net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include <net/inet_connection_sock.h>
  23 #include "core.h"
  24 #include "nl80211.h"
  25 #include "reg.h"
  26 #include "rdev-ops.h"
  27
  28 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  29                                    struct genl_info *info,
  30                                    struct cfg80211_crypto_settings *settings,
  31                                    int cipher_limit);
  32
  33 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
  34                             struct genl_info *info);
  35 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
  36                               struct genl_info *info);
  37
  38 /* the netlink family */
  39 static struct genl_family nl80211_fam = {
  40         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  41         .name = "nl80211",      /* have users key off the name instead */
  42         .hdrsize = 0,           /* no private header */
  43         .version = 1,           /* no particular meaning now */
  44         .maxattr = NL80211_ATTR_MAX,
  45         .netnsok = true,
  46         .pre_doit = nl80211_pre_doit,
  47         .post_doit = nl80211_post_doit,
  48 };
  49
  50 /* returns ERR_PTR values */
  51 static struct wireless_dev *
  52 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  53 {
  54         struct cfg80211_registered_device *rdev;
  55         struct wireless_dev *result = NULL;
  56         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  57         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  58         u64 wdev_id;
  59         int wiphy_idx = -1;
  60         int ifidx = -1;
  61
  62         assert_cfg80211_lock();
  63
  64         if (!have_ifidx && !have_wdev_id)
  65                 return ERR_PTR(-EINVAL);
  66
  67         if (have_ifidx)
  68                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  69         if (have_wdev_id) {
  70                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  71                 wiphy_idx = wdev_id >> 32;
  72         }
  73
  74         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  75                 struct wireless_dev *wdev;
  76
  77                 if (wiphy_net(&rdev->wiphy) != netns)
  78                         continue;
  79
  80                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  81                         continue;
  82
  83                 mutex_lock(&rdev->devlist_mtx);
  84                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
  85                         if (have_ifidx && wdev->netdev &&
  86                             wdev->netdev->ifindex == ifidx) {
  87                                 result = wdev;
  88                                 break;
  89                         }
  90                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
  91                                 result = wdev;
  92                                 break;
  93                         }
  94                 }
  95                 mutex_unlock(&rdev->devlist_mtx);
  96
  97                 if (result)
  98                         break;
  99         }
 100
 101         if (result)
 102                 return result;
 103         return ERR_PTR(-ENODEV);
 104 }
 105
 106 static struct cfg80211_registered_device *
 107 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 108 {
 109         struct cfg80211_registered_device *rdev = NULL, *tmp;
 110         struct net_device *netdev;
 111
 112         assert_cfg80211_lock();
 113
 114         if (!attrs[NL80211_ATTR_WIPHY] &&
 115             !attrs[NL80211_ATTR_IFINDEX] &&
 116             !attrs[NL80211_ATTR_WDEV])
 117                 return ERR_PTR(-EINVAL);
 118
 119         if (attrs[NL80211_ATTR_WIPHY])
 120                 rdev = cfg80211_rdev_by_wiphy_idx(
 121                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 122
 123         if (attrs[NL80211_ATTR_WDEV]) {
 124                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 125                 struct wireless_dev *wdev;
 126                 bool found = false;
 127
 128                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 129                 if (tmp) {
 130                         /* make sure wdev exists */
 131                         mutex_lock(&tmp->devlist_mtx);
 132                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 133                                 if (wdev->identifier != (u32)wdev_id)
 134                                         continue;
 135                                 found = true;
 136                                 break;
 137                         }
 138                         mutex_unlock(&tmp->devlist_mtx);
 139
 140                         if (!found)
 141                                 tmp = NULL;
 142
 143                         if (rdev && tmp != rdev)
 144                                 return ERR_PTR(-EINVAL);
 145                         rdev = tmp;
 146                 }
 147         }
 148
 149         if (attrs[NL80211_ATTR_IFINDEX]) {
 150                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 151                 netdev = dev_get_by_index(netns, ifindex);
 152                 if (netdev) {
 153                         if (netdev->ieee80211_ptr)
 154                                 tmp = wiphy_to_dev(
 155                                                 netdev->ieee80211_ptr->wiphy);
 156                         else
 157                                 tmp = NULL;
 158
 159                         dev_put(netdev);
 160
 161                         /* not wireless device -- return error */
 162                         if (!tmp)
 163                                 return ERR_PTR(-EINVAL);
 164
 165                         /* mismatch -- return error */
 166                         if (rdev && tmp != rdev)
 167                                 return ERR_PTR(-EINVAL);
 168
 169                         rdev = tmp;
 170                 }
 171         }
 172
 173         if (!rdev)
 174                 return ERR_PTR(-ENODEV);
 175
 176         if (netns != wiphy_net(&rdev->wiphy))
 177                 return ERR_PTR(-ENODEV);
 178
 179         return rdev;
 180 }
 181
 182 /*
 183  * This function returns a pointer to the driver
 184  * that the genl_info item that is passed refers to.
 185  * If successful, it returns non-NULL and also locks
 186  * the driver's mutex!
 187  *
 188  * This means that you need to call cfg80211_unlock_rdev()
 189  * before being allowed to acquire &cfg80211_mutex!
 190  *
 191  * This is necessary because we need to lock the global
 192  * mutex to get an item off the list safely, and then
 193  * we lock the rdev mutex so it doesn't go away under us.
 194  *
 195  * We don't want to keep cfg80211_mutex locked
 196  * for all the time in order to allow requests on
 197  * other interfaces to go through at the same time.
 198  *
 199  * The result of this can be a PTR_ERR and hence must
 200  * be checked with IS_ERR() for errors.
 201  */
 202 static struct cfg80211_registered_device *
 203 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 204 {
 205         struct cfg80211_registered_device *rdev;
 206
 207         mutex_lock(&cfg80211_mutex);
 208         rdev = __cfg80211_rdev_from_attrs(netns, info->attrs);
 209
 210         /* if it is not an error we grab the lock on
 211          * it to assure it won't be going away while
 212          * we operate on it */
 213         if (!IS_ERR(rdev))
 214                 mutex_lock(&rdev->mtx);
 215
 216         mutex_unlock(&cfg80211_mutex);
 217
 218         return rdev;
 219 }
 220
 221 /* policy for the attributes */
 222 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
 223         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 224         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 225                                       .len = 20-1 },
 226         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 227
 228         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 229         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 230         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 231         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 232         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 233
 234         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 235         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 236         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 237         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 238         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 239
 240         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 241         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 242         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 243
 244         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 245         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 246
 247         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 248         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 249                                     .len = WLAN_MAX_KEY_LEN },
 250         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 251         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 252         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 253         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 254         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 255
 256         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 257         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 258         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 259                                        .len = IEEE80211_MAX_DATA_LEN },
 260         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 261                                        .len = IEEE80211_MAX_DATA_LEN },
 262         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 263         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 264         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 265         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 266                                                .len = NL80211_MAX_SUPP_RATES },
 267         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 268         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 269         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 270         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 271                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 272         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 273
 274         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 275         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 276
 277         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 278         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 279         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 280         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 281                                            .len = NL80211_MAX_SUPP_RATES },
 282         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 283
 284         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 285         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 286
 287         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 288
 289         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 290         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 291                               .len = IEEE80211_MAX_DATA_LEN },
 292         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 293         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 294
 295         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 296                                 .len = IEEE80211_MAX_SSID_LEN },
 297         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 298         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 299         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 300         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 301         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 302         [NL80211_ATTR_STA_FLAGS2] = {
 303                 .len = sizeof(struct nl80211_sta_flag_update),
 304         },
 305         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 306         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 307         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 308         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 309         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 310         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 311         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 312         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 313         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 314                                  .len = WLAN_PMKID_LEN },
 315         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 316         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 317         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 318         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 319                                  .len = IEEE80211_MAX_DATA_LEN },
 320         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 321         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 322         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 323         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 324         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 325         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 326         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 327         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 328         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 329         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 330         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 331         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 332         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 333         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 334         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 335         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 336         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 337         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 338         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 339         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 340                                          .len = IEEE80211_MAX_DATA_LEN },
 341         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 342                                          .len = IEEE80211_MAX_DATA_LEN },
 343         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 344         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 345         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 346         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 347         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 348         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 349         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 350         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 351         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 352         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 353                                       .len = IEEE80211_MAX_DATA_LEN },
 354         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 355         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 356         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 357                 .len = NL80211_HT_CAPABILITY_LEN
 358         },
 359         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 360         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 361         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 362         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 363         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 364         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 365         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 366         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 367         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 368         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 369         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 370         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 371         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 372         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 373         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 374 };
 375
 376 /* policy for the key attributes */
 377 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 378         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 379         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 380         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 381         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 382         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 383         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 384         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 385         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 386 };
 387
 388 /* policy for the key default flags */
 389 static const struct nla_policy
 390 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 391         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 392         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 393 };
 394
 395 /* policy for WoWLAN attributes */
 396 static const struct nla_policy
 397 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 398         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 399         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 400         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 401         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 402         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 403         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 404         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 405         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 406         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 407 };
 408
 409 static const struct nla_policy
 410 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 411         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 412         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 413         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 414         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 415         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 416         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 417         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 418                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 419         },
 420         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 421                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 422         },
 423         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 424         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 425         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 426 };
 427
 428 /* policy for GTK rekey offload attributes */
 429 static const struct nla_policy
 430 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 431         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 432         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 433         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 434 };
 435
 436 static const struct nla_policy
 437 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 438         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 439                                                  .len = IEEE80211_MAX_SSID_LEN },
 440         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 441 };
 442
 443 /* ifidx get helper */
 444 static int nl80211_get_ifidx(struct netlink_callback *cb)
 445 {
 446         int res;
 447
 448         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 449                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 450                           nl80211_policy);
 451         if (res)
 452                 return res;
 453
 454         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 455                 return -EINVAL;
 456
 457         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 458         if (!res)
 459                 return -EINVAL;
 460         return res;
 461 }
 462
 463 static int nl80211_prepare_netdev_dump(struct sk_buff *skb,
 464                                        struct netlink_callback *cb,
 465                                        struct cfg80211_registered_device **rdev,
 466                                        struct net_device **dev)
 467 {
 468         int ifidx = cb->args[0];
 469         int err;
 470
 471         if (!ifidx)
 472                 ifidx = nl80211_get_ifidx(cb);
 473         if (ifidx < 0)
 474                 return ifidx;
 475
 476         cb->args[0] = ifidx;
 477
 478         rtnl_lock();
 479
 480         *dev = __dev_get_by_index(sock_net(skb->sk), ifidx);
 481         if (!*dev) {
 482                 err = -ENODEV;
 483                 goto out_rtnl;
 484         }
 485
 486         *rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
 487         if (IS_ERR(*rdev)) {
 488                 err = PTR_ERR(*rdev);
 489                 goto out_rtnl;
 490         }
 491
 492         return 0;
 493  out_rtnl:
 494         rtnl_unlock();
 495         return err;
 496 }
 497
 498 static void nl80211_finish_netdev_dump(struct cfg80211_registered_device *rdev)
 499 {
 500         cfg80211_unlock_rdev(rdev);
 501         rtnl_unlock();
 502 }
 503
 504 /* IE validation */
 505 static bool is_valid_ie_attr(const struct nlattr *attr)
 506 {
 507         const u8 *pos;
 508         int len;
 509
 510         if (!attr)
 511                 return true;
 512
 513         pos = nla_data(attr);
 514         len = nla_len(attr);
 515
 516         while (len) {
 517                 u8 elemlen;
 518
 519                 if (len < 2)
 520                         return false;
 521                 len -= 2;
 522
 523                 elemlen = pos[1];
 524                 if (elemlen > len)
 525                         return false;
 526
 527                 len -= elemlen;
 528                 pos += 2 + elemlen;
 529         }
 530
 531         return true;
 532 }
 533
 534 /* message building helper */
 535 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 536                                    int flags, u8 cmd)
 537 {
 538         /* since there is no private header just add the generic one */
 539         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 540 }
 541
 542 static int nl80211_msg_put_channel(struct sk_buff *msg,
 543                                    struct ieee80211_channel *chan,
 544                                    bool large)
 545 {
 546         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 547                         chan->center_freq))
 548                 goto nla_put_failure;
 549
 550         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 551             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 552                 goto nla_put_failure;
 553         if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
 554             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN))
 555                 goto nla_put_failure;
 556         if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
 557             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IBSS))
 558                 goto nla_put_failure;
 559         if (chan->flags & IEEE80211_CHAN_RADAR) {
 560                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 561                         goto nla_put_failure;
 562                 if (large) {
 563                         u32 time;
 564
 565                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 566
 567                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 568                                         chan->dfs_state))
 569                                 goto nla_put_failure;
 570                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 571                                         time))
 572                                 goto nla_put_failure;
 573                 }
 574         }
 575
 576         if (large) {
 577                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 578                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 579                         goto nla_put_failure;
 580                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 581                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 582                         goto nla_put_failure;
 583                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 584                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 585                         goto nla_put_failure;
 586                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 587                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 588                         goto nla_put_failure;
 589         }
 590
 591         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 592                         DBM_TO_MBM(chan->max_power)))
 593                 goto nla_put_failure;
 594
 595         return 0;
 596
 597  nla_put_failure:
 598         return -ENOBUFS;
 599 }
 600
 601 /* netlink command implementations */
 602
 603 struct key_parse {
 604         struct key_params p;
 605         int idx;
 606         int type;
 607         bool def, defmgmt;
 608         bool def_uni, def_multi;
 609 };
 610
 611 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 612 {
 613         struct nlattr *tb[NL80211_KEY_MAX + 1];
 614         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 615                                    nl80211_key_policy);
 616         if (err)
 617                 return err;
 618
 619         k->def = !!tb[NL80211_KEY_DEFAULT];
 620         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 621
 622         if (k->def) {
 623                 k->def_uni = true;
 624                 k->def_multi = true;
 625         }
 626         if (k->defmgmt)
 627                 k->def_multi = true;
 628
 629         if (tb[NL80211_KEY_IDX])
 630                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 631
 632         if (tb[NL80211_KEY_DATA]) {
 633                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 634                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 635         }
 636
 637         if (tb[NL80211_KEY_SEQ]) {
 638                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 639                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 640         }
 641
 642         if (tb[NL80211_KEY_CIPHER])
 643                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 644
 645         if (tb[NL80211_KEY_TYPE]) {
 646                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 647                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 648                         return -EINVAL;
 649         }
 650
 651         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 652                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 653                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 654                                        tb[NL80211_KEY_DEFAULT_TYPES],
 655                                        nl80211_key_default_policy);
 656                 if (err)
 657                         return err;
 658
 659                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 660                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 661         }
 662
 663         return 0;
 664 }
 665
 666 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 667 {
 668         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 669                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 670                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 671         }
 672
 673         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 674                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 675                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 676         }
 677
 678         if (info->attrs[NL80211_ATTR_KEY_IDX])
 679                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 680
 681         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 682                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 683
 684         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 685         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 686
 687         if (k->def) {
 688                 k->def_uni = true;
 689                 k->def_multi = true;
 690         }
 691         if (k->defmgmt)
 692                 k->def_multi = true;
 693
 694         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 695                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 696                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 697                         return -EINVAL;
 698         }
 699
 700         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 701                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 702                 int err = nla_parse_nested(
 703                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 704                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 705                                 nl80211_key_default_policy);
 706                 if (err)
 707                         return err;
 708
 709                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 710                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 711         }
 712
 713         return 0;
 714 }
 715
 716 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 717 {
 718         int err;
 719
 720         memset(k, 0, sizeof(*k));
 721         k->idx = -1;
 722         k->type = -1;
 723
 724         if (info->attrs[NL80211_ATTR_KEY])
 725                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 726         else
 727                 err = nl80211_parse_key_old(info, k);
 728
 729         if (err)
 730                 return err;
 731
 732         if (k->def && k->defmgmt)
 733                 return -EINVAL;
 734
 735         if (k->defmgmt) {
 736                 if (k->def_uni || !k->def_multi)
 737                         return -EINVAL;
 738         }
 739
 740         if (k->idx != -1) {
 741                 if (k->defmgmt) {
 742                         if (k->idx < 4 || k->idx > 5)
 743                                 return -EINVAL;
 744                 } else if (k->def) {
 745                         if (k->idx < 0 || k->idx > 3)
 746                                 return -EINVAL;
 747                 } else {
 748                         if (k->idx < 0 || k->idx > 5)
 749                                 return -EINVAL;
 750                 }
 751         }
 752
 753         return 0;
 754 }
 755
 756 static struct cfg80211_cached_keys *
 757 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 758                        struct nlattr *keys, bool *no_ht)
 759 {
 760         struct key_parse parse;
 761         struct nlattr *key;
 762         struct cfg80211_cached_keys *result;
 763         int rem, err, def = 0;
 764
 765         result = kzalloc(sizeof(*result), GFP_KERNEL);
 766         if (!result)
 767                 return ERR_PTR(-ENOMEM);
 768
 769         result->def = -1;
 770         result->defmgmt = -1;
 771
 772         nla_for_each_nested(key, keys, rem) {
 773                 memset(&parse, 0, sizeof(parse));
 774                 parse.idx = -1;
 775
 776                 err = nl80211_parse_key_new(key, &parse);
 777                 if (err)
 778                         goto error;
 779                 err = -EINVAL;
 780                 if (!parse.p.key)
 781                         goto error;
 782                 if (parse.idx < 0 || parse.idx > 4)
 783                         goto error;
 784                 if (parse.def) {
 785                         if (def)
 786                                 goto error;
 787                         def = 1;
 788                         result->def = parse.idx;
 789                         if (!parse.def_uni || !parse.def_multi)
 790                                 goto error;
 791                 } else if (parse.defmgmt)
 792                         goto error;
 793                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 794                                                      parse.idx, false, NULL);
 795                 if (err)
 796                         goto error;
 797                 result->params[parse.idx].cipher = parse.p.cipher;
 798                 result->params[parse.idx].key_len = parse.p.key_len;
 799                 result->params[parse.idx].key = result->data[parse.idx];
 800                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 801
 802                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 803                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 804                         if (no_ht)
 805                                 *no_ht = true;
 806                 }
 807         }
 808
 809         return result;
 810  error:
 811         kfree(result);
 812         return ERR_PTR(err);
 813 }
 814
 815 static int nl80211_key_allowed(struct wireless_dev *wdev)
 816 {
 817         ASSERT_WDEV_LOCK(wdev);
 818
 819         switch (wdev->iftype) {
 820         case NL80211_IFTYPE_AP:
 821         case NL80211_IFTYPE_AP_VLAN:
 822         case NL80211_IFTYPE_P2P_GO:
 823         case NL80211_IFTYPE_MESH_POINT:
 824                 break;
 825         case NL80211_IFTYPE_ADHOC:
 826                 if (!wdev->current_bss)
 827                         return -ENOLINK;
 828                 break;
 829         case NL80211_IFTYPE_STATION:
 830         case NL80211_IFTYPE_P2P_CLIENT:
 831                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 832                         return -ENOLINK;
 833                 break;
 834         default:
 835                 return -EINVAL;
 836         }
 837
 838         return 0;
 839 }
 840
 841 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 842 {
 843         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 844         int i;
 845
 846         if (!nl_modes)
 847                 goto nla_put_failure;
 848
 849         i = 0;
 850         while (ifmodes) {
 851                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 852                         goto nla_put_failure;
 853                 ifmodes >>= 1;
 854                 i++;
 855         }
 856
 857         nla_nest_end(msg, nl_modes);
 858         return 0;
 859
 860 nla_put_failure:
 861         return -ENOBUFS;
 862 }
 863
 864 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 865                                           struct sk_buff *msg,
 866                                           bool large)
 867 {
 868         struct nlattr *nl_combis;
 869         int i, j;
 870
 871         nl_combis = nla_nest_start(msg,
 872                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 873         if (!nl_combis)
 874                 goto nla_put_failure;
 875
 876         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 877                 const struct ieee80211_iface_combination *c;
 878                 struct nlattr *nl_combi, *nl_limits;
 879
 880                 c = &wiphy->iface_combinations[i];
 881
 882                 nl_combi = nla_nest_start(msg, i + 1);
 883                 if (!nl_combi)
 884                         goto nla_put_failure;
 885
 886                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 887                 if (!nl_limits)
 888                         goto nla_put_failure;
 889
 890                 for (j = 0; j < c->n_limits; j++) {
 891                         struct nlattr *nl_limit;
