9833         if (!hdr) {
9834                 nlmsg_free(msg);
9835                 return;
9836         }
9837
9838         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
9839                 goto nla_put_failure;
9840
9841         if (nl80211_send_chandef(msg, chandef))
9842                 goto nla_put_failure;
9843
9844         genlmsg_end(msg, hdr);
9845
9846         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9847                                 nl80211_mlme_mcgrp.id, gfp);
9848         return;
9849
9850  nla_put_failure:
9851         genlmsg_cancel(msg, hdr);
9852         nlmsg_free(msg);
9853 }
9854
9855 void
9856 nl80211_send_cqm_txe_notify(struct cfg80211_registered_device *rdev,
9857                             struct net_device *netdev, const u8 *peer,
9858                             u32 num_packets, u32 rate, u32 intvl, gfp_t gfp)
9859 {
9860         struct sk_buff *msg;
9861         struct nlattr *pinfoattr;
9862         void *hdr;
9863
9864         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
9865         if (!msg)
9866                 return;
9867
9868         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
9869         if (!hdr) {
9870                 nlmsg_free(msg);
9871                 return;
9872         }
9873
9874         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9875             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9876             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
9877                 goto nla_put_failure;
9878
9879         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
9880         if (!pinfoattr)
9881                 goto nla_put_failure;
9882
9883         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
9884                 goto nla_put_failure;
9885
9886         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
9887                 goto nla_put_failure;
9888
9889         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
9890                 goto nla_put_failure;
9891
9892         nla_nest_end(msg, pinfoattr);
9893
9894         genlmsg_end(msg, hdr);
9895
9896         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9897                                 nl80211_mlme_mcgrp.id, gfp);
9898         return;
9899
9900  nla_put_failure:
9901         genlmsg_cancel(msg, hdr);
9902         nlmsg_free(msg);
9903 }
9904
9905 void
9906 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
9907                      struct cfg80211_chan_def *chandef,
9908                      enum nl80211_radar_event event,
9909                      struct net_device *netdev, gfp_t gfp)
9910 {
9911         struct sk_buff *msg;
9912         void *hdr;
9913
9914         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9915         if (!msg)
9916                 return;
9917
9918         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
9919         if (!hdr) {
9920                 nlmsg_free(msg);
9921                 return;
9922         }
9923
9924         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
9925                 goto nla_put_failure;
9926
9927         /* NOP and radar events don't need a netdev parameter */
9928         if (netdev) {
9929                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
9930
9931                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9932                     nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
9933                         goto nla_put_failure;
9934         }
9935
9936         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
9937                 goto nla_put_failure;
9938
9939         if (nl80211_send_chandef(msg, chandef))
9940                 goto nla_put_failure;
9941
9942         if (genlmsg_end(msg, hdr) < 0) {
9943                 nlmsg_free(msg);
9944                 return;
9945         }
9946
9947         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9948                                 nl80211_mlme_mcgrp.id, gfp);
9949         return;
9950
9951  nla_put_failure:
9952         genlmsg_cancel(msg, hdr);
9953         nlmsg_free(msg);
9954 }
9955
9956 void
9957 nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
9958                                 struct net_device *netdev, const u8 *peer,
9959                                 u32 num_packets, gfp_t gfp)
9960 {
9961         struct sk_buff *msg;
9962         struct nlattr *pinfoattr;
9963         void *hdr;
9964
9965         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9966         if (!msg)
9967                 return;
9968
9969         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
9970         if (!hdr) {
9971                 nlmsg_free(msg);
9972                 return;
9973         }
9974
9975         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9976             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9977             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
9978                 goto nla_put_failure;
9979
9980         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
9981         if (!pinfoattr)
9982                 goto nla_put_failure;
9983
9984         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
9985                 goto nla_put_failure;
9986
9987         nla_nest_end(msg, pinfoattr);
9988
9989         genlmsg_end(msg, hdr);
9990
9991         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9992                                 nl80211_mlme_mcgrp.id, gfp);
9993         return;
9994
9995  nla_put_failure:
9996         genlmsg_cancel(msg, hdr);
9997         nlmsg_free(msg);
9998 }
9999
10000 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
10001                            u64 cookie, bool acked, gfp_t gfp)
10002 {
10003         struct wireless_dev *wdev = dev->ieee80211_ptr;
10004         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10005         struct sk_buff *msg;
10006         void *hdr;
10007         int err;
10008
10009         trace_cfg80211_probe_status(dev, addr, cookie, acked);
10010
10011         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10012
10013         if (!msg)
10014                 return;
10015