 892
 893                         nl_limit = nla_nest_start(msg, j + 1);
 894                         if (!nl_limit)
 895                                 goto nla_put_failure;
 896                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 897                                         c->limits[j].max))
 898                                 goto nla_put_failure;
 899                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 900                                                 c->limits[j].types))
 901                                 goto nla_put_failure;
 902                         nla_nest_end(msg, nl_limit);
 903                 }
 904
 905                 nla_nest_end(msg, nl_limits);
 906
 907                 if (c->beacon_int_infra_match &&
 908                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 909                         goto nla_put_failure;
 910                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 911                                 c->num_different_channels) ||
 912                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 913                                 c->max_interfaces))
 914                         goto nla_put_failure;
 915                 if (large &&
 916                     nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
 917                                 c->radar_detect_widths))
 918                         goto nla_put_failure;
 919
 920                 nla_nest_end(msg, nl_combi);
 921         }
 922
 923         nla_nest_end(msg, nl_combis);
 924
 925         return 0;
 926 nla_put_failure:
 927         return -ENOBUFS;
 928 }
 929
 930 #ifdef CONFIG_PM
 931 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
 932                                         struct sk_buff *msg)
 933 {
 934         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan.tcp;
 935         struct nlattr *nl_tcp;
 936
 937         if (!tcp)
 938                 return 0;
 939
 940         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
 941         if (!nl_tcp)
 942                 return -ENOBUFS;
 943
 944         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 945                         tcp->data_payload_max))
 946                 return -ENOBUFS;
 947
 948         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 949                         tcp->data_payload_max))
 950                 return -ENOBUFS;
 951
 952         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
 953                 return -ENOBUFS;
 954
 955         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
 956                                 sizeof(*tcp->tok), tcp->tok))
 957                 return -ENOBUFS;
 958
 959         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
 960                         tcp->data_interval_max))
 961                 return -ENOBUFS;
 962
 963         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
 964                         tcp->wake_payload_max))
 965                 return -ENOBUFS;
 966
 967         nla_nest_end(msg, nl_tcp);
 968         return 0;
 969 }
 970
 971 static int nl80211_send_wowlan(struct sk_buff *msg,
 972                                struct cfg80211_registered_device *dev,
 973                                bool large)
 974 {
 975         struct nlattr *nl_wowlan;
 976
 977         if (!dev->wiphy.wowlan.flags && !dev->wiphy.wowlan.n_patterns)
 978                 return 0;
 979
 980         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
 981         if (!nl_wowlan)
 982                 return -ENOBUFS;
 983
 984         if (((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY) &&
 985              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
 986             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT) &&
 987              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
 988             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT) &&
 989              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
 990             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
 991              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
 992             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
 993              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
 994             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
 995              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
 996             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
 997              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
 998             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
 999              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1000                 return -ENOBUFS;
1001
1002         if (dev->wiphy.wowlan.n_patterns) {
1003                 struct nl80211_wowlan_pattern_support pat = {
1004                         .max_patterns = dev->wiphy.wowlan.n_patterns,
1005                         .min_pattern_len = dev->wiphy.wowlan.pattern_min_len,
1006                         .max_pattern_len = dev->wiphy.wowlan.pattern_max_len,
1007                         .max_pkt_offset = dev->wiphy.wowlan.max_pkt_offset,
1008                 };
1009
1010                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1011                             sizeof(pat), &pat))
1012                         return -ENOBUFS;
1013         }
1014
1015         if (large && nl80211_send_wowlan_tcp_caps(dev, msg))
1016                 return -ENOBUFS;
1017
1018         nla_nest_end(msg, nl_wowlan);
1019
1020         return 0;
1021 }
1022 #endif
1023
1024 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1025                                       struct ieee80211_supported_band *sband)
1026 {
1027         struct nlattr *nl_rates, *nl_rate;
1028         struct ieee80211_rate *rate;
1029         int i;
1030
1031         /* add HT info */
1032         if (sband->ht_cap.ht_supported &&
1033             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1034                      sizeof(sband->ht_cap.mcs),
1035                      &sband->ht_cap.mcs) ||
1036              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1037                          sband->ht_cap.cap) ||
1038              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1039                         sband->ht_cap.ampdu_factor) ||
1040              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1041                         sband->ht_cap.ampdu_density)))
1042                 return -ENOBUFS;
1043
1044         /* add VHT info */
1045         if (sband->vht_cap.vht_supported &&
1046             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1047                      sizeof(sband->vht_cap.vht_mcs),
1048                      &sband->vht_cap.vht_mcs) ||
1049              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1050                          sband->vht_cap.cap)))
1051                 return -ENOBUFS;
1052
1053         /* add bitrates */
1054         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1055         if (!nl_rates)
1056                 return -ENOBUFS;
1057
1058         for (i = 0; i < sband->n_bitrates; i++) {
1059                 nl_rate = nla_nest_start(msg, i);
1060                 if (!nl_rate)
1061                         return -ENOBUFS;
1062
1063                 rate = &sband->bitrates[i];
1064                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1065                                 rate->bitrate))
1066                         return -ENOBUFS;
1067                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1068                     nla_put_flag(msg,
1069                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1070                         return -ENOBUFS;
1071
1072                 nla_nest_end(msg, nl_rate);
1073         }
1074
1075         nla_nest_end(msg, nl_rates);
1076
1077         return 0;
1078 }
1079
1080 static int
1081 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1082                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1083 {
1084         u16 stypes;
1085         struct nlattr *nl_ftypes, *nl_ifs;
1086         enum nl80211_iftype ift;
1087         int i;
1088
1089         if (!mgmt_stypes)
1090                 return 0;
1091
1092         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1093         if (!nl_ifs)
1094                 return -ENOBUFS;
1095
1096         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1097                 nl_ftypes = nla_nest_start(msg, ift);
1098                 if (!nl_ftypes)
1099                         return -ENOBUFS;
1100                 i = 0;
1101                 stypes = mgmt_stypes[ift].tx;
1102                 while (stypes) {
1103                         if ((stypes & 1) &&
1104                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1105                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1106                                 return -ENOBUFS;
1107                         stypes >>= 1;
1108                         i++;
1109                 }
1110                 nla_nest_end(msg, nl_ftypes);
1111         }
1112
1113         nla_nest_end(msg, nl_ifs);
1114
1115         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1116         if (!nl_ifs)
1117                 return -ENOBUFS;
1118
1119         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1120                 nl_ftypes = nla_nest_start(msg, ift);
1121                 if (!nl_ftypes)
1122                         return -ENOBUFS;
1123                 i = 0;
1124                 stypes = mgmt_stypes[ift].rx;
1125                 while (stypes) {
1126                         if ((stypes & 1) &&
1127                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1128                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1129                                 return -ENOBUFS;
1130                         stypes >>= 1;
1131                         i++;
1132                 }
1133                 nla_nest_end(msg, nl_ftypes);
1134         }
1135         nla_nest_end(msg, nl_ifs);
1136
1137         return 0;
1138 }
1139
1140 static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
1141                               struct sk_buff *msg, u32 portid, u32 seq,
1142                               int flags, bool split, long *split_start,
1143                               long *band_start, long *chan_start)
1144 {
1145         void *hdr;
1146         struct nlattr *nl_bands, *nl_band;
1147         struct nlattr *nl_freqs, *nl_freq;
1148         struct nlattr *nl_cmds;
1149         enum ieee80211_band band;
1150         struct ieee80211_channel *chan;
1151         int i;
1152         const struct ieee80211_txrx_stypes *mgmt_stypes =
1153                                 dev->wiphy.mgmt_stypes;
1154         long start = 0, start_chan = 0, start_band = 0;
1155         u32 features;
1156
1157         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
1158         if (!hdr)
1159                 return -ENOBUFS;
1160
1161         /* allow always using the variables */
1162         if (!split) {
1163                 split_start = &start;
1164                 band_start = &start_band;
1165                 chan_start = &start_chan;
1166         }
1167
1168         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
1169             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1170                            wiphy_name(&dev->wiphy)) ||
1171             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1172                         cfg80211_rdev_list_generation))
1173                 goto nla_put_failure;
1174
1175         switch (*split_start) {
1176         case 0:
1177                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1178                                dev->wiphy.retry_short) ||
1179                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1180                                dev->wiphy.retry_long) ||
1181                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1182                                 dev->wiphy.frag_threshold) ||
1183                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1184                                 dev->wiphy.rts_threshold) ||
1185                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1186                                dev->wiphy.coverage_class) ||
1187                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1188                                dev->wiphy.max_scan_ssids) ||
1189                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1190                                dev->wiphy.max_sched_scan_ssids) ||
1191                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1192                                 dev->wiphy.max_scan_ie_len) ||
1193                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1194                                 dev->wiphy.max_sched_scan_ie_len) ||
1195                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1196                                dev->wiphy.max_match_sets))
1197                         goto nla_put_failure;
1198
1199                 if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1200                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1201                         goto nla_put_failure;
1202                 if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1203                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1204                         goto nla_put_failure;
1205                 if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1206                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1207                         goto nla_put_failure;
1208                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1209                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1210                         goto nla_put_failure;
1211                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1212                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1213                         goto nla_put_failure;
1214                 if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1215                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1216                         goto nla_put_failure;
1217
1218                 (*split_start)++;
1219                 if (split)
1220                         break;
1221         case 1:
1222                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1223                             sizeof(u32) * dev->wiphy.n_cipher_suites,
1224                             dev->wiphy.cipher_suites))
1225                         goto nla_put_failure;
1226
1227                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1228                                dev->wiphy.max_num_pmkids))
1229                         goto nla_put_failure;
1230
1231                 if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1232                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1233                         goto nla_put_failure;
1234
1235                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1236                                 dev->wiphy.available_antennas_tx) ||
1237                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1238                                 dev->wiphy.available_antennas_rx))
1239                         goto nla_put_failure;
1240
1241                 if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1242                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1243                                 dev->wiphy.probe_resp_offload))
1244                         goto nla_put_failure;
1245
1246                 if ((dev->wiphy.available_antennas_tx ||
1247                      dev->wiphy.available_antennas_rx) &&
1248                     dev->ops->get_antenna) {
1249                         u32 tx_ant = 0, rx_ant = 0;
1250                         int res;
1251                         res = rdev_get_antenna(dev, &tx_ant, &rx_ant);
1252                         if (!res) {
1253                                 if (nla_put_u32(msg,
1254                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1255                                                 tx_ant) ||
1256                                     nla_put_u32(msg,
1257                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1258                                                 rx_ant))
1259                                         goto nla_put_failure;
1260                         }
1261                 }
1262
1263                 (*split_start)++;
1264                 if (split)
1265                         break;
1266         case 2:
1267                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1268                                         dev->wiphy.interface_modes))
1269                                 goto nla_put_failure;
1270                 (*split_start)++;
1271                 if (split)
1272                         break;
1273         case 3:
1274                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1275                 if (!nl_bands)
1276                         goto nla_put_failure;
1277
1278                 for (band = *band_start; band < IEEE80211_NUM_BANDS; band++) {
1279                         struct ieee80211_supported_band *sband;
1280
1281                         sband = dev->wiphy.bands[band];
1282
1283                         if (!sband)
1284                                 continue;
1285
1286                         nl_band = nla_nest_start(msg, band);
1287                         if (!nl_band)
1288                                 goto nla_put_failure;
1289
1290                         switch (*chan_start) {
1291                         case 0:
1292                                 if (nl80211_send_band_rateinfo(msg, sband))
1293                                         goto nla_put_failure;
1294                                 (*chan_start)++;
1295                                 if (split)
1296                                         break;
1297                         default:
1298                                 /* add frequencies */
1299                                 nl_freqs = nla_nest_start(
1300                                         msg, NL80211_BAND_ATTR_FREQS);
1301                                 if (!nl_freqs)
1302                                         goto nla_put_failure;
1303
1304                                 for (i = *chan_start - 1;
1305                                      i < sband->n_channels;
1306                                      i++) {
1307                                         nl_freq = nla_nest_start(msg, i);
1308                                         if (!nl_freq)
1309                                                 goto nla_put_failure;
1310
1311                                         chan = &sband->channels[i];
1312
1313                                         if (nl80211_msg_put_channel(msg, chan,
1314                                                                     split))
1315                                                 goto nla_put_failure;
1316
1317                                         nla_nest_end(msg, nl_freq);
1318                                         if (split)
1319                                                 break;
1320                                 }
1321                                 if (i < sband->n_channels)
1322                                         *chan_start = i + 2;
1323                                 else
1324                                         *chan_start = 0;
1325                                 nla_nest_end(msg, nl_freqs);
1326                         }
1327
1328                         nla_nest_end(msg, nl_band);
1329
1330                         if (split) {
1331                                 /* start again here */
1332                                 if (*chan_start)
1333                                         band--;
1334                                 break;
1335                         }
1336                 }
1337                 nla_nest_end(msg, nl_bands);
1338
1339                 if (band < IEEE80211_NUM_BANDS)
1340                         *band_start = band + 1;
1341                 else
1342                         *band_start = 0;
1343
1344                 /* if bands & channels are done, continue outside */
1345                 if (*band_start == 0 && *chan_start == 0)
1346                         (*split_start)++;
1347                 if (split)
1348                         break;
1349         case 4:
1350                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1351                 if (!nl_cmds)
1352                         goto nla_put_failure;
1353
1354                 i = 0;
1355 #define CMD(op, n)                                                      \
1356                  do {                                                   \
1357                         if (dev->ops->op) {                             \
1358                                 i++;                                    \
1359                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1360                                         goto nla_put_failure;           \
1361                         }                                               \
1362                 } while (0)
1363
1364                 CMD(add_virtual_intf, NEW_INTERFACE);
1365                 CMD(change_virtual_intf, SET_INTERFACE);
1366                 CMD(add_key, NEW_KEY);
1367                 CMD(start_ap, START_AP);
1368                 CMD(add_station, NEW_STATION);
1369                 CMD(add_mpath, NEW_MPATH);
1370                 CMD(update_mesh_config, SET_MESH_CONFIG);
1371                 CMD(change_bss, SET_BSS);
1372                 CMD(auth, AUTHENTICATE);
1373                 CMD(assoc, ASSOCIATE);
1374                 CMD(deauth, DEAUTHENTICATE);
1375                 CMD(disassoc, DISASSOCIATE);
1376                 CMD(join_ibss, JOIN_IBSS);
1377                 CMD(join_mesh, JOIN_MESH);
1378                 CMD(set_pmksa, SET_PMKSA);
1379                 CMD(del_pmksa, DEL_PMKSA);
1380                 CMD(flush_pmksa, FLUSH_PMKSA);
1381                 if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1382                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1383                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1384                 CMD(mgmt_tx, FRAME);
1385                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1386                 if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1387                         i++;
1388                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1389                                 goto nla_put_failure;
1390                 }
1391                 if (dev->ops->set_monitor_channel || dev->ops->start_ap ||
1392                     dev->ops->join_mesh) {
1393                         i++;
1394                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1395                                 goto nla_put_failure;
1396                 }
1397                 CMD(set_wds_peer, SET_WDS_PEER);
1398                 if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1399                         CMD(tdls_mgmt, TDLS_MGMT);
1400                         CMD(tdls_oper, TDLS_OPER);
1401                 }
1402                 if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1403                         CMD(sched_scan_start, START_SCHED_SCAN);
1404                 CMD(probe_client, PROBE_CLIENT);
1405                 CMD(set_noack_map, SET_NOACK_MAP);
1406                 if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1407                         i++;
1408                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1409                                 goto nla_put_failure;
1410                 }
1411                 CMD(start_p2p_device, START_P2P_DEVICE);
1412                 CMD(set_mcast_rate, SET_MCAST_RATE);
1413
1414 #ifdef CONFIG_NL80211_TESTMODE
1415                 CMD(testmode_cmd, TESTMODE);
1416 #endif
1417
1418 #undef CMD
1419
1420                 if (dev->ops->connect || dev->ops->auth) {
1421                         i++;
1422                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1423                                 goto nla_put_failure;
1424                 }
1425
1426                 if (dev->ops->disconnect || dev->ops->deauth) {
1427                         i++;
1428                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1429                                 goto nla_put_failure;
1430                 }
1431
1432                 nla_nest_end(msg, nl_cmds);
1433                 (*split_start)++;
1434                 if (split)
1435                         break;
1436         case 5:
1437                 if (dev->ops->remain_on_channel &&
1438                     (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1439                     nla_put_u32(msg,
1440                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1441                                 dev->wiphy.max_remain_on_channel_duration))
1442                         goto nla_put_failure;
1443
1444                 if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1445                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1446                         goto nla_put_failure;
1447
1448                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1449                         goto nla_put_failure;
1450                 (*split_start)++;
1451                 if (split)
1452                         break;
1453         case 6:
1454 #ifdef CONFIG_PM
1455                 if (nl80211_send_wowlan(msg, dev, split))
1456                         goto nla_put_failure;
1457                 (*split_start)++;
1458                 if (split)
1459                         break;
1460 #else
1461                 (*split_start)++;
1462 #endif
1463         case 7:
1464                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1465                                         dev->wiphy.software_iftypes))
1466                         goto nla_put_failure;
1467
1468                 if (nl80211_put_iface_combinations(&dev->wiphy, msg, split))
1469                         goto nla_put_failure;
1470
1471                 (*split_start)++;
1472                 if (split)
1473                         break;
1474         case 8:
1475                 if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1476                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1477                                 dev->wiphy.ap_sme_capa))
1478                         goto nla_put_failure;
1479
1480                 features = dev->wiphy.features;
1481                 /*
1482                  * We can only add the per-channel limit information if the
1483                  * dump is split, otherwise it makes it too big. Therefore
1484                  * only advertise it in that case.
1485                  */
1486                 if (split)
1487                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1488                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1489                         goto nla_put_failure;
1490
1491                 if (dev->wiphy.ht_capa_mod_mask &&
1492                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1493                             sizeof(*dev->wiphy.ht_capa_mod_mask),
1494                             dev->wiphy.ht_capa_mod_mask))
1495                         goto nla_put_failure;
1496
1497                 if (dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1498                     dev->wiphy.max_acl_mac_addrs &&
1499                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1500                                 dev->wiphy.max_acl_mac_addrs))
1501                         goto nla_put_failure;
1502
1503                 /*
1504                  * Any information below this point is only available to
1505                  * applications that can deal with it being split. This
1506                  * helps ensure that newly added capabilities don't break
1507                  * older tools by overrunning their buffers.
1508                  *
1509                  * We still increment split_start so that in the split
1510                  * case we'll continue with more data in the next round,
1511                  * but break unconditionally so unsplit data stops here.
1512                  */
1513                 (*split_start)++;
1514                 break;
1515         case 9:
1516                 if (dev->wiphy.extended_capabilities &&
1517                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1518                              dev->wiphy.extended_capabilities_len,
1519                              dev->wiphy.extended_capabilities) ||
1520                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1521                              dev->wiphy.extended_capabilities_len,
1522                              dev->wiphy.extended_capabilities_mask)))
1523                         goto nla_put_failure;
1524
1525                 /* done */
1526                 *split_start = 0;
1527                 break;
1528         }
1529         return genlmsg_end(msg, hdr);
1530
1531  nla_put_failure:
1532         genlmsg_cancel(msg, hdr);
1533         return -EMSGSIZE;
1534 }
1535
1536 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1537 {
1538         int idx = 0, ret;
1539         int start = cb->args[0];
1540         struct cfg80211_registered_device *dev;
1541         s64 filter_wiphy = -1;
1542         bool split = false;
1543         struct nlattr **tb = nl80211_fam.attrbuf;
1544         int res;
1545
1546         mutex_lock(&cfg80211_mutex);
1547         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1548                           tb, nl80211_fam.maxattr, nl80211_policy);
1549         if (res == 0) {
1550                 split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1551                 if (tb[NL80211_ATTR_WIPHY])
1552                         filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1553                 if (tb[NL80211_ATTR_WDEV])
1554                         filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1555                 if (tb[NL80211_ATTR_IFINDEX]) {
1556                         struct net_device *netdev;
1557                         int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1558
1559                         netdev = dev_get_by_index(sock_net(skb->sk), ifidx);
1560                         if (!netdev) {
1561                                 mutex_unlock(&cfg80211_mutex);
1562                                 return -ENODEV;
1563                         }
1564                         if (netdev->ieee80211_ptr) {
1565                                 dev = wiphy_to_dev(
1566                                         netdev->ieee80211_ptr->wiphy);
1567                                 filter_wiphy = dev->wiphy_idx;
1568                         }
1569                         dev_put(netdev);
1570                 }
1571         }
1572
1573         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1574                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1575                         continue;
1576                 if (++idx <= start)
1577                         continue;
1578                 if (filter_wiphy != -1 && dev->wiphy_idx != filter_wiphy)
1579                         continue;
1580                 /* attempt to fit multiple wiphy data chunks into the skb */
1581                 do {
1582                         ret = nl80211_send_wiphy(dev, skb,
1583                                                  NETLINK_CB(cb->skb).portid,
1584                                                  cb->nlh->nlmsg_seq,
1585                                                  NLM_F_MULTI,
1586                                                  split, &cb->args[1],
1587                                                  &cb->args[2],
1588                                                  &cb->args[3]);
1589                         if (ret < 0) {
1590                                 /*
1591                                  * If sending the wiphy data didn't fit (ENOBUFS
1592                                  * or EMSGSIZE returned), this SKB is still
1593                                  * empty (so it's not too big because another
1594                                  * wiphy dataset is already in the skb) and
1595                                  * we've not tried to adjust the dump allocation
1596                                  * yet ... then adjust the alloc size to be
1597                                  * bigger, and return 1 but with the empty skb.
1598                                  * This results in an empty message being RX'ed
1599                                  * in userspace, but that is ignored.
1600                                  *
1601                                  * We can then retry with the larger buffer.
1602                                  */
1603                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1604                                     !skb->len &&
1605                                     cb->min_dump_alloc < 4096) {
1606                                         cb->min_dump_alloc = 4096;
1607                                         mutex_unlock(&cfg80211_mutex);
1608                                         return 1;
1609                                 }
1610                                 idx--;
1611                                 break;
1612                         }
1613                 } while (cb->args[1] > 0);
1614                 break;
1615         }
1616         mutex_unlock(&cfg80211_mutex);
1617
1618         cb->args[0] = idx;
1619
1620         return skb->len;
1621 }
1622
1623 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1624 {
1625         struct sk_buff *msg;
1626         struct cfg80211_registered_device *dev = info->user_ptr[0];
1627
1628         msg = nlmsg_new(4096, GFP_KERNEL);
1629         if (!msg)
1630                 return -ENOMEM;
1631
1632         if (nl80211_send_wiphy(dev, msg, info->snd_portid, info->snd_seq, 0,
1633                                false, NULL, NULL, NULL) < 0) {
1634                 nlmsg_free(msg);
1635                 return -ENOBUFS;
1636         }
1637
1638         return genlmsg_reply(msg, info);
1639 }
1640
1641 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1642         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1643         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1644         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1645         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1646         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1647 };
1648
1649 static int parse_txq_params(struct nlattr *tb[],
1650                             struct ieee80211_txq_params *txq_params)
1651 {
1652         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1653             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1654             !tb[NL80211_TXQ_ATTR_AIFS])
1655                 return -EINVAL;
1656
1657         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1658         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1659         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1660         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1661         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1662
1663         if (txq_params->ac >= NL80211_NUM_ACS)
1664                 return -EINVAL;
1665
1666         return 0;
1667 }
1668
1669 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1670 {
1671         /*
1672          * You can only set the channel explicitly for WDS interfaces,
1673          * all others have their channel managed via their respective
1674          * "establish a connection" command (connect, join, ...)
1675          *
1676          * For AP/GO and mesh mode, the channel can be set with the
1677          * channel userspace API, but is only stored and passed to the
1678          * low-level driver when the AP starts or the mesh is joined.
1679          * This is for backward compatibility, userspace can also give
1680          * the channel in the start-ap or join-mesh commands instead.
1681          *
1682          * Monitors are special as they are normally slaved to
1683          * whatever else is going on, so they have their own special
1684          * operation to set the monitor channel if possible.
1685          */
1686         return !wdev ||
1687                 wdev->iftype == NL80211_IFTYPE_AP ||
1688                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1689                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1690                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1691 }
1692
1693 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1694                                  struct genl_info *info,
1695                                  struct cfg80211_chan_def *chandef)
1696 {
1697         u32 control_freq;
1698
1699         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1700                 return -EINVAL;
1701
1702         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1703
1704         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1705         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1706         chandef->center_freq1 = control_freq;
1707         chandef->center_freq2 = 0;
1708
1709         /* Primary channel not allowed */
1710         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1711                 return -EINVAL;
1712
1713         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1714                 enum nl80211_channel_type chantype;
1715
1716                 chantype = nla_get_u32(
1717                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1718
1719                 switch (chantype) {
1720                 case NL80211_CHAN_NO_HT:
1721                 case NL80211_CHAN_HT20:
1722                 case NL80211_CHAN_HT40PLUS:
1723                 case NL80211_CHAN_HT40MINUS:
1724                         cfg80211_chandef_create(chandef, chandef->chan,
1725                                                 chantype);
1726                         break;
1727                 default:
1728                         return -EINVAL;
1729                 }
1730         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1731                 chandef->width =
1732                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1733                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1734                         chandef->center_freq1 =
1735                                 nla_get_u32(
1736                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1737                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1738                         chandef->center_freq2 =
1739                                 nla_get_u32(
1740                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1741         }
1742
1743         if (!cfg80211_chandef_valid(chandef))
1744                 return -EINVAL;
1745
1746         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1747                                      IEEE80211_CHAN_DISABLED))
1748                 return -EINVAL;
1749
1750         return 0;
1751 }
1752
1753 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1754                                  struct wireless_dev *wdev,
1755                                  struct genl_info *info)
1756 {
1757         struct cfg80211_chan_def chandef;
1758         int result;
1759         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1760
1761         if (wdev)
1762                 iftype = wdev->iftype;
1763
1764         if (!nl80211_can_set_dev_channel(wdev))
1765                 return -EOPNOTSUPP;
1766
1767         result = nl80211_parse_chandef(rdev, info, &chandef);
1768         if (result)
1769                 return result;
1770
1771         mutex_lock(&rdev->devlist_mtx);
1772         switch (iftype) {
1773         case NL80211_IFTYPE_AP:
1774         case NL80211_IFTYPE_P2P_GO:
1775                 if (wdev->beacon_interval) {
1776                         result = -EBUSY;
1777                         break;
1778                 }
1779                 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef)) {
1780                         result = -EINVAL;
1781                         break;
1782                 }
1783                 wdev->preset_chandef = chandef;
1784                 result = 0;
1785                 break;
1786         case NL80211_IFTYPE_MESH_POINT:
1787                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
1788                 break;
1789         case NL80211_IFTYPE_MONITOR:
1790                 result = cfg80211_set_monitor_channel(rdev, &chandef);
1791                 break;
1792         default:
1793                 result = -EINVAL;
1794         }
1795         mutex_unlock(&rdev->devlist_mtx);
1796
1797         return result;
1798 }
1799
1800 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1801 {
1802         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1803         struct net_device *netdev = info->user_ptr[1];
1804
1805         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1806 }
1807
1808 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1809 {
1810         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1811         struct net_device *dev = info->user_ptr[1];
1812         struct wireless_dev *wdev = dev->ieee80211_ptr;
1813         const u8 *bssid;
1814
1815         if (!info->attrs[NL80211_ATTR_MAC])
1816                 return -EINVAL;
1817
1818         if (netif_running(dev))
1819                 return -EBUSY;
1820
1821         if (!rdev->ops->set_wds_peer)
1822                 return -EOPNOTSUPP;
1823
1824         if (wdev->iftype != NL80211_IFTYPE_WDS)
1825                 return -EOPNOTSUPP;
1826
1827         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1828         return rdev_set_wds_peer(rdev, dev, bssid);
1829 }
1830
1831
1832 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1833 {
1834         struct cfg80211_registered_device *rdev;
1835         struct net_device *netdev = NULL;
1836         struct wireless_dev *wdev;
1837         int result = 0, rem_txq_params = 0;
1838         struct nlattr *nl_txq_params;
1839         u32 changed;
1840         u8 retry_short = 0, retry_long = 0;
1841         u32 frag_threshold = 0, rts_threshold = 0;
1842         u8 coverage_class = 0;
1843
1844         /*
1845          * Try to find the wiphy and netdev. Normally this
1846          * function shouldn't need the netdev, but this is
1847          * done for backward compatibility -- previously
1848          * setting the channel was done per wiphy, but now
1849          * it is per netdev. Previous userland like hostapd
1850          * also passed a netdev to set_wiphy, so that it is
1851          * possible to let that go to the right netdev!
1852          */
1853         mutex_lock(&cfg80211_mutex);
1854
1855         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1856                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1857
1858                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1859                 if (netdev && netdev->ieee80211_ptr) {
1860                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1861                         mutex_lock(&rdev->mtx);
1862                 } else
1863                         netdev = NULL;
1864         }
1865
1866         if (!netdev) {
1867                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
1868                                                   info->attrs);
1869                 if (IS_ERR(rdev)) {
1870                         mutex_unlock(&cfg80211_mutex);
1871                         return PTR_ERR(rdev);
1872                 }
1873                 wdev = NULL;
1874                 netdev = NULL;
1875                 result = 0;
1876
1877                 mutex_lock(&rdev->mtx);
1878         } else
1879                 wdev = netdev->ieee80211_ptr;
1880
1881         /*
1882          * end workaround code, by now the rdev is available
1883          * and locked, and wdev may or may not be NULL.
1884          */
1885
1886         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1887                 result = cfg80211_dev_rename(
1888                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1889
1890         mutex_unlock(&cfg80211_mutex);
1891
1892         if (result)
1893                 goto bad_res;
1894
1895         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1896                 struct ieee80211_txq_params txq_params;
1897                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1898
1899                 if (!rdev->ops->set_txq_params) {
1900                         result = -EOPNOTSUPP;
1901                         goto bad_res;
1902                 }
1903
1904                 if (!netdev) {
1905                         result = -EINVAL;
1906                         goto bad_res;
1907                 }
1908
1909                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1910                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
1911                         result = -EINVAL;
1912                         goto bad_res;
1913                 }
1914
1915                 if (!netif_running(netdev)) {
1916                         result = -ENETDOWN;
1917                         goto bad_res;
1918                 }
1919
1920                 nla_for_each_nested(nl_txq_params,
1921                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1922                                     rem_txq_params) {
1923                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1924                                   nla_data(nl_txq_params),
1925                                   nla_len(nl_txq_params),
1926                                   txq_params_policy);
1927                         result = parse_txq_params(tb, &txq_params);
1928                         if (result)
1929                                 goto bad_res;
1930
1931                         result = rdev_set_txq_params(rdev, netdev,
1932                                                      &txq_params);
1933                         if (result)
1934                                 goto bad_res;
1935                 }
1936         }
1937
1938         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1939                 result = __nl80211_set_channel(rdev,
1940                                 nl80211_can_set_dev_channel(wdev) ? wdev : NULL,
1941                                 info);
1942                 if (result)
1943                         goto bad_res;
1944         }
1945
1946         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1947                 struct wireless_dev *txp_wdev = wdev;
1948                 enum nl80211_tx_power_setting type;
1949                 int idx, mbm = 0;
1950
1951                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
1952                         txp_wdev = NULL;
1953
1954                 if (!rdev->ops->set_tx_power) {
1955                         result = -EOPNOTSUPP;
1956                         goto bad_res;
1957                 }
1958
1959                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1960                 type = nla_get_u32(info->attrs[idx]);
1961
1962                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1963                     (type != NL80211_TX_POWER_AUTOMATIC)) {
1964                         result = -EINVAL;
1965                         goto bad_res;
1966                 }
1967
1968                 if (type != NL80211_TX_POWER_AUTOMATIC) {
1969                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1970                         mbm = nla_get_u32(info->attrs[idx]);
1971                 }
1972
1973                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
1974                 if (result)
1975                         goto bad_res;
1976         }
1977
1978         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
1979             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
1980                 u32 tx_ant, rx_ant;
1981                 if ((!rdev->wiphy.available_antennas_tx &&
1982                      !rdev->wiphy.available_antennas_rx) ||
1983                     !rdev->ops->set_antenna) {
1984                         result = -EOPNOTSUPP;
1985                         goto bad_res;
1986                 }
1987
1988                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
1989                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
1990
1991                 /* reject antenna configurations which don't match the
1992                  * available antenna masks, except for the "all" mask */
1993                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
1994                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
1995                         result = -EINVAL;
1996                         goto bad_res;
1997                 }
1998
1999                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2000                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2001
2002                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2003                 if (result)
2004                         goto bad_res;
2005         }
2006
2007         changed = 0;
2008
2009         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2010                 retry_short = nla_get_u8(
2011                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2012                 if (retry_short == 0) {
2013                         result = -EINVAL;
2014                         goto bad_res;
2015                 }
2016                 changed |= WIPHY_PARAM_RETRY_SHORT;
2017         }
2018
2019         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2020                 retry_long = nla_get_u8(
2021                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2022                 if (retry_long == 0) {
2023                         result = -EINVAL;
2024                         goto bad_res;
2025                 }
2026                 changed |= WIPHY_PARAM_RETRY_LONG;
2027         }
2028
2029         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2030                 frag_threshold = nla_get_u32(
2031                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2032                 if (frag_threshold < 256) {
2033                         result = -EINVAL;
2034                         goto bad_res;
2035                 }
2036                 if (frag_threshold != (u32) -1) {
2037                         /*
2038                          * Fragments (apart from the last one) are required to
2039                          * have even length. Make the fragmentation code
2040                          * simpler by stripping LSB should someone try to use
2041                          * odd threshold value.
2042                          */
2043                         frag_threshold &= ~0x1;
2044                 }
2045                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2046         }
2047
2048         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2049                 rts_threshold = nla_get_u32(
2050                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2051                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2052         }
2053
2054         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2055                 coverage_class = nla_get_u8(
2056                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2057                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2058         }
2059
2060         if (changed) {
2061                 u8 old_retry_short, old_retry_long;
2062                 u32 old_frag_threshold, old_rts_threshold;
2063                 u8 old_coverage_class;
2064
2065                 if (!rdev->ops->set_wiphy_params) {
2066                         result = -EOPNOTSUPP;
2067                         goto bad_res;
2068                 }
2069
2070                 old_retry_short = rdev->wiphy.retry_short;
2071                 old_retry_long = rdev->wiphy.retry_long;
2072                 old_frag_threshold = rdev->wiphy.frag_threshold;
2073                 old_rts_threshold = rdev->wiphy.rts_threshold;
2074                 old_coverage_class = rdev->wiphy.coverage_class;
2075
2076                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2077                         rdev->wiphy.retry_short = retry_short;
2078                 if (changed & WIPHY_PARAM_RETRY_LONG)
2079                         rdev->wiphy.retry_long = retry_long;
2080                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2081                         rdev->wiphy.frag_threshold = frag_threshold;
2082                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2083                         rdev->wiphy.rts_threshold = rts_threshold;
2084                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2085                         rdev->wiphy.coverage_class = coverage_class;
2086
2087                 result = rdev_set_wiphy_params(rdev, changed);
2088                 if (result) {
2089                         rdev->wiphy.retry_short = old_retry_short;
2090                         rdev->wiphy.retry_long = old_retry_long;
2091                         rdev->wiphy.frag_threshold = old_frag_threshold;
2092                         rdev->wiphy.rts_threshold = old_rts_threshold;
2093                         rdev->wiphy.coverage_class = old_coverage_class;
2094                 }
2095         }
2096
2097  bad_res:
2098         mutex_unlock(&rdev->mtx);
2099         if (netdev)
2100                 dev_put(netdev);
2101         return result;
2102 }
2103
2104 static inline u64 wdev_id(struct wireless_dev *wdev)
2105 {
2106         return (u64)wdev->identifier |
2107                ((u64)wiphy_to_dev(wdev->wiphy)->wiphy_idx << 32);
2108 }
2109
2110 static int nl80211_send_chandef(struct sk_buff *msg,
2111                                  struct cfg80211_chan_def *chandef)
2112 {
2113         WARN_ON(!cfg80211_chandef_valid(chandef));
2114
2115         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2116                         chandef->chan->center_freq))
2117                 return -ENOBUFS;
2118         switch (chandef->width) {
2119         case NL80211_CHAN_WIDTH_20_NOHT:
2120         case NL80211_CHAN_WIDTH_20:
2121         case NL80211_CHAN_WIDTH_40:
2122                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2123                                 cfg80211_get_chandef_type(chandef)))
2124                         return -ENOBUFS;
2125                 break;
2126         default:
2127                 break;
2128         }
2129         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2130                 return -ENOBUFS;
2131         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2132                 return -ENOBUFS;
2133         if (chandef->center_freq2 &&
2134             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2135                 return -ENOBUFS;
2136         return 0;
2137 }
2138
2139 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2140                               struct cfg80211_registered_device *rdev,
2141                               struct wireless_dev *wdev)
2142 {
2143         struct net_device *dev = wdev->netdev;
2144         void *hdr;
2145
2146         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
2147         if (!hdr)
2148                 return -1;
2149
2150         if (dev &&
2151             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2152              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2153                 goto nla_put_failure;
2154
2155         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2156             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2157             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2158             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2159             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2160                         rdev->devlist_generation ^
2161                         (cfg80211_rdev_list_generation << 2)))
2162                 goto nla_put_failure;
2163
2164         if (rdev->ops->get_channel) {
2165                 int ret;
2166                 struct cfg80211_chan_def chandef;
2167
2168                 ret = rdev_get_channel(rdev, wdev, &chandef);
2169                 if (ret == 0) {
2170                         if (nl80211_send_chandef(msg, &chandef))
2171                                 goto nla_put_failure;
2172                 }
2173         }
2174
2175         if (wdev->ssid_len) {
2176                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2177                         goto nla_put_failure;
2178         }
2179
2180         return genlmsg_end(msg, hdr);
2181
2182  nla_put_failure:
2183         genlmsg_cancel(msg, hdr);
2184         return -EMSGSIZE;
2185 }
2186
2187 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2188 {
2189         int wp_idx = 0;
2190         int if_idx = 0;
2191         int wp_start = cb->args[0];
2192         int if_start = cb->args[1];
2193         struct cfg80211_registered_device *rdev;
2194         struct wireless_dev *wdev;
2195
2196         mutex_lock(&cfg80211_mutex);
2197         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2198                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2199                         continue;
2200                 if (wp_idx < wp_start) {
2201                         wp_idx++;
2202                         continue;
2203                 }
2204                 if_idx = 0;
2205
2206                 mutex_lock(&rdev->devlist_mtx);
2207                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
2208                         if (if_idx < if_start) {
2209                                 if_idx++;
2210                                 continue;
2211                         }
2212                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2213                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2214                                                rdev, wdev) < 0) {
2215                                 mutex_unlock(&rdev->devlist_mtx);
2216                                 goto out;
2217                         }
2218                         if_idx++;
2219                 }
2220                 mutex_unlock(&rdev->devlist_mtx);
2221
2222                 wp_idx++;
2223         }
2224  out:
2225         mutex_unlock(&cfg80211_mutex);
2226
2227         cb->args[0] = wp_idx;
2228         cb->args[1] = if_idx;
2229
2230         return skb->len;
2231 }
2232
2233 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2234 {
2235         struct sk_buff *msg;
2236         struct cfg80211_registered_device *dev = info->user_ptr[0];
2237         struct wireless_dev *wdev = info->user_ptr[1];
2238
2239         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2240         if (!msg)
2241                 return -ENOMEM;
2242
2243         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2244                                dev, wdev) < 0) {
2245                 nlmsg_free(msg);
2246                 return -ENOBUFS;
2247         }
2248
2249         return genlmsg_reply(msg, info);
2250 }
2251
2252 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2253         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2254         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2255         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2256         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2257         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2258 };
2259
2260 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2261 {
2262         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2263         int flag;
2264
2265         *mntrflags = 0;
2266
2267         if (!nla)
2268                 return -EINVAL;
2269
2270         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2271                              nla, mntr_flags_policy))
2272                 return -EINVAL;
2273
2274         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2275                 if (flags[flag])
2276                         *mntrflags |= (1<<flag);
2277
2278         return 0;
2279 }
2280
2281 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2282                                struct net_device *netdev, u8 use_4addr,
2283                                enum nl80211_iftype iftype)
2284 {
2285         if (!use_4addr) {
2286                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2287                         return -EBUSY;
2288                 return 0;
2289         }
2290
2291         switch (iftype) {
2292         case NL80211_IFTYPE_AP_VLAN:
2293                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2294                         return 0;
2295                 break;
2296         case NL80211_IFTYPE_STATION:
2297                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2298                         return 0;
2299                 break;
2300         default:
2301                 break;
2302         }
2303
2304         return -EOPNOTSUPP;
2305 }
2306
2307 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2308 {
2309         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2310         struct vif_params params;
2311         int err;
2312         enum nl80211_iftype otype, ntype;
2313         struct net_device *dev = info->user_ptr[1];
2314         u32 _flags, *flags = NULL;
2315         bool change = false;
2316
2317         memset(&params, 0, sizeof(params));
2318
2319         otype = ntype = dev->ieee80211_ptr->iftype;
2320
2321         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2322                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2323                 if (otype != ntype)
2324                         change = true;
2325                 if (ntype > NL80211_IFTYPE_MAX)
2326                         return -EINVAL;
2327         }
2328
2329         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2330                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2331
2332                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2333                         return -EINVAL;
2334                 if (netif_running(dev))
2335                         return -EBUSY;
2336
2337                 wdev_lock(wdev);
2338                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2339                              IEEE80211_MAX_MESH_ID_LEN);
2340                 wdev->mesh_id_up_len =
2341                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2342                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2343                        wdev->mesh_id_up_len);
2344                 wdev_unlock(wdev);
2345         }
2346
2347         if (info->attrs[NL80211_ATTR_4ADDR]) {
2348                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2349                 change = true;
2350                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2351                 if (err)
2352                         return err;
2353         } else {
2354                 params.use_4addr = -1;
2355         }
2356
2357         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2358                 if (ntype != NL80211_IFTYPE_MONITOR)
2359                         return -EINVAL;
2360                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2361                                           &_flags);
2362                 if (err)
2363                         return err;
2364
2365                 flags = &_flags;
2366                 change = true;
2367         }
2368
2369         if (change)
2370                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2371         else
2372                 err = 0;
2373
2374         if (!err && params.use_4addr != -1)
2375                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2376
2377         return err;
2378 }
2379
2380 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2381 {
2382         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2383         struct vif_params params;
2384         struct wireless_dev *wdev;
2385         struct sk_buff *msg;
2386         int err;
2387         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2388         u32 flags;
2389
2390         memset(&params, 0, sizeof(params));
2391
2392         if (!info->attrs[NL80211_ATTR_IFNAME])
2393                 return -EINVAL;
2394
2395         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2396                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2397                 if (type > NL80211_IFTYPE_MAX)
2398                         return -EINVAL;
2399         }
2400
2401         if (!rdev->ops->add_virtual_intf ||
2402             !(rdev->wiphy.interface_modes & (1 << type)))
2403                 return -EOPNOTSUPP;
2404
2405         if (type == NL80211_IFTYPE_P2P_DEVICE && info->attrs[NL80211_ATTR_MAC]) {
2406                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2407                            ETH_ALEN);
2408                 if (!is_valid_ether_addr(params.macaddr))
2409                         return -EADDRNOTAVAIL;
2410         }
2411
2412         if (info->attrs[NL80211_ATTR_4ADDR]) {
2413                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2414                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2415                 if (err)
2416                         return err;
2417         }
2418
2419         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2420         if (!msg)
2421                 return -ENOMEM;
2422
2423         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2424                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2425                                   &flags);
2426         wdev = rdev_add_virtual_intf(rdev,
2427                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2428                                 type, err ? NULL : &flags, &params);
2429         if (IS_ERR(wdev)) {
2430                 nlmsg_free(msg);
2431                 return PTR_ERR(wdev);
2432         }
2433
2434         switch (type) {
2435         case NL80211_IFTYPE_MESH_POINT:
2436                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2437                         break;
2438                 wdev_lock(wdev);
2439                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2440                              IEEE80211_MAX_MESH_ID_LEN);
2441                 wdev->mesh_id_up_len =
2442                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2443                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2444                        wdev->mesh_id_up_len);
2445                 wdev_unlock(wdev);
2446                 break;
2447         case NL80211_IFTYPE_P2P_DEVICE:
2448                 /*
2449                  * P2P Device doesn't have a netdev, so doesn't go
2450                  * through the netdev notifier and must be added here
2451                  */
2452                 mutex_init(&wdev->mtx);
2453                 INIT_LIST_HEAD(&wdev->event_list);
2454                 spin_lock_init(&wdev->event_lock);
2455                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2456                 spin_lock_init(&wdev->mgmt_registrations_lock);
2457
2458                 mutex_lock(&rdev->devlist_mtx);
2459                 wdev->identifier = ++rdev->wdev_id;
2460                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2461                 rdev->devlist_generation++;
2462                 mutex_unlock(&rdev->devlist_mtx);
2463                 break;
2464         default:
2465                 break;
2466         }
2467
2468         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2469                                rdev, wdev) < 0) {
2470                 nlmsg_free(msg);
2471                 return -ENOBUFS;
2472         }
2473
2474         return genlmsg_reply(msg, info);
2475 }
2476
2477 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2478 {
2479         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2480         struct wireless_dev *wdev = info->user_ptr[1];
2481
2482         if (!rdev->ops->del_virtual_intf)
2483                 return -EOPNOTSUPP;
2484
2485         /*
2486          * If we remove a wireless device without a netdev then clear
2487          * user_ptr[1] so that nl80211_post_doit won't dereference it
2488          * to check if it needs to do dev_put(). Otherwise it crashes
2489          * since the wdev has been freed, unlike with a netdev where
2490          * we need the dev_put() for the netdev to really be freed.