10016         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
10017         if (!hdr) {
10018                 nlmsg_free(msg);
10019                 return;
10020         }
10021
10022         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10023             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10024             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
10025             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
10026             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
10027                 goto nla_put_failure;
10028
10029         err = genlmsg_end(msg, hdr);
10030         if (err < 0) {
10031                 nlmsg_free(msg);
10032                 return;
10033         }
10034
10035         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10036                                 nl80211_mlme_mcgrp.id, gfp);
10037         return;
10038
10039  nla_put_failure:
10040         genlmsg_cancel(msg, hdr);
10041         nlmsg_free(msg);
10042 }
10043 EXPORT_SYMBOL(cfg80211_probe_status);
10044
10045 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
10046                                  const u8 *frame, size_t len,
10047                                  int freq, int sig_dbm)
10048 {
10049         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10050         struct sk_buff *msg;
10051         void *hdr;
10052         struct cfg80211_beacon_registration *reg;
10053
10054         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
10055
10056         spin_lock_bh(&rdev->beacon_registrations_lock);
10057         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
10058                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
10059                 if (!msg) {
10060                         spin_unlock_bh(&rdev->beacon_registrations_lock);
10061                         return;
10062                 }
10063
10064                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
10065                 if (!hdr)
10066                         goto nla_put_failure;
10067
10068                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10069                     (freq &&
10070                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
10071                     (sig_dbm &&
10072                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
10073                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
10074                         goto nla_put_failure;
10075
10076                 genlmsg_end(msg, hdr);
10077
10078                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
10079         }
10080         spin_unlock_bh(&rdev->beacon_registrations_lock);
10081         return;
10082
10083  nla_put_failure:
10084         spin_unlock_bh(&rdev->beacon_registrations_lock);
10085         if (hdr)
10086                 genlmsg_cancel(msg, hdr);
10087         nlmsg_free(msg);
10088 }
10089 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
10090
10091 #ifdef CONFIG_PM
10092 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
10093                                    struct cfg80211_wowlan_wakeup *wakeup,
10094                                    gfp_t gfp)
10095 {
10096         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10097         struct sk_buff *msg;
10098         void *hdr;
10099         int err, size = 200;
10100
10101         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
10102
10103         if (wakeup)
10104                 size += wakeup->packet_present_len;
10105
10106         msg = nlmsg_new(size, gfp);
10107         if (!msg)
10108                 return;
10109
10110         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
10111         if (!hdr)
10112                 goto free_msg;
10113
10114         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10115             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10116                 goto free_msg;
10117
10118         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10119                                         wdev->netdev->ifindex))
10120                 goto free_msg;
10121
10122         if (wakeup) {
10123                 struct nlattr *reasons;
10124
10125                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
10126
10127                 if (wakeup->disconnect &&
10128                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
10129                         goto free_msg;
10130                 if (wakeup->magic_pkt &&
10131                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
10132                         goto free_msg;
10133                 if (wakeup->gtk_rekey_failure &&
10134                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
10135                         goto free_msg;
10136                 if (wakeup->eap_identity_req &&
10137                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
10138                         goto free_msg;
10139                 if (wakeup->four_way_handshake &&
10140                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
10141                         goto free_msg;
10142                 if (wakeup->rfkill_release &&
10143                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
10144                         goto free_msg;
10145
10146                 if (wakeup->pattern_idx >= 0 &&
10147                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
10148                                 wakeup->pattern_idx))
10149                         goto free_msg;
10150
10151                 if (wakeup->tcp_match)
10152                         nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH);
10153
10154                 if (wakeup->tcp_connlost)
10155                         nla_put_flag(msg,
10156                                      NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST);
10157
10158                 if (wakeup->tcp_nomoretokens)
10159                         nla_put_flag(msg,
10160                                 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS);
10161
10162                 if (wakeup->packet) {