2491          */
2492         if (!wdev->netdev)
2493                 info->user_ptr[1] = NULL;
2494
2495         return rdev_del_virtual_intf(rdev, wdev);
2496 }
2497
2498 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2499 {
2500         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2501         struct net_device *dev = info->user_ptr[1];
2502         u16 noack_map;
2503
2504         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2505                 return -EINVAL;
2506
2507         if (!rdev->ops->set_noack_map)
2508                 return -EOPNOTSUPP;
2509
2510         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2511
2512         return rdev_set_noack_map(rdev, dev, noack_map);
2513 }
2514
2515 struct get_key_cookie {
2516         struct sk_buff *msg;
2517         int error;
2518         int idx;
2519 };
2520
2521 static void get_key_callback(void *c, struct key_params *params)
2522 {
2523         struct nlattr *key;
2524         struct get_key_cookie *cookie = c;
2525
2526         if ((params->key &&
2527              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2528                      params->key_len, params->key)) ||
2529             (params->seq &&
2530              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2531                      params->seq_len, params->seq)) ||
2532             (params->cipher &&
2533              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2534                          params->cipher)))
2535                 goto nla_put_failure;
2536
2537         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2538         if (!key)
2539                 goto nla_put_failure;
2540
2541         if ((params->key &&
2542              nla_put(cookie->msg, NL80211_KEY_DATA,
2543                      params->key_len, params->key)) ||
2544             (params->seq &&
2545              nla_put(cookie->msg, NL80211_KEY_SEQ,
2546                      params->seq_len, params->seq)) ||
2547             (params->cipher &&
2548              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2549                          params->cipher)))
2550                 goto nla_put_failure;
2551
2552         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2553                 goto nla_put_failure;
2554
2555         nla_nest_end(cookie->msg, key);
2556
2557         return;
2558  nla_put_failure:
2559         cookie->error = 1;
2560 }
2561
2562 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2563 {
2564         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2565         int err;
2566         struct net_device *dev = info->user_ptr[1];
2567         u8 key_idx = 0;
2568         const u8 *mac_addr = NULL;
2569         bool pairwise;
2570         struct get_key_cookie cookie = {
2571                 .error = 0,
2572         };
2573         void *hdr;
2574         struct sk_buff *msg;
2575
2576         if (info->attrs[NL80211_ATTR_KEY_IDX])
2577                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2578
2579         if (key_idx > 5)
2580                 return -EINVAL;
2581
2582         if (info->attrs[NL80211_ATTR_MAC])
2583                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2584
2585         pairwise = !!mac_addr;
2586         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2587                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2588                 if (kt >= NUM_NL80211_KEYTYPES)
2589                         return -EINVAL;
2590                 if (kt != NL80211_KEYTYPE_GROUP &&
2591                     kt != NL80211_KEYTYPE_PAIRWISE)
2592                         return -EINVAL;
2593                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2594         }
2595
2596         if (!rdev->ops->get_key)
2597                 return -EOPNOTSUPP;
2598
2599         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2600         if (!msg)
2601                 return -ENOMEM;
2602
2603         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2604                              NL80211_CMD_NEW_KEY);
2605         if (IS_ERR(hdr))
2606                 return PTR_ERR(hdr);
2607
2608         cookie.msg = msg;
2609         cookie.idx = key_idx;
2610
2611         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2612             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2613                 goto nla_put_failure;
2614         if (mac_addr &&
2615             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2616                 goto nla_put_failure;
2617
2618         if (pairwise && mac_addr &&
2619             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2620                 return -ENOENT;
2621
2622         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2623                            get_key_callback);
2624
2625         if (err)
2626                 goto free_msg;
2627
2628         if (cookie.error)
2629                 goto nla_put_failure;
2630
2631         genlmsg_end(msg, hdr);
2632         return genlmsg_reply(msg, info);
2633
2634  nla_put_failure:
2635         err = -ENOBUFS;
2636  free_msg:
2637         nlmsg_free(msg);
2638         return err;
2639 }
2640
2641 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2642 {
2643         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2644         struct key_parse key;
2645         int err;
2646         struct net_device *dev = info->user_ptr[1];
2647
2648         err = nl80211_parse_key(info, &key);
2649         if (err)
2650                 return err;
2651
2652         if (key.idx < 0)
2653                 return -EINVAL;
2654
2655         /* only support setting default key */
2656         if (!key.def && !key.defmgmt)
2657                 return -EINVAL;
2658
2659         wdev_lock(dev->ieee80211_ptr);
2660
2661         if (key.def) {
2662                 if (!rdev->ops->set_default_key) {
2663                         err = -EOPNOTSUPP;
2664                         goto out;
2665                 }
2666
2667                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2668                 if (err)
2669                         goto out;
2670
2671                 err = rdev_set_default_key(rdev, dev, key.idx,
2672                                                  key.def_uni, key.def_multi);
2673
2674                 if (err)
2675                         goto out;
2676
2677 #ifdef CONFIG_CFG80211_WEXT
2678                 dev->ieee80211_ptr->wext.default_key = key.idx;
2679 #endif
2680         } else {
2681                 if (key.def_uni || !key.def_multi) {
2682                         err = -EINVAL;
2683                         goto out;
2684                 }
2685
2686                 if (!rdev->ops->set_default_mgmt_key) {
2687                         err = -EOPNOTSUPP;
2688                         goto out;
2689                 }
2690
2691                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2692                 if (err)
2693                         goto out;
2694
2695                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2696                 if (err)
2697                         goto out;
2698
2699 #ifdef CONFIG_CFG80211_WEXT
2700                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2701 #endif
2702         }
2703
2704  out:
2705         wdev_unlock(dev->ieee80211_ptr);
2706
2707         return err;
2708 }
2709
2710 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2711 {
2712         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2713         int err;
2714         struct net_device *dev = info->user_ptr[1];
2715         struct key_parse key;
2716         const u8 *mac_addr = NULL;
2717
2718         err = nl80211_parse_key(info, &key);
2719         if (err)
2720                 return err;
2721
2722         if (!key.p.key)
2723                 return -EINVAL;
2724
2725         if (info->attrs[NL80211_ATTR_MAC])
2726                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2727
2728         if (key.type == -1) {
2729                 if (mac_addr)
2730                         key.type = NL80211_KEYTYPE_PAIRWISE;
2731                 else
2732                         key.type = NL80211_KEYTYPE_GROUP;
2733         }
2734
2735         /* for now */
2736         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2737             key.type != NL80211_KEYTYPE_GROUP)
2738                 return -EINVAL;
2739
2740         if (!rdev->ops->add_key)
2741                 return -EOPNOTSUPP;
2742
2743         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2744                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2745                                            mac_addr))
2746                 return -EINVAL;
2747
2748         wdev_lock(dev->ieee80211_ptr);
2749         err = nl80211_key_allowed(dev->ieee80211_ptr);
2750         if (!err)
2751                 err = rdev_add_key(rdev, dev, key.idx,
2752                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2753                                     mac_addr, &key.p);
2754         wdev_unlock(dev->ieee80211_ptr);
2755
2756         return err;
2757 }
2758
2759 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2760 {
2761         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2762         int err;
2763         struct net_device *dev = info->user_ptr[1];
2764         u8 *mac_addr = NULL;
2765         struct key_parse key;
2766
2767         err = nl80211_parse_key(info, &key);
2768         if (err)
2769                 return err;
2770
2771         if (info->attrs[NL80211_ATTR_MAC])
2772                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2773
2774         if (key.type == -1) {
2775                 if (mac_addr)
2776                         key.type = NL80211_KEYTYPE_PAIRWISE;
2777                 else
2778                         key.type = NL80211_KEYTYPE_GROUP;
2779         }
2780
2781         /* for now */
2782         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2783             key.type != NL80211_KEYTYPE_GROUP)
2784                 return -EINVAL;
2785
2786         if (!rdev->ops->del_key)
2787                 return -EOPNOTSUPP;
2788
2789         wdev_lock(dev->ieee80211_ptr);
2790         err = nl80211_key_allowed(dev->ieee80211_ptr);
2791
2792         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2793             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2794                 err = -ENOENT;
2795
2796         if (!err)
2797                 err = rdev_del_key(rdev, dev, key.idx,
2798                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2799                                    mac_addr);
2800
2801 #ifdef CONFIG_CFG80211_WEXT
2802         if (!err) {
2803                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
2804                         dev->ieee80211_ptr->wext.default_key = -1;
2805                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2806                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2807         }
2808 #endif
2809         wdev_unlock(dev->ieee80211_ptr);
2810
2811         return err;
2812 }
2813
2814 /* This function returns an error or the number of nested attributes */
2815 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
2816 {
2817         struct nlattr *attr;
2818         int n_entries = 0, tmp;
2819
2820         nla_for_each_nested(attr, nl_attr, tmp) {
2821                 if (nla_len(attr) != ETH_ALEN)
2822                         return -EINVAL;
2823
2824                 n_entries++;
2825         }
2826
2827         return n_entries;
2828 }
2829
2830 /*
2831  * This function parses ACL information and allocates memory for ACL data.
2832  * On successful return, the calling function is responsible to free the
2833  * ACL buffer returned by this function.
2834  */
2835 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
2836                                                 struct genl_info *info)
2837 {
2838         enum nl80211_acl_policy acl_policy;
2839         struct nlattr *attr;
2840         struct cfg80211_acl_data *acl;
2841         int i = 0, n_entries, tmp;
2842
2843         if (!wiphy->max_acl_mac_addrs)
2844                 return ERR_PTR(-EOPNOTSUPP);
2845
2846         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
2847                 return ERR_PTR(-EINVAL);
2848
2849         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
2850         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
2851             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
2852                 return ERR_PTR(-EINVAL);
2853
2854         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
2855                 return ERR_PTR(-EINVAL);
2856
2857         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
2858         if (n_entries < 0)
2859                 return ERR_PTR(n_entries);
2860
2861         if (n_entries > wiphy->max_acl_mac_addrs)
2862                 return ERR_PTR(-ENOTSUPP);
2863
2864         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
2865                       GFP_KERNEL);
2866         if (!acl)
2867                 return ERR_PTR(-ENOMEM);
2868
2869         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
2870                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
2871                 i++;
2872         }
2873
2874         acl->n_acl_entries = n_entries;
2875         acl->acl_policy = acl_policy;
2876
2877         return acl;
2878 }
2879
2880 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
2881 {
2882         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2883         struct net_device *dev = info->user_ptr[1];
2884         struct cfg80211_acl_data *acl;
2885         int err;
2886
2887         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2888             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2889                 return -EOPNOTSUPP;
2890
2891         if (!dev->ieee80211_ptr->beacon_interval)
2892                 return -EINVAL;
2893
2894         acl = parse_acl_data(&rdev->wiphy, info);
2895         if (IS_ERR(acl))
2896                 return PTR_ERR(acl);
2897
2898         err = rdev_set_mac_acl(rdev, dev, acl);
2899
2900         kfree(acl);
2901
2902         return err;
2903 }
2904
2905 static int nl80211_parse_beacon(struct genl_info *info,
2906                                 struct cfg80211_beacon_data *bcn)
2907 {
2908         bool haveinfo = false;
2909
2910         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]) ||
2911             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]) ||
2912             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
2913             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2914                 return -EINVAL;
2915
2916         memset(bcn, 0, sizeof(*bcn));
2917
2918         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
2919                 bcn->head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2920                 bcn->head_len = nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2921                 if (!bcn->head_len)
2922                         return -EINVAL;
2923                 haveinfo = true;
2924         }
2925
2926         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
2927                 bcn->tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2928                 bcn->tail_len =
2929                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2930                 haveinfo = true;
2931         }
2932
2933         if (!haveinfo)
2934                 return -EINVAL;
2935
2936         if (info->attrs[NL80211_ATTR_IE]) {
2937                 bcn->beacon_ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2938                 bcn->beacon_ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2939         }
2940
2941         if (info->attrs[NL80211_ATTR_IE_PROBE_RESP]) {
2942                 bcn->proberesp_ies =
2943                         nla_data(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2944                 bcn->proberesp_ies_len =
2945                         nla_len(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2946         }
2947
2948         if (info->attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
2949                 bcn->assocresp_ies =
2950                         nla_data(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2951                 bcn->assocresp_ies_len =
2952                         nla_len(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2953         }
2954
2955         if (info->attrs[NL80211_ATTR_PROBE_RESP]) {
2956                 bcn->probe_resp =
2957                         nla_data(info->attrs[NL80211_ATTR_PROBE_RESP]);
2958                 bcn->probe_resp_len =
2959                         nla_len(info->attrs[NL80211_ATTR_PROBE_RESP]);
2960         }
2961
2962         return 0;
2963 }
2964
2965 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
2966                                    struct cfg80211_ap_settings *params)
2967 {
2968         struct wireless_dev *wdev;
2969         bool ret = false;
2970
2971         mutex_lock(&rdev->devlist_mtx);
2972
2973         list_for_each_entry(wdev, &rdev->wdev_list, list) {
2974                 if (wdev->iftype != NL80211_IFTYPE_AP &&
2975                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
2976                         continue;
2977
2978                 if (!wdev->preset_chandef.chan)
2979                         continue;
2980
2981                 params->chandef = wdev->preset_chandef;
2982                 ret = true;
2983                 break;
2984         }
2985
2986         mutex_unlock(&rdev->devlist_mtx);
2987
2988         return ret;
2989 }
2990
2991 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
2992                                     enum nl80211_auth_type auth_type,
2993                                     enum nl80211_commands cmd)
2994 {
2995         if (auth_type > NL80211_AUTHTYPE_MAX)
2996                 return false;
2997
2998         switch (cmd) {
2999         case NL80211_CMD_AUTHENTICATE:
3000                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3001                     auth_type == NL80211_AUTHTYPE_SAE)
3002                         return false;
3003                 return true;
3004         case NL80211_CMD_CONNECT:
3005         case NL80211_CMD_START_AP:
3006                 /* SAE not supported yet */
3007                 if (auth_type == NL80211_AUTHTYPE_SAE)
3008                         return false;
3009                 return true;
3010         default:
3011                 return false;
3012         }
3013 }
3014
3015 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3016 {
3017         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3018         struct net_device *dev = info->user_ptr[1];
3019         struct wireless_dev *wdev = dev->ieee80211_ptr;
3020         struct cfg80211_ap_settings params;
3021         int err;
3022         u8 radar_detect_width = 0;
3023
3024         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3025             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3026                 return -EOPNOTSUPP;
3027
3028         if (!rdev->ops->start_ap)
3029                 return -EOPNOTSUPP;
3030
3031         if (wdev->beacon_interval)
3032                 return -EALREADY;
3033
3034         memset(&params, 0, sizeof(params));
3035
3036         /* these are required for START_AP */
3037         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3038             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3039             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3040                 return -EINVAL;
3041
3042         err = nl80211_parse_beacon(info, &params.beacon);
3043         if (err)
3044                 return err;
3045
3046         params.beacon_interval =
3047                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3048         params.dtim_period =
3049                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3050
3051         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
3052         if (err)
3053                 return err;
3054
3055         /*
3056          * In theory, some of these attributes should be required here
3057          * but since they were not used when the command was originally
3058          * added, keep them optional for old user space programs to let
3059          * them continue to work with drivers that do not need the
3060          * additional information -- drivers must check!
3061          */
3062         if (info->attrs[NL80211_ATTR_SSID]) {
3063                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3064                 params.ssid_len =
3065                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3066                 if (params.ssid_len == 0 ||
3067                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3068                         return -EINVAL;
3069         }
3070
3071         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3072                 params.hidden_ssid = nla_get_u32(
3073                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3074                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3075                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3076                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3077                         return -EINVAL;
3078         }
3079
3080         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3081
3082         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3083                 params.auth_type = nla_get_u32(
3084                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3085                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3086                                              NL80211_CMD_START_AP))
3087                         return -EINVAL;
3088         } else
3089                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3090
3091         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3092                                       NL80211_MAX_NR_CIPHER_SUITES);
3093         if (err)
3094                 return err;
3095
3096         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3097                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3098                         return -EOPNOTSUPP;
3099                 params.inactivity_timeout = nla_get_u16(
3100                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3101         }
3102
3103         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3104                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3105                         return -EINVAL;
3106                 params.p2p_ctwindow =
3107                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3108                 if (params.p2p_ctwindow > 127)
3109                         return -EINVAL;
3110                 if (params.p2p_ctwindow != 0 &&
3111                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3112                         return -EINVAL;
3113         }
3114
3115         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3116                 u8 tmp;
3117
3118                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3119                         return -EINVAL;
3120                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3121                 if (tmp > 1)
3122                         return -EINVAL;
3123                 params.p2p_opp_ps = tmp;
3124                 if (params.p2p_opp_ps != 0 &&
3125                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3126                         return -EINVAL;
3127         }
3128
3129         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3130                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
3131                 if (err)
3132                         return err;
3133         } else if (wdev->preset_chandef.chan) {
3134                 params.chandef = wdev->preset_chandef;
3135         } else if (!nl80211_get_ap_channel(rdev, &params))
3136                 return -EINVAL;
3137
3138         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
3139                 return -EINVAL;
3140
3141         err = cfg80211_chandef_dfs_required(wdev->wiphy, &params.chandef);
3142         if (err < 0)
3143                 return err;
3144         if (err) {
3145                 radar_detect_width = BIT(params.chandef.width);
3146                 params.radar_required = true;
3147         }
3148
3149         mutex_lock(&rdev->devlist_mtx);
3150         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
3151                                            params.chandef.chan,
3152                                            CHAN_MODE_SHARED,
3153                                            radar_detect_width);
3154         mutex_unlock(&rdev->devlist_mtx);
3155
3156         if (err)
3157                 return err;
3158
3159         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3160                 params.acl = parse_acl_data(&rdev->wiphy, info);
3161                 if (IS_ERR(params.acl))
3162                         return PTR_ERR(params.acl);
3163         }
3164
3165         err = rdev_start_ap(rdev, dev, &params);
3166         if (!err) {
3167                 wdev->preset_chandef = params.chandef;
3168                 wdev->beacon_interval = params.beacon_interval;
3169                 wdev->channel = params.chandef.chan;
3170                 wdev->ssid_len = params.ssid_len;
3171                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3172         }
3173
3174         kfree(params.acl);
3175
3176         return err;
3177 }
3178
3179 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3180 {
3181         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3182         struct net_device *dev = info->user_ptr[1];
3183         struct wireless_dev *wdev = dev->ieee80211_ptr;
3184         struct cfg80211_beacon_data params;
3185         int err;
3186
3187         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3188             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3189                 return -EOPNOTSUPP;
3190
3191         if (!rdev->ops->change_beacon)
3192                 return -EOPNOTSUPP;
3193
3194         if (!wdev->beacon_interval)
3195                 return -EINVAL;
3196
3197         err = nl80211_parse_beacon(info, &params);
3198         if (err)
3199                 return err;
3200
3201         return rdev_change_beacon(rdev, dev, &params);
3202 }
3203
3204 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3205 {
3206         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3207         struct net_device *dev = info->user_ptr[1];
3208
3209         return cfg80211_stop_ap(rdev, dev);
3210 }
3211
3212 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3213         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3214         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3215         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3216         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3217         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3218         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3219 };
3220
3221 static int parse_station_flags(struct genl_info *info,
3222                                enum nl80211_iftype iftype,
3223                                struct station_parameters *params)
3224 {
3225         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3226         struct nlattr *nla;
3227         int flag;
3228
3229         /*
3230          * Try parsing the new attribute first so userspace
3231          * can specify both for older kernels.
3232          */
3233         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3234         if (nla) {
3235                 struct nl80211_sta_flag_update *sta_flags;
3236
3237                 sta_flags = nla_data(nla);
3238                 params->sta_flags_mask = sta_flags->mask;
3239                 params->sta_flags_set = sta_flags->set;
3240                 params->sta_flags_set &= params->sta_flags_mask;
3241                 if ((params->sta_flags_mask |
3242                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3243                         return -EINVAL;
3244                 return 0;
3245         }
3246
3247         /* if present, parse the old attribute */
3248
3249         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3250         if (!nla)
3251                 return 0;
3252
3253         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3254                              nla, sta_flags_policy))
3255                 return -EINVAL;
3256
3257         /*
3258          * Only allow certain flags for interface types so that
3259          * other attributes are silently ignored. Remember that
3260          * this is backward compatibility code with old userspace
3261          * and shouldn't be hit in other cases anyway.
3262          */
3263         switch (iftype) {
3264         case NL80211_IFTYPE_AP:
3265         case NL80211_IFTYPE_AP_VLAN:
3266         case NL80211_IFTYPE_P2P_GO:
3267                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3268                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3269                                          BIT(NL80211_STA_FLAG_WME) |
3270                                          BIT(NL80211_STA_FLAG_MFP);
3271                 break;
3272         case NL80211_IFTYPE_P2P_CLIENT:
3273         case NL80211_IFTYPE_STATION:
3274                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3275                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3276                 break;
3277         case NL80211_IFTYPE_MESH_POINT:
3278                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3279                                          BIT(NL80211_STA_FLAG_MFP) |
3280                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3281         default:
3282                 return -EINVAL;
3283         }
3284
3285         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3286                 if (flags[flag]) {
3287                         params->sta_flags_set |= (1<<flag);
3288
3289                         /* no longer support new API additions in old API */
3290                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3291                                 return -EINVAL;
3292                 }
3293         }
3294
3295         return 0;
3296 }
3297
3298 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3299                                  int attr)
3300 {
3301         struct nlattr *rate;
3302         u32 bitrate;
3303         u16 bitrate_compat;
3304
3305         rate = nla_nest_start(msg, attr);
3306         if (!rate)
3307                 return false;
3308
3309         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3310         bitrate = cfg80211_calculate_bitrate(info);
3311         /* report 16-bit bitrate only if we can */
3312         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3313         if (bitrate > 0 &&
3314             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3315                 return false;
3316         if (bitrate_compat > 0 &&
3317             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3318                 return false;
3319
3320         if (info->flags & RATE_INFO_FLAGS_MCS) {
3321                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3322                         return false;
3323                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3324                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3325                         return false;
3326                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3327                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3328                         return false;
3329         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3330                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3331                         return false;
3332                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3333                         return false;
3334                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3335                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3336                         return false;
3337                 if (info->flags & RATE_INFO_FLAGS_80_MHZ_WIDTH &&
3338                     nla_put_flag(msg, NL80211_RATE_INFO_80_MHZ_WIDTH))
3339                         return false;
3340                 if (info->flags & RATE_INFO_FLAGS_80P80_MHZ_WIDTH &&
3341                     nla_put_flag(msg, NL80211_RATE_INFO_80P80_MHZ_WIDTH))
3342                         return false;
3343                 if (info->flags & RATE_INFO_FLAGS_160_MHZ_WIDTH &&
3344                     nla_put_flag(msg, NL80211_RATE_INFO_160_MHZ_WIDTH))
3345                         return false;
3346                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3347                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3348                         return false;
3349         }
3350
3351         nla_nest_end(msg, rate);
3352         return true;
3353 }
3354
3355 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
3356                                 int flags,
3357                                 struct cfg80211_registered_device *rdev,
3358                                 struct net_device *dev,
3359                                 const u8 *mac_addr, struct station_info *sinfo)
3360 {
3361         void *hdr;
3362         struct nlattr *sinfoattr, *bss_param;
3363
3364         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3365         if (!hdr)
3366                 return -1;
3367
3368         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3369             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3370             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3371                 goto nla_put_failure;
3372
3373         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3374         if (!sinfoattr)
3375                 goto nla_put_failure;
3376         if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
3377             nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
3378                         sinfo->connected_time))
3379                 goto nla_put_failure;
3380         if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
3381             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
3382                         sinfo->inactive_time))
3383                 goto nla_put_failure;
3384         if ((sinfo->filled & (STATION_INFO_RX_BYTES |
3385                               STATION_INFO_RX_BYTES64)) &&
3386             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3387                         (u32)sinfo->rx_bytes))
3388                 goto nla_put_failure;
3389         if ((sinfo->filled & (STATION_INFO_TX_BYTES |
3390                               NL80211_STA_INFO_TX_BYTES64)) &&
3391             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3392                         (u32)sinfo->tx_bytes))
3393                 goto nla_put_failure;
3394         if ((sinfo->filled & STATION_INFO_RX_BYTES64) &&
3395             nla_put_u64(msg, NL80211_STA_INFO_RX_BYTES64,
3396                         sinfo->rx_bytes))
3397                 goto nla_put_failure;
3398         if ((sinfo->filled & STATION_INFO_TX_BYTES64) &&
3399             nla_put_u64(msg, NL80211_STA_INFO_TX_BYTES64,
3400                         sinfo->tx_bytes))
3401                 goto nla_put_failure;
3402         if ((sinfo->filled & STATION_INFO_LLID) &&
3403             nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
3404                 goto nla_put_failure;
3405         if ((sinfo->filled & STATION_INFO_PLID) &&
3406             nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
3407                 goto nla_put_failure;
3408         if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
3409             nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
3410                        sinfo->plink_state))
3411                 goto nla_put_failure;
3412         switch (rdev->wiphy.signal_type) {
3413         case CFG80211_SIGNAL_TYPE_MBM:
3414                 if ((sinfo->filled & STATION_INFO_SIGNAL) &&
3415                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
3416                                sinfo->signal))
3417                         goto nla_put_failure;
3418                 if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
3419                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
3420                                sinfo->signal_avg))
3421                         goto nla_put_failure;
3422                 break;
3423         default:
3424                 break;
3425         }
3426         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
3427                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3428                                           NL80211_STA_INFO_TX_BITRATE))
3429                         goto nla_put_failure;
3430         }
3431         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
3432                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3433                                           NL80211_STA_INFO_RX_BITRATE))
3434                         goto nla_put_failure;
3435         }
3436         if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
3437             nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
3438                         sinfo->rx_packets))
3439                 goto nla_put_failure;
3440         if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
3441             nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
3442                         sinfo->tx_packets))
3443                 goto nla_put_failure;
3444         if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
3445             nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
3446                         sinfo->tx_retries))
3447                 goto nla_put_failure;
3448         if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
3449             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
3450                         sinfo->tx_failed))
3451                 goto nla_put_failure;
3452         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
3453             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
3454                         sinfo->beacon_loss_count))
3455                 goto nla_put_failure;
3456         if ((sinfo->filled & STATION_INFO_LOCAL_PM) &&
3457             nla_put_u32(msg, NL80211_STA_INFO_LOCAL_PM,
3458                         sinfo->local_pm))
3459                 goto nla_put_failure;
3460         if ((sinfo->filled & STATION_INFO_PEER_PM) &&
3461             nla_put_u32(msg, NL80211_STA_INFO_PEER_PM,
3462                         sinfo->peer_pm))
3463                 goto nla_put_failure;
3464         if ((sinfo->filled & STATION_INFO_NONPEER_PM) &&
3465             nla_put_u32(msg, NL80211_STA_INFO_NONPEER_PM,
3466                         sinfo->nonpeer_pm))
3467                 goto nla_put_failure;
3468         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
3469                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3470                 if (!bss_param)
3471                         goto nla_put_failure;
3472
3473                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3474                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3475                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3476                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3477                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3478                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3479                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3480                                sinfo->bss_param.dtim_period) ||
3481                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3482                                 sinfo->bss_param.beacon_interval))
3483                         goto nla_put_failure;
3484
3485                 nla_nest_end(msg, bss_param);
3486         }
3487         if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
3488             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3489                     sizeof(struct nl80211_sta_flag_update),
3490                     &sinfo->sta_flags))
3491                 goto nla_put_failure;
3492         if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
3493                 nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
3494                             sinfo->t_offset))
3495                 goto nla_put_failure;
3496         nla_nest_end(msg, sinfoattr);
3497
3498         if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
3499             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3500                     sinfo->assoc_req_ies))
3501                 goto nla_put_failure;
3502
3503         return genlmsg_end(msg, hdr);
3504
3505  nla_put_failure:
3506         genlmsg_cancel(msg, hdr);
3507         return -EMSGSIZE;
3508 }
3509
3510 static int nl80211_dump_station(struct sk_buff *skb,
3511                                 struct netlink_callback *cb)
3512 {
3513         struct station_info sinfo;
3514         struct cfg80211_registered_device *dev;
3515         struct net_device *netdev;
3516         u8 mac_addr[ETH_ALEN];
3517         int sta_idx = cb->args[1];
3518         int err;
3519
3520         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
3521         if (err)
3522                 return err;
3523
3524         if (!dev->ops->dump_station) {
3525                 err = -EOPNOTSUPP;
3526                 goto out_err;
3527         }
3528
3529         while (1) {
3530                 memset(&sinfo, 0, sizeof(sinfo));
3531                 err = rdev_dump_station(dev, netdev, sta_idx,
3532                                         mac_addr, &sinfo);
3533                 if (err == -ENOENT)
3534                         break;
3535                 if (err)
3536                         goto out_err;
3537
3538                 if (nl80211_send_station(skb,
3539                                 NETLINK_CB(cb->skb).portid,
3540                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3541                                 dev, netdev, mac_addr,
3542                                 &sinfo) < 0)
3543                         goto out;
3544
3545                 sta_idx++;
3546         }
3547
3548
3549  out:
3550         cb->args[1] = sta_idx;
3551         err = skb->len;
3552  out_err:
3553         nl80211_finish_netdev_dump(dev);
3554
3555         return err;
3556 }
3557
3558 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3559 {
3560         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3561         struct net_device *dev = info->user_ptr[1];
3562         struct station_info sinfo;
3563         struct sk_buff *msg;
3564         u8 *mac_addr = NULL;
3565         int err;
3566
3567         memset(&sinfo, 0, sizeof(sinfo));
3568
3569         if (!info->attrs[NL80211_ATTR_MAC])
3570                 return -EINVAL;
3571
3572         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3573
3574         if (!rdev->ops->get_station)
3575                 return -EOPNOTSUPP;
3576
3577         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3578         if (err)
3579                 return err;
3580
3581         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3582         if (!msg)
3583                 return -ENOMEM;
3584
3585         if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3586                                  rdev, dev, mac_addr, &sinfo) < 0) {
3587                 nlmsg_free(msg);
3588                 return -ENOBUFS;
3589         }
3590
3591         return genlmsg_reply(msg, info);
3592 }
3593
3594 int cfg80211_check_station_change(struct wiphy *wiphy,
3595                                   struct station_parameters *params,
3596                                   enum cfg80211_station_type statype)
3597 {
3598         if (params->listen_interval != -1)
3599                 return -EINVAL;
3600         if (params->aid)
3601                 return -EINVAL;
3602
3603         /* When you run into this, adjust the code below for the new flag */
3604         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
3605
3606         switch (statype) {
3607         case CFG80211_STA_MESH_PEER_NONSEC:
3608         case CFG80211_STA_MESH_PEER_SECURE:
3609                 /*
3610                  * No ignoring the TDLS flag here -- the userspace mesh
3611                  * code doesn't have the bug of including TDLS in the
3612                  * mask everywhere.
3613                  */
3614                 if (params->sta_flags_mask &
3615                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3616                                   BIT(NL80211_STA_FLAG_MFP) |
3617                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3618                         return -EINVAL;
3619                 break;
3620         case CFG80211_STA_TDLS_PEER_SETUP:
3621         case CFG80211_STA_TDLS_PEER_ACTIVE:
3622                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3623                         return -EINVAL;
3624                 /* ignore since it can't change */
3625                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3626                 break;
3627         default:
3628                 /* disallow mesh-specific things */
3629                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3630                         return -EINVAL;
3631                 if (params->local_pm)
3632                         return -EINVAL;
3633                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3634                         return -EINVAL;
3635         }
3636
3637         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
3638             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
3639                 /* TDLS can't be set, ... */
3640                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3641                         return -EINVAL;
3642                 /*
3643                  * ... but don't bother the driver with it. This works around
3644                  * a hostapd/wpa_supplicant issue -- it always includes the
3645                  * TLDS_PEER flag in the mask even for AP mode.
3646                  */
3647                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3648         }
3649
3650         if (statype != CFG80211_STA_TDLS_PEER_SETUP) {
3651                 /* reject other things that can't change */
3652                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
3653                         return -EINVAL;
3654                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
3655                         return -EINVAL;
3656                 if (params->supported_rates)
3657                         return -EINVAL;
3658                 if (params->ext_capab || params->ht_capa || params->vht_capa)
3659                         return -EINVAL;
3660         }
3661
3662         if (statype != CFG80211_STA_AP_CLIENT) {
3663                 if (params->vlan)
3664                         return -EINVAL;
3665         }
3666
3667         switch (statype) {
3668         case CFG80211_STA_AP_MLME_CLIENT:
3669                 /* Use this only for authorizing/unauthorizing a station */
3670                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
3671                         return -EOPNOTSUPP;
3672                 break;
3673         case CFG80211_STA_AP_CLIENT:
3674                 /* accept only the listed bits */
3675                 if (params->sta_flags_mask &
3676                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3677                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3678                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
3679                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3680                                   BIT(NL80211_STA_FLAG_WME) |
3681                                   BIT(NL80211_STA_FLAG_MFP)))
3682                         return -EINVAL;
3683
3684                 /* but authenticated/associated only if driver handles it */
3685                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
3686                     params->sta_flags_mask &
3687                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3688                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
3689                         return -EINVAL;
3690                 break;
3691         case CFG80211_STA_IBSS:
3692         case CFG80211_STA_AP_STA:
3693                 /* reject any changes other than AUTHORIZED */
3694                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
3695                         return -EINVAL;
3696                 break;
3697         case CFG80211_STA_TDLS_PEER_SETUP:
3698                 /* reject any changes other than AUTHORIZED or WME */
3699                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3700                                                BIT(NL80211_STA_FLAG_WME)))
3701                         return -EINVAL;
3702                 /* force (at least) rates when authorizing */
3703                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
3704                     !params->supported_rates)
3705                         return -EINVAL;
3706                 break;
3707         case CFG80211_STA_TDLS_PEER_ACTIVE:
3708                 /* reject any changes */
3709                 return -EINVAL;
3710         case CFG80211_STA_MESH_PEER_NONSEC:
3711                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3712                         return -EINVAL;
3713                 break;
3714         case CFG80211_STA_MESH_PEER_SECURE:
3715                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3716                         return -EINVAL;
3717                 break;
3718         }
3719
3720         return 0;
3721 }
3722 EXPORT_SYMBOL(cfg80211_check_station_change);
3723
3724 /*
3725  * Get vlan interface making sure it is running and on the right wiphy.
3726  */
3727 static struct net_device *get_vlan(struct genl_info *info,
3728                                    struct cfg80211_registered_device *rdev)
3729 {
3730         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
3731         struct net_device *v;
3732         int ret;
3733
3734         if (!vlanattr)
3735                 return NULL;
3736
3737         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
3738         if (!v)
3739                 return ERR_PTR(-ENODEV);
3740
3741         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
3742                 ret = -EINVAL;
3743                 goto error;
3744         }
3745
3746         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
3747             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3748             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
3749                 ret = -EINVAL;
3750                 goto error;
3751         }
3752
3753         if (!netif_running(v)) {
3754                 ret = -ENETDOWN;
3755                 goto error;
3756         }
3757
3758         return v;
3759  error:
3760         dev_put(v);
3761         return ERR_PTR(ret);
3762 }
3763
3764 static struct nla_policy
3765 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
3766         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
3767         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
3768 };
3769
3770 static int nl80211_parse_sta_wme(struct genl_info *info,
3771                                  struct station_parameters *params)
3772 {
3773         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
3774         struct nlattr *nla;
3775         int err;
3776
3777         /* parse WME attributes if present */
3778         if (!info->attrs[NL80211_ATTR_STA_WME])
3779                 return 0;
3780
3781         nla = info->attrs[NL80211_ATTR_STA_WME];
3782         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
3783                                nl80211_sta_wme_policy);
3784         if (err)
3785                 return err;
3786
3787         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
3788                 params->uapsd_queues = nla_get_u8(
3789                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
3790         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
3791                 return -EINVAL;
3792
3793         if (tb[NL80211_STA_WME_MAX_SP])
3794                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
3795
3796         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
3797                 return -EINVAL;
3798
3799         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
3800
3801         return 0;
3802 }
3803
3804 static int nl80211_set_station_tdls(struct genl_info *info,
3805                                     struct station_parameters *params)
3806 {
3807         /* Dummy STA entry gets updated once the peer capabilities are known */
3808         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3809                 params->ht_capa =
3810                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3811         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
3812                 params->vht_capa =
3813                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
3814
3815         return nl80211_parse_sta_wme(info, params);
3816 }
3817
3818 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
3819 {
3820         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3821         struct net_device *dev = info->user_ptr[1];
3822         struct station_parameters params;
3823         u8 *mac_addr;
3824         int err;
3825
3826         memset(&params, 0, sizeof(params));
3827
3828         params.listen_interval = -1;
3829
3830         if (!rdev->ops->change_station)
3831                 return -EOPNOTSUPP;
3832
3833         if (info->attrs[NL80211_ATTR_STA_AID])
3834                 return -EINVAL;
3835
3836         if (!info->attrs[NL80211_ATTR_MAC])
3837                 return -EINVAL;
3838
3839         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3840
3841         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
3842                 params.supported_rates =
3843                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3844                 params.supported_rates_len =
3845                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3846         }
3847
3848         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
3849                 params.capability =
3850                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
3851                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
3852         }
3853
3854         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
3855                 params.ext_capab =
3856                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3857                 params.ext_capab_len =
3858                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3859         }
3860
3861         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3862                 return -EINVAL;
3863
3864         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3865                 return -EINVAL;
3866
3867         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
3868                 params.plink_action =
3869                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3870                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
3871                         return -EINVAL;
3872         }
3873
3874         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
3875                 params.plink_state =
3876                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
3877                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
3878                         return -EINVAL;
3879                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
3880         }
3881
3882         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
3883                 enum nl80211_mesh_power_mode pm = nla_get_u32(
3884                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
3885
3886                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
3887                     pm > NL80211_MESH_POWER_MAX)
3888                         return -EINVAL;
3889
3890                 params.local_pm = pm;
3891         }
3892
3893         /* Include parameters for TDLS peer (will check later) */
3894         err = nl80211_set_station_tdls(info, &params);
3895         if (err)
3896                 return err;
3897
3898         params.vlan = get_vlan(info, rdev);
3899         if (IS_ERR(params.vlan))
3900                 return PTR_ERR(params.vlan);
3901
3902         switch (dev->ieee80211_ptr->iftype) {
3903         case NL80211_IFTYPE_AP:
3904         case NL80211_IFTYPE_AP_VLAN:
3905         case NL80211_IFTYPE_P2P_GO:
3906         case NL80211_IFTYPE_P2P_CLIENT:
3907         case NL80211_IFTYPE_STATION:
3908         case NL80211_IFTYPE_ADHOC:
3909         case NL80211_IFTYPE_MESH_POINT:
3910                 break;
3911         default:
3912                 err = -EOPNOTSUPP;
3913                 goto out_put_vlan;
3914         }
3915
3916         /* driver will call cfg80211_check_station_change() */
3917         err = rdev_change_station(rdev, dev, mac_addr, &params);
3918
3919  out_put_vlan:
3920         if (params.vlan)
3921                 dev_put(params.vlan);
3922
3923         return err;
3924 }
3925
3926 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
3927 {
3928         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3929         int err;
3930         struct net_device *dev = info->user_ptr[1];
3931         struct station_parameters params;
3932         u8 *mac_addr = NULL;
3933
3934         memset(&params, 0, sizeof(params));
3935
3936         if (!rdev->ops->add_station)
3937                 return -EOPNOTSUPP;
3938
3939         if (!info->attrs[NL80211_ATTR_MAC])
3940                 return -EINVAL;
3941
3942         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3943                 return -EINVAL;
3944
3945         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
3946                 return -EINVAL;
3947
3948         if (!info->attrs[NL80211_ATTR_STA_AID])
3949                 return -EINVAL;
3950
3951         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3952         params.supported_rates =
3953                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3954         params.supported_rates_len =
3955                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3956         params.listen_interval =
3957                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
3958
3959         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
3960         if (!params.aid || params.aid > IEEE80211_MAX_AID)
3961                 return -EINVAL;
3962
3963         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
3964                 params.capability =
3965                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
3966                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
3967         }
3968
3969         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
3970                 params.ext_capab =
3971                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3972                 params.ext_capab_len =
3973                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3974         }
3975
3976         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3977                 params.ht_capa =
3978                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3979
3980         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
3981                 params.vht_capa =
3982                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
3983
3984         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
3985                 params.plink_action =
3986                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3987                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
3988                         return -EINVAL;
3989         }
3990
3991         err = nl80211_parse_sta_wme(info, &params);
3992         if (err)
3993                 return err;
3994
3995         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3996                 return -EINVAL;
3997
3998         /* When you run into this, adjust the code below for the new flag */
3999         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4000
4001         switch (dev->ieee80211_ptr->iftype) {
4002         case NL80211_IFTYPE_AP:
4003         case NL80211_IFTYPE_AP_VLAN:
4004         case NL80211_IFTYPE_P2P_GO:
4005                 /* ignore WME attributes if iface/sta is not capable */
4006                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
4007                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
4008                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4009
4010                 /* TDLS peers cannot be added */
4011                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4012                         return -EINVAL;
4013                 /* but don't bother the driver with it */
4014                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4015
4016                 /* allow authenticated/associated only if driver handles it */
4017                 if (!(rdev->wiphy.features &
4018                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4019                     params.sta_flags_mask &
4020                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4021                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4022                         return -EINVAL;
4023
4024                 /* must be last in here for error handling */
4025                 params.vlan = get_vlan(info, rdev);
4026                 if (IS_ERR(params.vlan))
4027                         return PTR_ERR(params.vlan);
4028                 break;
4029         case NL80211_IFTYPE_MESH_POINT:
4030                 /* ignore uAPSD data */
4031                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4032
4033                 /* associated is disallowed */
4034                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
4035                         return -EINVAL;
4036                 /* TDLS peers cannot be added */
4037                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4038                         return -EINVAL;
4039                 break;
4040         case NL80211_IFTYPE_STATION:
4041                 /* ignore uAPSD data */
4042                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4043
4044                 /* these are disallowed */
4045                 if (params.sta_flags_mask &
4046                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
4047                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4048                         return -EINVAL;
4049                 /* Only TDLS peers can be added */
4050                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4051                         return -EINVAL;
4052                 /* Can only add if TDLS ... */
4053                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
4054                         return -EOPNOTSUPP;
4055                 /* ... with external setup is supported */
4056                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
4057                         return -EOPNOTSUPP;
4058                 /*
4059                  * Older wpa_supplicant versions always mark the TDLS peer
4060                  * as authorized, but it shouldn't yet be.