10163                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
10164                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
10165
10166                         if (!wakeup->packet_80211) {
10167                                 pkt_attr =
10168                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
10169                                 len_attr =
10170                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
10171                         }
10172
10173                         if (wakeup->packet_len &&
10174                             nla_put_u32(msg, len_attr, wakeup->packet_len))
10175                                 goto free_msg;
10176
10177                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
10178                                     wakeup->packet))
10179                                 goto free_msg;
10180                 }
10181
10182                 nla_nest_end(msg, reasons);
10183         }
10184
10185         err = genlmsg_end(msg, hdr);
10186         if (err < 0)
10187                 goto free_msg;
10188
10189         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10190                                 nl80211_mlme_mcgrp.id, gfp);
10191         return;
10192
10193  free_msg:
10194         nlmsg_free(msg);
10195 }
10196 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
10197 #endif
10198
10199 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
10200                                 enum nl80211_tdls_operation oper,
10201                                 u16 reason_code, gfp_t gfp)
10202 {
10203         struct wireless_dev *wdev = dev->ieee80211_ptr;
10204         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10205         struct sk_buff *msg;
10206         void *hdr;
10207         int err;
10208
10209         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
10210                                          reason_code);
10211
10212         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10213         if (!msg)
10214                 return;
10215
10216         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
10217         if (!hdr) {
10218                 nlmsg_free(msg);
10219                 return;
10220         }
10221
10222         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10223             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10224             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
10225             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
10226             (reason_code > 0 &&
10227              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
10228                 goto nla_put_failure;
10229
10230         err = genlmsg_end(msg, hdr);
10231         if (err < 0) {
10232                 nlmsg_free(msg);
10233                 return;
10234         }
10235
10236         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10237                                 nl80211_mlme_mcgrp.id, gfp);
10238         return;
10239
10240  nla_put_failure:
10241         genlmsg_cancel(msg, hdr);
10242         nlmsg_free(msg);
10243 }
10244 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
10245
10246 static int nl80211_netlink_notify(struct notifier_block * nb,
10247                                   unsigned long state,
10248                                   void *_notify)
10249 {
10250         struct netlink_notify *notify = _notify;
10251         struct cfg80211_registered_device *rdev;
10252         struct wireless_dev *wdev;
10253         struct cfg80211_beacon_registration *reg, *tmp;
10254
10255         if (state != NETLINK_URELEASE)
10256                 return NOTIFY_DONE;
10257
10258         rcu_read_lock();
10259
10260         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
10261                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list)
10262                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
10263
10264                 spin_lock_bh(&rdev->beacon_registrations_lock);
10265                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
10266                                          list) {
10267                         if (reg->nlportid == notify->portid) {
10268                                 list_del(&reg->list);
10269                                 kfree(reg);
10270                                 break;
10271                         }
10272                 }
10273                 spin_unlock_bh(&rdev->beacon_registrations_lock);
10274         }
10275
10276         rcu_read_unlock();
10277
10278         return NOTIFY_DONE;
10279 }
10280
10281 static struct notifier_block nl80211_netlink_notifier = {
10282         .notifier_call = nl80211_netlink_notify,
10283 };
10284
10285 /* initialisation/exit functions */
10286
10287 int nl80211_init(void)
10288 {
10289         int err;
10290
10291         err = genl_register_family_with_ops(&nl80211_fam,
10292                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
10293         if (err)
10294                 return err;
10295
10296         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
10297         if (err)
10298                 goto err_out;
10299
10300         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
10301         if (err)
10302                 goto err_out;
10303
10304         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
10305         if (err)
10306                 goto err_out;
10307
10308         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
10309         if (err)
10310                 goto err_out;
10311
10312 #ifdef CONFIG_NL80211_TESTMODE
10313         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
10314         if (err)
10315                 goto err_out;
10316 #endif
10317
10318         err = netlink_register_notifier(&nl80211_netlink_notifier);
10319         if (err)
10320                 goto err_out;
10321
10322         return 0;
10323  err_out:
10324         genl_unregister_family(&nl80211_fam);
10325         return err;
10326 }
10327
10328 void nl80211_exit(void)
10329 {
10330         netlink_unregister_notifier(&nl80211_netlink_notifier);
10331         genl_unregister_family(&nl80211_fam);
10332 }