4061                  */
4062                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4063                 break;
4064         default:
4065                 return -EOPNOTSUPP;
4066         }
4067
4068         /* be aware of params.vlan when changing code here */
4069
4070         err = rdev_add_station(rdev, dev, mac_addr, &params);
4071
4072         if (params.vlan)
4073                 dev_put(params.vlan);
4074         return err;
4075 }
4076
4077 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
4078 {
4079         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4080         struct net_device *dev = info->user_ptr[1];
4081         u8 *mac_addr = NULL;
4082
4083         if (info->attrs[NL80211_ATTR_MAC])
4084                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4085
4086         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4087             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4088             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4089             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4090                 return -EINVAL;
4091
4092         if (!rdev->ops->del_station)
4093                 return -EOPNOTSUPP;
4094
4095         return rdev_del_station(rdev, dev, mac_addr);
4096 }
4097
4098 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4099                                 int flags, struct net_device *dev,
4100                                 u8 *dst, u8 *next_hop,
4101                                 struct mpath_info *pinfo)
4102 {
4103         void *hdr;
4104         struct nlattr *pinfoattr;
4105
4106         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
4107         if (!hdr)
4108                 return -1;
4109
4110         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4111             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
4112             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
4113             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
4114                 goto nla_put_failure;
4115
4116         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
4117         if (!pinfoattr)
4118                 goto nla_put_failure;
4119         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
4120             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
4121                         pinfo->frame_qlen))
4122                 goto nla_put_failure;
4123         if (((pinfo->filled & MPATH_INFO_SN) &&
4124              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
4125             ((pinfo->filled & MPATH_INFO_METRIC) &&
4126              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
4127                          pinfo->metric)) ||
4128             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
4129              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
4130                          pinfo->exptime)) ||
4131             ((pinfo->filled & MPATH_INFO_FLAGS) &&
4132              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
4133                         pinfo->flags)) ||
4134             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
4135              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
4136                          pinfo->discovery_timeout)) ||
4137             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
4138              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
4139                         pinfo->discovery_retries)))
4140                 goto nla_put_failure;
4141
4142         nla_nest_end(msg, pinfoattr);
4143
4144         return genlmsg_end(msg, hdr);
4145
4146  nla_put_failure:
4147         genlmsg_cancel(msg, hdr);
4148         return -EMSGSIZE;
4149 }
4150
4151 static int nl80211_dump_mpath(struct sk_buff *skb,
4152                               struct netlink_callback *cb)
4153 {
4154         struct mpath_info pinfo;
4155         struct cfg80211_registered_device *dev;
4156         struct net_device *netdev;
4157         u8 dst[ETH_ALEN];
4158         u8 next_hop[ETH_ALEN];
4159         int path_idx = cb->args[1];
4160         int err;
4161
4162         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
4163         if (err)
4164                 return err;
4165
4166         if (!dev->ops->dump_mpath) {
4167                 err = -EOPNOTSUPP;
4168                 goto out_err;
4169         }
4170
4171         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
4172                 err = -EOPNOTSUPP;
4173                 goto out_err;
4174         }
4175
4176         while (1) {
4177                 err = rdev_dump_mpath(dev, netdev, path_idx, dst, next_hop,
4178                                       &pinfo);
4179                 if (err == -ENOENT)
4180                         break;
4181                 if (err)
4182                         goto out_err;
4183
4184                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4185                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4186                                        netdev, dst, next_hop,
4187                                        &pinfo) < 0)
4188                         goto out;
4189
4190                 path_idx++;
4191         }
4192
4193
4194  out:
4195         cb->args[1] = path_idx;
4196         err = skb->len;
4197  out_err:
4198         nl80211_finish_netdev_dump(dev);
4199         return err;
4200 }
4201
4202 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
4203 {
4204         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4205         int err;
4206         struct net_device *dev = info->user_ptr[1];
4207         struct mpath_info pinfo;
4208         struct sk_buff *msg;
4209         u8 *dst = NULL;
4210         u8 next_hop[ETH_ALEN];
4211
4212         memset(&pinfo, 0, sizeof(pinfo));
4213
4214         if (!info->attrs[NL80211_ATTR_MAC])
4215                 return -EINVAL;
4216
4217         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4218
4219         if (!rdev->ops->get_mpath)
4220                 return -EOPNOTSUPP;
4221
4222         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4223                 return -EOPNOTSUPP;
4224
4225         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4226         if (err)
4227                 return err;
4228
4229         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4230         if (!msg)
4231                 return -ENOMEM;
4232
4233         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4234                                  dev, dst, next_hop, &pinfo) < 0) {
4235                 nlmsg_free(msg);
4236                 return -ENOBUFS;
4237         }
4238
4239         return genlmsg_reply(msg, info);
4240 }
4241
4242 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
4243 {
4244         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4245         struct net_device *dev = info->user_ptr[1];
4246         u8 *dst = NULL;
4247         u8 *next_hop = NULL;
4248
4249         if (!info->attrs[NL80211_ATTR_MAC])
4250                 return -EINVAL;
4251
4252         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4253                 return -EINVAL;
4254
4255         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4256         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4257
4258         if (!rdev->ops->change_mpath)
4259                 return -EOPNOTSUPP;
4260
4261         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4262                 return -EOPNOTSUPP;
4263
4264         return rdev_change_mpath(rdev, dev, dst, next_hop);
4265 }
4266
4267 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
4268 {
4269         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4270         struct net_device *dev = info->user_ptr[1];
4271         u8 *dst = NULL;
4272         u8 *next_hop = NULL;
4273
4274         if (!info->attrs[NL80211_ATTR_MAC])
4275                 return -EINVAL;
4276
4277         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4278                 return -EINVAL;
4279
4280         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4281         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4282
4283         if (!rdev->ops->add_mpath)
4284                 return -EOPNOTSUPP;
4285
4286         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4287                 return -EOPNOTSUPP;
4288
4289         return rdev_add_mpath(rdev, dev, dst, next_hop);
4290 }
4291
4292 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
4293 {
4294         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4295         struct net_device *dev = info->user_ptr[1];
4296         u8 *dst = NULL;
4297
4298         if (info->attrs[NL80211_ATTR_MAC])
4299                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4300
4301         if (!rdev->ops->del_mpath)
4302                 return -EOPNOTSUPP;
4303
4304         return rdev_del_mpath(rdev, dev, dst);
4305 }
4306
4307 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
4308 {
4309         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4310         struct net_device *dev = info->user_ptr[1];
4311         struct bss_parameters params;
4312
4313         memset(&params, 0, sizeof(params));
4314         /* default to not changing parameters */
4315         params.use_cts_prot = -1;
4316         params.use_short_preamble = -1;
4317         params.use_short_slot_time = -1;
4318         params.ap_isolate = -1;
4319         params.ht_opmode = -1;
4320         params.p2p_ctwindow = -1;
4321         params.p2p_opp_ps = -1;
4322
4323         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
4324                 params.use_cts_prot =
4325                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
4326         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
4327                 params.use_short_preamble =
4328                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
4329         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
4330                 params.use_short_slot_time =
4331                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4332         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4333                 params.basic_rates =
4334                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4335                 params.basic_rates_len =
4336                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4337         }
4338         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
4339                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4340         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
4341                 params.ht_opmode =
4342                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4343
4344         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4345                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4346                         return -EINVAL;
4347                 params.p2p_ctwindow =
4348                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4349                 if (params.p2p_ctwindow < 0)
4350                         return -EINVAL;
4351                 if (params.p2p_ctwindow != 0 &&
4352                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4353                         return -EINVAL;
4354         }
4355
4356         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4357                 u8 tmp;
4358
4359                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4360                         return -EINVAL;
4361                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4362                 if (tmp > 1)
4363                         return -EINVAL;
4364                 params.p2p_opp_ps = tmp;
4365                 if (params.p2p_opp_ps &&
4366                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4367                         return -EINVAL;
4368         }
4369
4370         if (!rdev->ops->change_bss)
4371                 return -EOPNOTSUPP;
4372
4373         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4374             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4375                 return -EOPNOTSUPP;
4376
4377         return rdev_change_bss(rdev, dev, &params);
4378 }
4379
4380 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
4381         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
4382         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
4383         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
4384         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
4385         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
4386         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
4387 };
4388
4389 static int parse_reg_rule(struct nlattr *tb[],
4390         struct ieee80211_reg_rule *reg_rule)
4391 {
4392         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
4393         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
4394
4395         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
4396                 return -EINVAL;
4397         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
4398                 return -EINVAL;
4399         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
4400                 return -EINVAL;
4401         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
4402                 return -EINVAL;
4403         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
4404                 return -EINVAL;
4405
4406         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
4407
4408         freq_range->start_freq_khz =
4409                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
4410         freq_range->end_freq_khz =
4411                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
4412         freq_range->max_bandwidth_khz =
4413                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
4414
4415         power_rule->max_eirp =
4416                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
4417
4418         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
4419                 power_rule->max_antenna_gain =
4420                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
4421
4422         return 0;
4423 }
4424
4425 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
4426 {
4427         int r;
4428         char *data = NULL;
4429         enum nl80211_user_reg_hint_type user_reg_hint_type;
4430
4431         /*
4432          * You should only get this when cfg80211 hasn't yet initialized
4433          * completely when built-in to the kernel right between the time
4434          * window between nl80211_init() and regulatory_init(), if that is
4435          * even possible.
4436          */
4437         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4438                 return -EINPROGRESS;
4439
4440         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4441                 return -EINVAL;
4442
4443         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4444
4445         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
4446                 user_reg_hint_type =
4447                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
4448         else
4449                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
4450
4451         switch (user_reg_hint_type) {
4452         case NL80211_USER_REG_HINT_USER:
4453         case NL80211_USER_REG_HINT_CELL_BASE:
4454                 break;
4455         default:
4456                 return -EINVAL;
4457         }
4458
4459         r = regulatory_hint_user(data, user_reg_hint_type);
4460
4461         return r;
4462 }
4463
4464 static int nl80211_get_mesh_config(struct sk_buff *skb,
4465                                    struct genl_info *info)
4466 {
4467         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4468         struct net_device *dev = info->user_ptr[1];
4469         struct wireless_dev *wdev = dev->ieee80211_ptr;
4470         struct mesh_config cur_params;
4471         int err = 0;
4472         void *hdr;
4473         struct nlattr *pinfoattr;
4474         struct sk_buff *msg;
4475
4476         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4477                 return -EOPNOTSUPP;
4478
4479         if (!rdev->ops->get_mesh_config)
4480                 return -EOPNOTSUPP;
4481
4482         wdev_lock(wdev);
4483         /* If not connected, get default parameters */
4484         if (!wdev->mesh_id_len)
4485                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
4486         else
4487                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
4488         wdev_unlock(wdev);
4489
4490         if (err)
4491                 return err;
4492
4493         /* Draw up a netlink message to send back */
4494         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4495         if (!msg)
4496                 return -ENOMEM;
4497         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4498                              NL80211_CMD_GET_MESH_CONFIG);
4499         if (!hdr)
4500                 goto out;
4501         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
4502         if (!pinfoattr)
4503                 goto nla_put_failure;
4504         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4505             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
4506                         cur_params.dot11MeshRetryTimeout) ||
4507             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4508                         cur_params.dot11MeshConfirmTimeout) ||
4509             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
4510                         cur_params.dot11MeshHoldingTimeout) ||
4511             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
4512                         cur_params.dot11MeshMaxPeerLinks) ||
4513             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
4514                        cur_params.dot11MeshMaxRetries) ||
4515             nla_put_u8(msg, NL80211_MESHCONF_TTL,
4516                        cur_params.dot11MeshTTL) ||
4517             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
4518                        cur_params.element_ttl) ||
4519             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4520                        cur_params.auto_open_plinks) ||
4521             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4522                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
4523             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4524                        cur_params.dot11MeshHWMPmaxPREQretries) ||
4525             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
4526                         cur_params.path_refresh_time) ||
4527             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4528                         cur_params.min_discovery_timeout) ||
4529             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4530                         cur_params.dot11MeshHWMPactivePathTimeout) ||
4531             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4532                         cur_params.dot11MeshHWMPpreqMinInterval) ||
4533             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4534                         cur_params.dot11MeshHWMPperrMinInterval) ||
4535             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4536                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
4537             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
4538                        cur_params.dot11MeshHWMPRootMode) ||
4539             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4540                         cur_params.dot11MeshHWMPRannInterval) ||
4541             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4542                        cur_params.dot11MeshGateAnnouncementProtocol) ||
4543             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
4544                        cur_params.dot11MeshForwarding) ||
4545             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
4546                         cur_params.rssi_threshold) ||
4547             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
4548                         cur_params.ht_opmode) ||
4549             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4550                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
4551             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4552                         cur_params.dot11MeshHWMProotInterval) ||
4553             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4554                         cur_params.dot11MeshHWMPconfirmationInterval) ||
4555             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
4556                         cur_params.power_mode) ||
4557             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
4558                         cur_params.dot11MeshAwakeWindowDuration))
4559                 goto nla_put_failure;
4560         nla_nest_end(msg, pinfoattr);
4561         genlmsg_end(msg, hdr);
4562         return genlmsg_reply(msg, info);
4563
4564  nla_put_failure:
4565         genlmsg_cancel(msg, hdr);
4566  out:
4567         nlmsg_free(msg);
4568         return -ENOBUFS;
4569 }
4570
4571 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
4572         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
4573         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
4574         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
4575         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
4576         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
4577         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
4578         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
4579         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
4580         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
4581         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
4582         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
4583         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
4584         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
4585         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
4586         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
4587         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
4588         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
4589         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
4590         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
4591         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
4592         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
4593         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
4594         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
4595         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
4596         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
4597         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
4598         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
4599 };
4600
4601 static const struct nla_policy
4602         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
4603         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
4604         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
4605         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
4606         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
4607         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
4608                                     .len = IEEE80211_MAX_DATA_LEN },
4609         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
4610 };
4611
4612 static int nl80211_parse_mesh_config(struct genl_info *info,
4613                                      struct mesh_config *cfg,
4614                                      u32 *mask_out)
4615 {
4616         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
4617         u32 mask = 0;
4618
4619 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
4620 do {                                                                        \
4621         if (tb[attr]) {                                                     \
4622                 if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
4623                         return -EINVAL;                                     \
4624                 cfg->param = fn(tb[attr]);                                  \
4625                 mask |= (1 << (attr - 1));                                  \
4626         }                                                                   \
4627 } while (0)
4628
4629
4630         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
4631                 return -EINVAL;
4632         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
4633                              info->attrs[NL80211_ATTR_MESH_CONFIG],
4634                              nl80211_meshconf_params_policy))
4635                 return -EINVAL;
4636
4637         /* This makes sure that there aren't more than 32 mesh config
4638          * parameters (otherwise our bitfield scheme would not work.) */
4639         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
4640
4641         /* Fill in the params struct */
4642         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
4643                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
4644                                   nla_get_u16);
4645         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
4646                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4647                                   nla_get_u16);
4648         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
4649                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
4650                                   nla_get_u16);
4651         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
4652                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
4653                                   nla_get_u16);
4654         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
4655                                   mask, NL80211_MESHCONF_MAX_RETRIES,
4656                                   nla_get_u8);
4657         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
4658                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
4659         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
4660                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
4661                                   nla_get_u8);
4662         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
4663                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4664                                   nla_get_u8);
4665         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
4666                                   1, 255, mask,
4667                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4668                                   nla_get_u32);
4669         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
4670                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4671                                   nla_get_u8);
4672         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
4673                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
4674                                   nla_get_u32);
4675         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
4676                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4677                                   nla_get_u16);
4678         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
4679                                   1, 65535, mask,
4680                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4681                                   nla_get_u32);
4682         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
4683                                   1, 65535, mask,
4684                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4685                                   nla_get_u16);
4686         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
4687                                   1, 65535, mask,
4688                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4689                                   nla_get_u16);
4690         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4691                                   dot11MeshHWMPnetDiameterTraversalTime,
4692                                   1, 65535, mask,
4693                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4694                                   nla_get_u16);
4695         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
4696                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
4697                                   nla_get_u8);
4698         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
4699                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4700                                   nla_get_u16);
4701         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4702                                   dot11MeshGateAnnouncementProtocol, 0, 1,
4703                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4704                                   nla_get_u8);
4705         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
4706                                   mask, NL80211_MESHCONF_FORWARDING,
4707                                   nla_get_u8);
4708         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, 1, 255,
4709                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
4710                                   nla_get_u32);
4711         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
4712                                   mask, NL80211_MESHCONF_HT_OPMODE,
4713                                   nla_get_u16);
4714         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
4715                                   1, 65535, mask,
4716                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4717                                   nla_get_u32);
4718         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
4719                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4720                                   nla_get_u16);
4721         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4722                                   dot11MeshHWMPconfirmationInterval,
4723                                   1, 65535, mask,
4724                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4725                                   nla_get_u16);
4726         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
4727                                   NL80211_MESH_POWER_ACTIVE,
4728                                   NL80211_MESH_POWER_MAX,
4729                                   mask, NL80211_MESHCONF_POWER_MODE,
4730                                   nla_get_u32);
4731         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
4732                                   0, 65535, mask,
4733                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
4734         if (mask_out)
4735                 *mask_out = mask;
4736
4737         return 0;
4738
4739 #undef FILL_IN_MESH_PARAM_IF_SET
4740 }
4741
4742 static int nl80211_parse_mesh_setup(struct genl_info *info,
4743                                      struct mesh_setup *setup)
4744 {
4745         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
4746
4747         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
4748                 return -EINVAL;
4749         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
4750                              info->attrs[NL80211_ATTR_MESH_SETUP],
4751                              nl80211_mesh_setup_params_policy))
4752                 return -EINVAL;
4753
4754         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
4755                 setup->sync_method =
4756                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
4757                  IEEE80211_SYNC_METHOD_VENDOR :
4758                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
4759
4760         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
4761                 setup->path_sel_proto =
4762                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
4763                  IEEE80211_PATH_PROTOCOL_VENDOR :
4764                  IEEE80211_PATH_PROTOCOL_HWMP;
4765
4766         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
4767                 setup->path_metric =
4768                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
4769                  IEEE80211_PATH_METRIC_VENDOR :
4770                  IEEE80211_PATH_METRIC_AIRTIME;
4771
4772
4773         if (tb[NL80211_MESH_SETUP_IE]) {
4774                 struct nlattr *ieattr =
4775                         tb[NL80211_MESH_SETUP_IE];
4776                 if (!is_valid_ie_attr(ieattr))
4777                         return -EINVAL;
4778                 setup->ie = nla_data(ieattr);
4779                 setup->ie_len = nla_len(ieattr);
4780         }
4781         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
4782         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
4783
4784         return 0;
4785 }
4786
4787 static int nl80211_update_mesh_config(struct sk_buff *skb,
4788                                       struct genl_info *info)
4789 {
4790         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4791         struct net_device *dev = info->user_ptr[1];
4792         struct wireless_dev *wdev = dev->ieee80211_ptr;
4793         struct mesh_config cfg;
4794         u32 mask;
4795         int err;
4796
4797         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4798                 return -EOPNOTSUPP;
4799
4800         if (!rdev->ops->update_mesh_config)
4801                 return -EOPNOTSUPP;
4802
4803         err = nl80211_parse_mesh_config(info, &cfg, &mask);
4804         if (err)
4805                 return err;
4806
4807         wdev_lock(wdev);
4808         if (!wdev->mesh_id_len)
4809                 err = -ENOLINK;
4810
4811         if (!err)
4812                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
4813
4814         wdev_unlock(wdev);
4815
4816         return err;
4817 }
4818
4819 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
4820 {
4821         const struct ieee80211_regdomain *regdom;
4822         struct sk_buff *msg;
4823         void *hdr = NULL;
4824         struct nlattr *nl_reg_rules;
4825         unsigned int i;
4826         int err = -EINVAL;
4827
4828         mutex_lock(&cfg80211_mutex);
4829
4830         if (!cfg80211_regdomain)
4831                 goto out;
4832
4833         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4834         if (!msg) {
4835                 err = -ENOBUFS;
4836                 goto out;
4837         }
4838
4839         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4840                              NL80211_CMD_GET_REG);
4841         if (!hdr)
4842                 goto put_failure;
4843
4844         if (reg_last_request_cell_base() &&
4845             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
4846                         NL80211_USER_REG_HINT_CELL_BASE))
4847                 goto nla_put_failure;
4848
4849         rcu_read_lock();
4850         regdom = rcu_dereference(cfg80211_regdomain);
4851
4852         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
4853             (regdom->dfs_region &&
4854              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
4855                 goto nla_put_failure_rcu;
4856
4857         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
4858         if (!nl_reg_rules)
4859                 goto nla_put_failure_rcu;
4860
4861         for (i = 0; i < regdom->n_reg_rules; i++) {
4862                 struct nlattr *nl_reg_rule;
4863                 const struct ieee80211_reg_rule *reg_rule;
4864                 const struct ieee80211_freq_range *freq_range;
4865                 const struct ieee80211_power_rule *power_rule;
4866
4867                 reg_rule = &regdom->reg_rules[i];
4868                 freq_range = &reg_rule->freq_range;
4869                 power_rule = &reg_rule->power_rule;
4870
4871                 nl_reg_rule = nla_nest_start(msg, i);
4872                 if (!nl_reg_rule)
4873                         goto nla_put_failure_rcu;
4874
4875                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
4876                                 reg_rule->flags) ||
4877                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
4878                                 freq_range->start_freq_khz) ||
4879                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
4880                                 freq_range->end_freq_khz) ||
4881                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
4882                                 freq_range->max_bandwidth_khz) ||
4883                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
4884                                 power_rule->max_antenna_gain) ||
4885                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
4886                                 power_rule->max_eirp))
4887                         goto nla_put_failure_rcu;
4888
4889                 nla_nest_end(msg, nl_reg_rule);
4890         }
4891         rcu_read_unlock();
4892
4893         nla_nest_end(msg, nl_reg_rules);
4894
4895         genlmsg_end(msg, hdr);
4896         err = genlmsg_reply(msg, info);
4897         goto out;
4898
4899 nla_put_failure_rcu:
4900         rcu_read_unlock();
4901 nla_put_failure:
4902         genlmsg_cancel(msg, hdr);
4903 put_failure:
4904         nlmsg_free(msg);
4905         err = -EMSGSIZE;
4906 out:
4907         mutex_unlock(&cfg80211_mutex);
4908         return err;
4909 }
4910
4911 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
4912 {
4913         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
4914         struct nlattr *nl_reg_rule;
4915         char *alpha2 = NULL;
4916         int rem_reg_rules = 0, r = 0;
4917         u32 num_rules = 0, rule_idx = 0, size_of_regd;
4918         u8 dfs_region = 0;
4919         struct ieee80211_regdomain *rd = NULL;
4920
4921         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4922                 return -EINVAL;
4923
4924         if (!info->attrs[NL80211_ATTR_REG_RULES])
4925                 return -EINVAL;
4926
4927         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4928
4929         if (info->attrs[NL80211_ATTR_DFS_REGION])
4930                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
4931
4932         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
4933                             rem_reg_rules) {
4934                 num_rules++;
4935                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
4936                         return -EINVAL;
4937         }
4938
4939         size_of_regd = sizeof(struct ieee80211_regdomain) +
4940                        num_rules * sizeof(struct ieee80211_reg_rule);
4941
4942         rd = kzalloc(size_of_regd, GFP_KERNEL);
4943         if (!rd)
4944                 return -ENOMEM;
4945
4946         rd->n_reg_rules = num_rules;
4947         rd->alpha2[0] = alpha2[0];
4948         rd->alpha2[1] = alpha2[1];
4949
4950         /*
4951          * Disable DFS master mode if the DFS region was
4952          * not supported or known on this kernel.
4953          */
4954         if (reg_supported_dfs_region(dfs_region))
4955                 rd->dfs_region = dfs_region;
4956
4957         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
4958                             rem_reg_rules) {
4959                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
4960                           nla_data(nl_reg_rule), nla_len(nl_reg_rule),
4961                           reg_rule_policy);
4962                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
4963                 if (r)
4964                         goto bad_reg;
4965
4966                 rule_idx++;
4967
4968                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
4969                         r = -EINVAL;
4970                         goto bad_reg;
4971                 }
4972         }
4973
4974         mutex_lock(&cfg80211_mutex);
4975
4976         r = set_regdom(rd);
4977         /* set_regdom took ownership */
4978         rd = NULL;
4979         mutex_unlock(&cfg80211_mutex);
4980
4981  bad_reg:
4982         kfree(rd);
4983         return r;
4984 }
4985
4986 static int validate_scan_freqs(struct nlattr *freqs)
4987 {
4988         struct nlattr *attr1, *attr2;
4989         int n_channels = 0, tmp1, tmp2;
4990
4991         nla_for_each_nested(attr1, freqs, tmp1) {
4992                 n_channels++;
4993                 /*
4994                  * Some hardware has a limited channel list for
4995                  * scanning, and it is pretty much nonsensical
4996                  * to scan for a channel twice, so disallow that
4997                  * and don't require drivers to check that the
4998                  * channel list they get isn't longer than what
4999                  * they can scan, as long as they can scan all
5000                  * the channels they registered at once.
5001                  */
5002                 nla_for_each_nested(attr2, freqs, tmp2)
5003                         if (attr1 != attr2 &&
5004                             nla_get_u32(attr1) == nla_get_u32(attr2))
5005                                 return 0;
5006         }
5007
5008         return n_channels;
5009 }
5010
5011 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
5012 {
5013         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5014         struct wireless_dev *wdev = info->user_ptr[1];
5015         struct cfg80211_scan_request *request;
5016         struct nlattr *attr;
5017         struct wiphy *wiphy;
5018         int err, tmp, n_ssids = 0, n_channels, i;
5019         size_t ie_len;
5020
5021         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5022                 return -EINVAL;
5023
5024         wiphy = &rdev->wiphy;
5025
5026         if (!rdev->ops->scan)
5027                 return -EOPNOTSUPP;
5028
5029         if (rdev->scan_req)
5030                 return -EBUSY;
5031
5032         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5033                 n_channels = validate_scan_freqs(
5034                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5035                 if (!n_channels)
5036                         return -EINVAL;
5037         } else {
5038                 enum ieee80211_band band;
5039                 n_channels = 0;
5040
5041                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
5042                         if (wiphy->bands[band])
5043                                 n_channels += wiphy->bands[band]->n_channels;
5044         }
5045
5046         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5047                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
5048                         n_ssids++;
5049
5050         if (n_ssids > wiphy->max_scan_ssids)
5051                 return -EINVAL;
5052
5053         if (info->attrs[NL80211_ATTR_IE])
5054                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5055         else
5056                 ie_len = 0;
5057
5058         if (ie_len > wiphy->max_scan_ie_len)
5059                 return -EINVAL;
5060
5061         request = kzalloc(sizeof(*request)
5062                         + sizeof(*request->ssids) * n_ssids
5063                         + sizeof(*request->channels) * n_channels
5064                         + ie_len, GFP_KERNEL);
5065         if (!request)
5066                 return -ENOMEM;
5067
5068         if (n_ssids)
5069                 request->ssids = (void *)&request->channels[n_channels];
5070         request->n_ssids = n_ssids;
5071         if (ie_len) {
5072                 if (request->ssids)
5073                         request->ie = (void *)(request->ssids + n_ssids);
5074                 else
5075                         request->ie = (void *)(request->channels + n_channels);
5076         }
5077
5078         i = 0;
5079         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5080                 /* user specified, bail out if channel not found */
5081                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
5082                         struct ieee80211_channel *chan;
5083
5084                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5085
5086                         if (!chan) {
5087                                 err = -EINVAL;
5088                                 goto out_free;
5089                         }
5090
5091                         /* ignore disabled channels */
5092                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5093                                 continue;
5094
5095                         request->channels[i] = chan;
5096                         i++;
5097                 }
5098         } else {
5099                 enum ieee80211_band band;
5100
5101                 /* all channels */
5102                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5103                         int j;
5104                         if (!wiphy->bands[band])
5105                                 continue;
5106                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5107                                 struct ieee80211_channel *chan;
5108
5109                                 chan = &wiphy->bands[band]->channels[j];
5110
5111                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5112                                         continue;
5113
5114                                 request->channels[i] = chan;
5115                                 i++;
5116                         }
5117                 }
5118         }
5119
5120         if (!i) {
5121                 err = -EINVAL;
5122                 goto out_free;
5123         }
5124
5125         request->n_channels = i;
5126
5127         i = 0;
5128         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5129                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
5130                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5131                                 err = -EINVAL;
5132                                 goto out_free;
5133                         }
5134                         request->ssids[i].ssid_len = nla_len(attr);
5135                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
5136                         i++;
5137                 }
5138         }
5139
5140         if (info->attrs[NL80211_ATTR_IE]) {
5141                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5142                 memcpy((void *)request->ie,
5143                        nla_data(info->attrs[NL80211_ATTR_IE]),
5144                        request->ie_len);
5145         }
5146
5147         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
5148                 if (wiphy->bands[i])
5149                         request->rates[i] =
5150                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
5151
5152         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
5153                 nla_for_each_nested(attr,
5154                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
5155                                     tmp) {
5156                         enum ieee80211_band band = nla_type(attr);
5157
5158                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
5159                                 err = -EINVAL;
5160                                 goto out_free;
5161                         }
5162                         err = ieee80211_get_ratemask(wiphy->bands[band],
5163                                                      nla_data(attr),
5164                                                      nla_len(attr),
5165                                                      &request->rates[band]);
5166                         if (err)
5167                                 goto out_free;
5168                 }
5169         }
5170
5171         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5172                 request->flags = nla_get_u32(
5173                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5174                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5175                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
5176                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
5177                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
5178                         err = -EOPNOTSUPP;
5179                         goto out_free;
5180                 }
5181         }
5182
5183         request->no_cck =
5184                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
5185
5186         request->wdev = wdev;
5187         request->wiphy = &rdev->wiphy;
5188         request->scan_start = jiffies;
5189
5190         rdev->scan_req = request;
5191         err = rdev_scan(rdev, request);
5192
5193         if (!err) {
5194                 nl80211_send_scan_start(rdev, wdev);
5195                 if (wdev->netdev)
5196                         dev_hold(wdev->netdev);
5197         } else {
5198  out_free:
5199                 rdev->scan_req = NULL;
5200                 kfree(request);
5201         }
5202
5203         return err;
5204 }
5205
5206 static int nl80211_start_sched_scan(struct sk_buff *skb,
5207                                     struct genl_info *info)
5208 {
5209         struct cfg80211_sched_scan_request *request;
5210         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5211         struct net_device *dev = info->user_ptr[1];
5212         struct nlattr *attr;
5213         struct wiphy *wiphy;
5214         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
5215         u32 interval;
5216         enum ieee80211_band band;
5217         size_t ie_len;
5218         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
5219
5220         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5221             !rdev->ops->sched_scan_start)
5222                 return -EOPNOTSUPP;
5223
5224         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5225                 return -EINVAL;
5226
5227         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
5228                 return -EINVAL;
5229
5230         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
5231         if (interval == 0)
5232                 return -EINVAL;
5233
5234         wiphy = &rdev->wiphy;
5235
5236         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5237                 n_channels = validate_scan_freqs(
5238                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5239                 if (!n_channels)
5240                         return -EINVAL;
5241         } else {
5242                 n_channels = 0;
5243
5244                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
5245                         if (wiphy->bands[band])
5246                                 n_channels += wiphy->bands[band]->n_channels;
5247         }
5248
5249         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5250                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5251                                     tmp)
5252                         n_ssids++;
5253
5254         if (n_ssids > wiphy->max_sched_scan_ssids)
5255                 return -EINVAL;
5256
5257         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
5258                 nla_for_each_nested(attr,
5259                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5260                                     tmp)
5261                         n_match_sets++;
5262
5263         if (n_match_sets > wiphy->max_match_sets)
5264                 return -EINVAL;
5265
5266         if (info->attrs[NL80211_ATTR_IE])
5267                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5268         else
5269                 ie_len = 0;
5270
5271         if (ie_len > wiphy->max_sched_scan_ie_len)
5272                 return -EINVAL;
5273
5274         mutex_lock(&rdev->sched_scan_mtx);
5275
5276         if (rdev->sched_scan_req) {
5277                 err = -EINPROGRESS;
5278                 goto out;
5279         }
5280
5281         request = kzalloc(sizeof(*request)
5282                         + sizeof(*request->ssids) * n_ssids
5283                         + sizeof(*request->match_sets) * n_match_sets
5284                         + sizeof(*request->channels) * n_channels
5285                         + ie_len, GFP_KERNEL);
5286         if (!request) {
5287                 err = -ENOMEM;
5288                 goto out;
5289         }
5290
5291         if (n_ssids)
5292                 request->ssids = (void *)&request->channels[n_channels];
5293         request->n_ssids = n_ssids;
5294         if (ie_len) {
5295                 if (request->ssids)
5296                         request->ie = (void *)(request->ssids + n_ssids);
5297                 else
5298                         request->ie = (void *)(request->channels + n_channels);
5299         }
5300
5301         if (n_match_sets) {
5302                 if (request->ie)
5303                         request->match_sets = (void *)(request->ie + ie_len);
5304                 else if (request->ssids)
5305                         request->match_sets =
5306                                 (void *)(request->ssids + n_ssids);
5307                 else
5308                         request->match_sets =
5309                                 (void *)(request->channels + n_channels);
5310         }
5311         request->n_match_sets = n_match_sets;
5312
5313         i = 0;
5314         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5315                 /* user specified, bail out if channel not found */
5316                 nla_for_each_nested(attr,
5317                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
5318                                     tmp) {
5319                         struct ieee80211_channel *chan;
5320
5321                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5322
5323                         if (!chan) {
5324                                 err = -EINVAL;
5325                                 goto out_free;
5326                         }
5327
5328                         /* ignore disabled channels */
5329                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5330                                 continue;
5331
5332                         request->channels[i] = chan;
5333                         i++;
5334                 }
5335         } else {
5336                 /* all channels */
5337                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5338                         int j;
5339                         if (!wiphy->bands[band])
5340                                 continue;
5341                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5342                                 struct ieee80211_channel *chan;
5343
5344                                 chan = &wiphy->bands[band]->channels[j];
5345
5346                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5347                                         continue;
5348
5349                                 request->channels[i] = chan;
5350                                 i++;
5351                         }
5352                 }
5353         }
5354
5355         if (!i) {
5356                 err = -EINVAL;
5357                 goto out_free;
5358         }
5359
5360         request->n_channels = i;
5361
5362         i = 0;
5363         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5364                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5365                                     tmp) {
5366                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5367                                 err = -EINVAL;
5368                                 goto out_free;
5369                         }
5370                         request->ssids[i].ssid_len = nla_len(attr);
5371                         memcpy(request->ssids[i].ssid, nla_data(attr),
5372                                nla_len(attr));
5373                         i++;
5374                 }
5375         }
5376
5377         i = 0;
5378         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5379                 nla_for_each_nested(attr,
5380                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5381                                     tmp) {
5382                         struct nlattr *ssid, *rssi;
5383
5384                         nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5385                                   nla_data(attr), nla_len(attr),
5386                                   nl80211_match_policy);
5387                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
5388                         if (ssid) {
5389                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
5390                                         err = -EINVAL;
5391                                         goto out_free;
5392                                 }
5393                                 memcpy(request->match_sets[i].ssid.ssid,
5394                                        nla_data(ssid), nla_len(ssid));
5395                                 request->match_sets[i].ssid.ssid_len =
5396                                         nla_len(ssid);
5397                         }
5398                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5399                         if (rssi)
5400                                 request->rssi_thold = nla_get_u32(rssi);
5401                         else
5402                                 request->rssi_thold =
5403                                                    NL80211_SCAN_RSSI_THOLD_OFF;
5404                         i++;
5405                 }
5406         }
5407
5408         if (info->attrs[NL80211_ATTR_IE]) {
5409                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5410                 memcpy((void *)request->ie,
5411                        nla_data(info->attrs[NL80211_ATTR_IE]),
5412                        request->ie_len);
5413         }
5414
5415         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5416                 request->flags = nla_get_u32(
5417                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5418                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5419                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
5420                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
5421                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
5422                         err = -EOPNOTSUPP;
5423                         goto out_free;
5424                 }
5425         }
5426
5427         request->dev = dev;
5428         request->wiphy = &rdev->wiphy;
5429         request->interval = interval;
5430         request->scan_start = jiffies;
5431
5432         err = rdev_sched_scan_start(rdev, dev, request);
5433         if (!err) {
5434                 rdev->sched_scan_req = request;
5435                 nl80211_send_sched_scan(rdev, dev,
5436                                         NL80211_CMD_START_SCHED_SCAN);
5437                 goto out;
5438         }
5439
5440 out_free:
5441         kfree(request);
5442 out:
5443         mutex_unlock(&rdev->sched_scan_mtx);
5444         return err;
5445 }
5446
5447 static int nl80211_stop_sched_scan(struct sk_buff *skb,
5448                                    struct genl_info *info)
5449 {
5450         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5451         int err;
5452
5453         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5454             !rdev->ops->sched_scan_stop)
5455                 return -EOPNOTSUPP;
5456
5457         mutex_lock(&rdev->sched_scan_mtx);
5458         err = __cfg80211_stop_sched_scan(rdev, false);
5459         mutex_unlock(&rdev->sched_scan_mtx);
5460
5461         return err;
5462 }
5463
5464 static int nl80211_start_radar_detection(struct sk_buff *skb,
5465                                          struct genl_info *info)
5466 {
5467         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5468         struct net_device *dev = info->user_ptr[1];
5469         struct wireless_dev *wdev = dev->ieee80211_ptr;
5470         struct cfg80211_chan_def chandef;
5471         int err;
5472
5473         err = nl80211_parse_chandef(rdev, info, &chandef);
5474         if (err)
5475                 return err;
5476
5477         if (wdev->cac_started)
5478                 return -EBUSY;
5479
5480         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef);
5481         if (err < 0)
5482                 return err;
5483
5484         if (err == 0)
5485                 return -EINVAL;
5486
5487         if (chandef.chan->dfs_state != NL80211_DFS_USABLE)
5488                 return -EINVAL;
5489
5490         if (!rdev->ops->start_radar_detection)
5491                 return -EOPNOTSUPP;
5492
5493         mutex_lock(&rdev->devlist_mtx);
5494         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
5495                                            chandef.chan, CHAN_MODE_SHARED,
5496                                            BIT(chandef.width));
5497         if (err)
5498                 goto err_locked;
5499
5500         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef);
5501         if (!err) {
5502                 wdev->channel = chandef.chan;
5503                 wdev->cac_started = true;
5504                 wdev->cac_start_time = jiffies;
5505         }
5506 err_locked:
5507         mutex_unlock(&rdev->devlist_mtx);
5508
5509         return err;
5510 }
5511
5512 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
5513                             u32 seq, int flags,
5514                             struct cfg80211_registered_device *rdev,
5515                             struct wireless_dev *wdev,
5516                             struct cfg80211_internal_bss *intbss)
5517 {
5518         struct cfg80211_bss *res = &intbss->pub;
5519         const struct cfg80211_bss_ies *ies;
5520         void *hdr;
5521         struct nlattr *bss;
5522         bool tsf = false;
5523
5524         ASSERT_WDEV_LOCK(wdev);
5525
5526         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
5527                              NL80211_CMD_NEW_SCAN_RESULTS);
5528         if (!hdr)
5529                 return -1;
5530
5531         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
5532
5533         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation) ||
5534             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
5535                 goto nla_put_failure;
5536
5537         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
5538         if (!bss)
5539                 goto nla_put_failure;
5540         if ((!is_zero_ether_addr(res->bssid) &&
5541              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
5542                 goto nla_put_failure;
5543
5544         rcu_read_lock();
5545         ies = rcu_dereference(res->ies);
5546         if (ies) {
5547                 if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5548                         goto fail_unlock_rcu;
5549                 tsf = true;
5550                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
5551                                         ies->len, ies->data))
5552                         goto fail_unlock_rcu;
5553         }
5554         ies = rcu_dereference(res->beacon_ies);
5555         if (ies) {
5556                 if (!tsf && nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5557                         goto fail_unlock_rcu;
5558                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
5559                                         ies->len, ies->data))
5560                         goto fail_unlock_rcu;
5561         }
5562         rcu_read_unlock();
5563
5564         if (res->beacon_interval &&
5565             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
5566                 goto nla_put_failure;
5567         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
5568             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
5569             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
5570                         jiffies_to_msecs(jiffies - intbss->ts)))
5571                 goto nla_put_failure;
5572
5573         switch (rdev->wiphy.signal_type) {
5574         case CFG80211_SIGNAL_TYPE_MBM:
5575                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
5576                         goto nla_put_failure;
5577                 break;
5578         case CFG80211_SIGNAL_TYPE_UNSPEC:
5579                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
5580                         goto nla_put_failure;
5581                 break;
5582         default:
5583                 break;
5584         }
5585
5586         switch (wdev->iftype) {
5587         case NL80211_IFTYPE_P2P_CLIENT:
5588         case NL80211_IFTYPE_STATION:
5589                 if (intbss == wdev->current_bss &&
5590                     nla_put_u32(msg, NL80211_BSS_STATUS,
5591                                 NL80211_BSS_STATUS_ASSOCIATED))
5592                         goto nla_put_failure;
5593                 break;
5594         case NL80211_IFTYPE_ADHOC:
5595                 if (intbss == wdev->current_bss &&
5596                     nla_put_u32(msg, NL80211_BSS_STATUS,
5597                                 NL80211_BSS_STATUS_IBSS_JOINED))
5598                         goto nla_put_failure;
5599                 break;
5600         default:
5601                 break;
5602         }
5603
5604         nla_nest_end(msg, bss);
5605
5606         return genlmsg_end(msg, hdr);
5607
5608  fail_unlock_rcu:
5609         rcu_read_unlock();
5610  nla_put_failure:
5611         genlmsg_cancel(msg, hdr);
5612         return -EMSGSIZE;
5613 }
5614
5615 static int nl80211_dump_scan(struct sk_buff *skb,
5616                              struct netlink_callback *cb)
5617 {
5618         struct cfg80211_registered_device *rdev;
5619         struct net_device *dev;
5620         struct cfg80211_internal_bss *scan;
5621         struct wireless_dev *wdev;
5622         int start = cb->args[1], idx = 0;
5623         int err;
5624
5625         err = nl80211_prepare_netdev_dump(skb, cb, &rdev, &dev);
5626         if (err)
5627                 return err;
5628
5629         wdev = dev->ieee80211_ptr;
5630
5631         wdev_lock(wdev);
5632         spin_lock_bh(&rdev->bss_lock);
5633         cfg80211_bss_expire(rdev);
5634
5635         cb->seq = rdev->bss_generation;
5636
5637         list_for_each_entry(scan, &rdev->bss_list, list) {
5638                 if (++idx <= start)
5639                         continue;
5640                 if (nl80211_send_bss(skb, cb,
5641                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5642                                 rdev, wdev, scan) < 0) {
5643                         idx--;
5644                         break;
5645                 }
5646         }
5647
5648         spin_unlock_bh(&rdev->bss_lock);
5649         wdev_unlock(wdev);
5650
5651         cb->args[1] = idx;
5652         nl80211_finish_netdev_dump(rdev);
5653
5654         return skb->len;
5655 }
5656
5657 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
5658                                 int flags, struct net_device *dev,
5659                                 struct survey_info *survey)
5660 {
5661         void *hdr;
5662         struct nlattr *infoattr;
5663
5664         hdr = nl80211hdr_put(msg, portid, seq, flags,
5665                              NL80211_CMD_NEW_SURVEY_RESULTS);
5666         if (!hdr)
5667                 return -ENOMEM;
5668
5669         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
5670                 goto nla_put_failure;
5671
5672         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
5673         if (!infoattr)
5674                 goto nla_put_failure;
5675
5676         if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
5677                         survey->channel->center_freq))
5678                 goto nla_put_failure;
5679
5680         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
5681             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
5682                 goto nla_put_failure;
5683         if ((survey->filled & SURVEY_INFO_IN_USE) &&
5684             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
5685                 goto nla_put_failure;
5686         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
5687             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
5688                         survey->channel_time))
5689                 goto nla_put_failure;
5690         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
5691             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
5692                         survey->channel_time_busy))
5693                 goto nla_put_failure;
5694         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
5695             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
5696                         survey->channel_time_ext_busy))
5697                 goto nla_put_failure;
5698         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
5699             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
5700                         survey->channel_time_rx))
5701                 goto nla_put_failure;
5702         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
5703             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
5704                         survey->channel_time_tx))
5705                 goto nla_put_failure;
5706
5707         nla_nest_end(msg, infoattr);
5708
5709         return genlmsg_end(msg, hdr);
5710
5711  nla_put_failure:
5712         genlmsg_cancel(msg, hdr);
5713         return -EMSGSIZE;
5714 }
5715
5716 static int nl80211_dump_survey(struct sk_buff *skb,
5717                         struct netlink_callback *cb)
5718 {
5719         struct survey_info survey;
5720         struct cfg80211_registered_device *dev;
5721         struct net_device *netdev;
5722         int survey_idx = cb->args[1];
5723         int res;
5724
5725         res = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
5726         if (res)
5727                 return res;
5728
5729         if (!dev->ops->dump_survey) {
5730                 res = -EOPNOTSUPP;
5731                 goto out_err;
5732         }
5733
5734         while (1) {
5735                 struct ieee80211_channel *chan;
5736
5737                 res = rdev_dump_survey(dev, netdev, survey_idx, &survey);
5738                 if (res == -ENOENT)
5739                         break;
5740                 if (res)
5741                         goto out_err;
5742
5743                 /* Survey without a channel doesn't make sense */
5744                 if (!survey.channel) {
5745                         res = -EINVAL;
5746                         goto out;
5747                 }
5748
5749                 chan = ieee80211_get_channel(&dev->wiphy,
5750                                              survey.channel->center_freq);
5751                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
5752                         survey_idx++;
5753                         continue;
5754                 }
5755
5756                 if (nl80211_send_survey(skb,
5757                                 NETLINK_CB(cb->skb).portid,
5758                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5759                                 netdev,
5760                                 &survey) < 0)
5761                         goto out;
5762                 survey_idx++;
5763         }
5764
5765  out:
5766         cb->args[1] = survey_idx;
5767         res = skb->len;
5768  out_err:
5769         nl80211_finish_netdev_dump(dev);
5770         return res;
5771 }
5772
5773 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
5774 {
5775         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
5776                                   NL80211_WPA_VERSION_2));
5777 }
5778
5779 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
5780 {
5781         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5782         struct net_device *dev = info->user_ptr[1];
5783         struct ieee80211_channel *chan;
5784         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
5785         int err, ssid_len, ie_len = 0, sae_data_len = 0;
5786         enum nl80211_auth_type auth_type;
5787         struct key_parse key;
5788         bool local_state_change;
5789
5790         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5791                 return -EINVAL;
5792
5793         if (!info->attrs[NL80211_ATTR_MAC])
5794                 return -EINVAL;
5795
5796         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
5797                 return -EINVAL;
5798
5799         if (!info->attrs[NL80211_ATTR_SSID])
5800                 return -EINVAL;
5801
5802         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
5803                 return -EINVAL;
5804
5805         err = nl80211_parse_key(info, &key);
5806         if (err)
5807                 return err;
5808
5809         if (key.idx >= 0) {
5810                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
5811                         return -EINVAL;
5812                 if (!key.p.key || !key.p.key_len)
5813                         return -EINVAL;
5814                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
5815                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
5816                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
5817                      key.p.key_len != WLAN_KEY_LEN_WEP104))
5818                         return -EINVAL;
5819                 if (key.idx > 4)
5820                         return -EINVAL;
5821         } else {
5822                 key.p.key_len = 0;
5823                 key.p.key = NULL;
5824         }
5825
5826         if (key.idx >= 0) {
5827                 int i;
5828                 bool ok = false;
5829                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
5830                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
5831                                 ok = true;
5832                                 break;
5833                         }
5834                 }
5835                 if (!ok)
5836                         return -EINVAL;
5837         }
5838
5839         if (!rdev->ops->auth)
5840                 return -EOPNOTSUPP;
5841
5842         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5843             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5844                 return -EOPNOTSUPP;
5845
5846         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5847         chan = ieee80211_get_channel(&rdev->wiphy,
5848                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5849         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
5850                 return -EINVAL;
5851
5852         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5853         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5854
5855         if (info->attrs[NL80211_ATTR_IE]) {
5856                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5857                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5858         }
5859
5860         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
5861         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
5862                 return -EINVAL;
5863
5864         if (auth_type == NL80211_AUTHTYPE_SAE &&
5865             !info->attrs[NL80211_ATTR_SAE_DATA])
5866                 return -EINVAL;
5867
5868         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
5869                 if (auth_type != NL80211_AUTHTYPE_SAE)
5870                         return -EINVAL;
5871                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
5872                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
5873                 /* need to include at least Auth Transaction and Status Code */
5874                 if (sae_data_len < 4)
5875                         return -EINVAL;
5876         }
5877
5878         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5879
5880         /*
5881          * Since we no longer track auth state, ignore
5882          * requests to only change local state.
5883          */
5884         if (local_state_change)
5885                 return 0;
5886
5887         return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
5888                                   ssid, ssid_len, ie, ie_len,
5889                                   key.p.key, key.p.key_len, key.idx,
5890                                   sae_data, sae_data_len);
5891 }
5892
5893 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
5894                                    struct genl_info *info,
5895                                    struct cfg80211_crypto_settings *settings,
5896                                    int cipher_limit)
5897 {
5898         memset(settings, 0, sizeof(*settings));
5899
5900         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
5901
5902         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
5903                 u16 proto;
5904                 proto = nla_get_u16(
5905                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
5906                 settings->control_port_ethertype = cpu_to_be16(proto);
5907                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
5908                     proto != ETH_P_PAE)
5909                         return -EINVAL;
5910                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
5911                         settings->control_port_no_encrypt = true;
5912         } else
5913                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
5914
5915         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
5916                 void *data;
5917                 int len, i;
5918
5919                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5920                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5921                 settings->n_ciphers_pairwise = len / sizeof(u32);
5922
5923                 if (len % sizeof(u32))
5924                         return -EINVAL;
5925
5926                 if (settings->n_ciphers_pairwise > cipher_limit)
5927                         return -EINVAL;
5928
5929                 memcpy(settings->ciphers_pairwise, data, len);
5930
5931                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
5932                         if (!cfg80211_supported_cipher_suite(
5933                                         &rdev->wiphy,
5934                                         settings->ciphers_pairwise[i]))
5935                                 return -EINVAL;
5936         }
5937
5938         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
5939                 settings->cipher_group =
5940                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
5941                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
5942                                                      settings->cipher_group))
5943                         return -EINVAL;
5944         }
5945
5946         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
5947                 settings->wpa_versions =
5948                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
5949                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
5950                         return -EINVAL;
5951         }
5952
5953         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
5954                 void *data;
5955                 int len;
5956
5957                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
5958                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
5959                 settings->n_akm_suites = len / sizeof(u32);
5960
5961                 if (len % sizeof(u32))
5962                         return -EINVAL;
5963
5964                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
5965                         return -EINVAL;
5966
5967                 memcpy(settings->akm_suites, data, len);
5968         }
5969
5970         return 0;
5971 }
5972
5973 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
5974 {
5975         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5976         struct net_device *dev = info->user_ptr[1];
5977         struct cfg80211_crypto_settings crypto;
5978         struct ieee80211_channel *chan;
5979         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
5980         int err, ssid_len, ie_len = 0;
5981         bool use_mfp = false;
5982         u32 flags = 0;
5983         struct ieee80211_ht_cap *ht_capa = NULL;
5984         struct ieee80211_ht_cap *ht_capa_mask = NULL;
5985
5986         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5987                 return -EINVAL;
5988
5989         if (!info->attrs[NL80211_ATTR_MAC] ||
5990             !info->attrs[NL80211_ATTR_SSID] ||
5991             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
5992                 return -EINVAL;
5993
5994         if (!rdev->ops->assoc)
5995                 return -EOPNOTSUPP;
5996
5997         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5998             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5999                 return -EOPNOTSUPP;
6000
6001         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6002
6003         chan = ieee80211_get_channel(&rdev->wiphy,
6004                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6005         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
6006                 return -EINVAL;
6007
6008         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6009         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6010
6011         if (info->attrs[NL80211_ATTR_IE]) {
6012                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6013                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6014         }
6015
6016         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6017                 enum nl80211_mfp mfp =
6018                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6019                 if (mfp == NL80211_MFP_REQUIRED)
6020                         use_mfp = true;
6021                 else if (mfp != NL80211_MFP_NO)
6022                         return -EINVAL;
6023         }
6024
6025         if (info->attrs[NL80211_ATTR_PREV_BSSID])
6026                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
6027
6028         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6029                 flags |= ASSOC_REQ_DISABLE_HT;
6030
6031         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6032                 ht_capa_mask =
6033                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]);
6034
6035         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6036                 if (!ht_capa_mask)
6037                         return -EINVAL;
6038                 ht_capa = nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
6039         }
6040
6041         err = nl80211_crypto_settings(rdev, info, &crypto, 1);
6042         if (!err)
6043                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
6044                                           ssid, ssid_len, ie, ie_len, use_mfp,
6045                                           &crypto, flags, ht_capa,
6046                                           ht_capa_mask);
6047
6048         return err;
6049 }
6050
6051 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
6052 {
6053         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6054         struct net_device *dev = info->user_ptr[1];
6055         const u8 *ie = NULL, *bssid;
6056         int ie_len = 0;
6057         u16 reason_code;
6058         bool local_state_change;
6059
6060         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6061                 return -EINVAL;
6062
6063         if (!info->attrs[NL80211_ATTR_MAC])
6064                 return -EINVAL;
6065
6066         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6067                 return -EINVAL;
6068
6069         if (!rdev->ops->deauth)
6070                 return -EOPNOTSUPP;
6071
6072         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6073             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6074                 return -EOPNOTSUPP;
6075
6076         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6077
6078         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6079         if (reason_code == 0) {
6080                 /* Reason Code 0 is reserved */
6081                 return -EINVAL;
6082         }
6083
6084         if (info->attrs[NL80211_ATTR_IE]) {
6085                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6086                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6087         }
6088
6089         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6090
6091         return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
6092                                     local_state_change);
6093 }
6094
6095 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
6096 {
6097         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6098         struct net_device *dev = info->user_ptr[1];
6099         const u8 *ie = NULL, *bssid;
6100         int ie_len = 0;
6101         u16 reason_code;
6102         bool local_state_change;
6103
6104         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6105                 return -EINVAL;
6106
6107         if (!info->attrs[NL80211_ATTR_MAC])
6108                 return -EINVAL;
6109
6110         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6111                 return -EINVAL;
6112
6113         if (!rdev->ops->disassoc)
6114                 return -EOPNOTSUPP;
6115
6116         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6117             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6118                 return -EOPNOTSUPP;
6119
6120         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6121
6122         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6123         if (reason_code == 0) {
6124                 /* Reason Code 0 is reserved */
6125                 return -EINVAL;
6126         }
6127
6128         if (info->attrs[NL80211_ATTR_IE]) {
6129                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6130                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6131         }
6132
6133         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6134
6135         return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
6136                                       local_state_change);
6137 }
6138
6139 static bool
6140 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
6141                          int mcast_rate[IEEE80211_NUM_BANDS],
6142                          int rateval)
6143 {
6144         struct wiphy *wiphy = &rdev->wiphy;
6145         bool found = false;
6146         int band, i;
6147
6148         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
6149                 struct ieee80211_supported_band *sband;
6150
6151                 sband = wiphy->bands[band];
6152                 if (!sband)
6153                         continue;
6154
6155                 for (i = 0; i < sband->n_bitrates; i++) {
6156                         if (sband->bitrates[i].bitrate == rateval) {
6157                                 mcast_rate[band] = i + 1;
6158                                 found = true;
6159                                 break;
6160                         }
6161                 }
6162         }
6163
6164         return found;
6165 }
6166
6167 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
6168 {
6169         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6170         struct net_device *dev = info->user_ptr[1];
6171         struct cfg80211_ibss_params ibss;
6172         struct wiphy *wiphy;
6173         struct cfg80211_cached_keys *connkeys = NULL;
6174         int err;
6175
6176         memset(&ibss, 0, sizeof(ibss));
6177
6178         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6179                 return -EINVAL;
6180
6181         if (!info->attrs[NL80211_ATTR_SSID] ||
6182             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6183                 return -EINVAL;
6184
6185         ibss.beacon_interval = 100;
6186
6187         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
6188                 ibss.beacon_interval =
6189                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
6190                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
6191                         return -EINVAL;
6192         }
6193
6194         if (!rdev->ops->join_ibss)
6195                 return -EOPNOTSUPP;
6196
6197         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6198                 return -EOPNOTSUPP;
6199
6200         wiphy = &rdev->wiphy;
6201
6202         if (info->attrs[NL80211_ATTR_MAC]) {
6203                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6204
6205                 if (!is_valid_ether_addr(ibss.bssid))
6206                         return -EINVAL;
6207         }
6208         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6209         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6210
6211         if (info->attrs[NL80211_ATTR_IE]) {
6212                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6213                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6214         }
6215
6216         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
6217         if (err)
6218                 return err;
6219
6220         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef))
6221                 return -EINVAL;
6222
6223         if (ibss.chandef.width > NL80211_CHAN_WIDTH_40)
6224                 return -EINVAL;
6225         if (ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
6226             !(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
6227                 return -EINVAL;
6228
6229         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
6230         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
6231
6232         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
6233                 u8 *rates =
6234                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6235                 int n_rates =
6236                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6237                 struct ieee80211_supported_band *sband =
6238                         wiphy->bands[ibss.chandef.chan->band];
6239
6240                 err = ieee80211_get_ratemask(sband, rates, n_rates,
6241                                              &ibss.basic_rates);
6242                 if (err)
6243                         return err;
6244         }
6245
6246         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
6247             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
6248                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
6249                 return -EINVAL;
6250
6251         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6252                 bool no_ht = false;
6253
6254                 connkeys = nl80211_parse_connkeys(rdev,
6255                                           info->attrs[NL80211_ATTR_KEYS],
6256                                           &no_ht);
6257                 if (IS_ERR(connkeys))
6258                         return PTR_ERR(connkeys);
6259
6260                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
6261                     no_ht) {
6262                         kfree(connkeys);
6263                         return -EINVAL;
6264                 }
6265         }
6266
6267         ibss.control_port =
6268                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
6269
6270         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
6271         if (err)
6272                 kfree(connkeys);
6273         return err;
6274 }
6275
6276 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
6277 {
6278         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6279         struct net_device *dev = info->user_ptr[1];
6280
6281         if (!rdev->ops->leave_ibss)
6282                 return -EOPNOTSUPP;
6283
6284         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6285                 return -EOPNOTSUPP;
6286
6287         return cfg80211_leave_ibss(rdev, dev, false);
6288 }
6289
6290 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
6291 {
6292         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6293         struct net_device *dev = info->user_ptr[1];
6294         int mcast_rate[IEEE80211_NUM_BANDS];
6295         u32 nla_rate;
6296         int err;
6297
6298         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
6299             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6300                 return -EOPNOTSUPP;
6301
6302         if (!rdev->ops->set_mcast_rate)
6303                 return -EOPNOTSUPP;
6304
6305         memset(mcast_rate, 0, sizeof(mcast_rate));
6306
6307         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
6308                 return -EINVAL;
6309
6310         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
6311         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
6312                 return -EINVAL;
6313
6314         err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
6315
6316         return err;
6317 }
6318
6319
6320 #ifdef CONFIG_NL80211_TESTMODE
6321 static struct genl_multicast_group nl80211_testmode_mcgrp = {
6322         .name = "testmode",
6323 };
6324
6325 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
6326 {
6327         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6328         int err;
6329
6330         if (!info->attrs[NL80211_ATTR_TESTDATA])
6331                 return -EINVAL;
6332
6333         err = -EOPNOTSUPP;
6334         if (rdev->ops->testmode_cmd) {
6335                 rdev->testmode_info = info;
6336                 err = rdev_testmode_cmd(rdev,
6337                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
6338                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
6339                 rdev->testmode_info = NULL;
6340         }
6341
6342         return err;
6343 }
6344
6345 static int nl80211_testmode_dump(struct sk_buff *skb,
6346                                  struct netlink_callback *cb)
6347 {
6348         struct cfg80211_registered_device *rdev;
6349         int err;
6350         long phy_idx;
6351         void *data = NULL;
6352         int data_len = 0;
6353
6354         if (cb->args[0]) {
6355                 /*
6356                  * 0 is a valid index, but not valid for args[0],
6357                  * so we need to offset by 1.
6358                  */
6359                 phy_idx = cb->args[0] - 1;
6360         } else {
6361                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
6362                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
6363                                   nl80211_policy);
6364                 if (err)
6365                         return err;
6366
6367                 mutex_lock(&cfg80211_mutex);
6368                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
6369                                                   nl80211_fam.attrbuf);
6370                 if (IS_ERR(rdev)) {
6371                         mutex_unlock(&cfg80211_mutex);
6372                         return PTR_ERR(rdev);
6373                 }
6374                 phy_idx = rdev->wiphy_idx;
6375                 rdev = NULL;
6376                 mutex_unlock(&cfg80211_mutex);
6377
6378                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
6379                         cb->args[1] =
6380                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
6381         }
6382
6383         if (cb->args[1]) {
6384                 data = nla_data((void *)cb->args[1]);
6385                 data_len = nla_len((void *)cb->args[1]);
6386         }
6387
6388         mutex_lock(&cfg80211_mutex);
6389         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
6390         if (!rdev) {
6391                 mutex_unlock(&cfg80211_mutex);
6392                 return -ENOENT;
6393         }
6394         cfg80211_lock_rdev(rdev);
6395         mutex_unlock(&cfg80211_mutex);
6396
6397         if (!rdev->ops->testmode_dump) {
6398                 err = -EOPNOTSUPP;
6399                 goto out_err;
6400         }
6401
6402         while (1) {
6403                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
6404                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
6405                                            NL80211_CMD_TESTMODE);
6406                 struct nlattr *tmdata;
6407
6408                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
6409                         genlmsg_cancel(skb, hdr);
6410                         break;
6411                 }
6412
6413                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6414                 if (!tmdata) {
6415                         genlmsg_cancel(skb, hdr);
6416                         break;
6417                 }
6418                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
6419                 nla_nest_end(skb, tmdata);
6420
6421                 if (err == -ENOBUFS || err == -ENOENT) {
6422                         genlmsg_cancel(skb, hdr);
6423                         break;
6424                 } else if (err) {
6425                         genlmsg_cancel(skb, hdr);
6426                         goto out_err;
6427                 }
6428
6429                 genlmsg_end(skb, hdr);
6430         }
6431
6432         err = skb->len;
6433         /* see above */
6434         cb->args[0] = phy_idx + 1;
6435  out_err:
6436         cfg80211_unlock_rdev(rdev);
6437         return err;
6438 }
6439
6440 static struct sk_buff *
6441 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
6442                               int approxlen, u32 portid, u32 seq, gfp_t gfp)
6443 {
6444         struct sk_buff *skb;
6445         void *hdr;
6446         struct nlattr *data;
6447
6448         skb = nlmsg_new(approxlen + 100, gfp);
6449         if (!skb)
6450                 return NULL;
6451
6452         hdr = nl80211hdr_put(skb, portid, seq, 0, NL80211_CMD_TESTMODE);
6453         if (!hdr) {
6454                 kfree_skb(skb);
6455                 return NULL;
6456         }
6457
6458         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
6459                 goto nla_put_failure;
6460         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6461
6462         ((void **)skb->cb)[0] = rdev;
6463         ((void **)skb->cb)[1] = hdr;
6464         ((void **)skb->cb)[2] = data;
6465
6466         return skb;
6467
6468  nla_put_failure:
6469         kfree_skb(skb);
6470         return NULL;
6471 }
6472
6473 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
6474                                                   int approxlen)
6475 {
6476         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6477
6478         if (WARN_ON(!rdev->testmode_info))
6479                 return NULL;
6480
6481         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
6482                                 rdev->testmode_info->snd_portid,
6483                                 rdev->testmode_info->snd_seq,
6484                                 GFP_KERNEL);
6485 }
6486 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
6487
6488 int cfg80211_testmode_reply(struct sk_buff *skb)
6489 {
6490         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
6491         void *hdr = ((void **)skb->cb)[1];
6492         struct nlattr *data = ((void **)skb->cb)[2];
6493
6494         if (WARN_ON(!rdev->testmode_info)) {
6495                 kfree_skb(skb);
6496                 return -EINVAL;
6497         }
6498
6499         nla_nest_end(skb, data);
6500         genlmsg_end(skb, hdr);
6501         return genlmsg_reply(skb, rdev->testmode_info);
6502 }
6503 EXPORT_SYMBOL(cfg80211_testmode_reply);
6504
6505 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
6506                                                   int approxlen, gfp_t gfp)
6507 {
6508         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6509
6510         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
6511 }
6512 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
6513
6514 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
6515 {
6516         void *hdr = ((void **)skb->cb)[1];
6517         struct nlattr *data = ((void **)skb->cb)[2];
6518
6519         nla_nest_end(skb, data);
6520         genlmsg_end(skb, hdr);
6521         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
6522 }
6523 EXPORT_SYMBOL(cfg80211_testmode_event);
6524 #endif
6525
6526 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
6527 {
6528         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6529         struct net_device *dev = info->user_ptr[1];
6530         struct cfg80211_connect_params connect;
6531         struct wiphy *wiphy;
6532         struct cfg80211_cached_keys *connkeys = NULL;
6533         int err;
6534
6535         memset(&connect, 0, sizeof(connect));
6536
6537         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6538                 return -EINVAL;
6539
6540         if (!info->attrs[NL80211_ATTR_SSID] ||
6541             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6542                 return -EINVAL;
6543
6544         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
6545                 connect.auth_type =
6546                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6547                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
6548                                              NL80211_CMD_CONNECT))
6549                         return -EINVAL;
6550         } else
6551                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
6552
6553         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
6554
6555         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
6556                                       NL80211_MAX_NR_CIPHER_SUITES);
6557         if (err)
6558                 return err;
6559
6560         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6561             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6562                 return -EOPNOTSUPP;
6563
6564         wiphy = &rdev->wiphy;
6565
6566         connect.bg_scan_period = -1;
6567         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
6568                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
6569                 connect.bg_scan_period =
6570                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
6571         }
6572
6573         if (info->attrs[NL80211_ATTR_MAC])
6574                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6575         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6576         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6577
6578         if (info->attrs[NL80211_ATTR_IE]) {
6579                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6580                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6581         }
6582
6583         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6584                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6585                 if (connect.mfp != NL80211_MFP_REQUIRED &&
6586                     connect.mfp != NL80211_MFP_NO)
6587                         return -EINVAL;
6588         } else {
6589                 connect.mfp = NL80211_MFP_NO;
6590         }
6591
6592         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6593                 connect.channel =
6594                         ieee80211_get_channel(wiphy,
6595                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6596                 if (!connect.channel ||
6597                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
6598                         return -EINVAL;
6599         }
6600
6601         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6602                 connkeys = nl80211_parse_connkeys(rdev,
6603                                           info->attrs[NL80211_ATTR_KEYS], NULL);
6604                 if (IS_ERR(connkeys))
6605                         return PTR_ERR(connkeys);
6606         }
6607
6608         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6609                 connect.flags |= ASSOC_REQ_DISABLE_HT;
6610
6611         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6612                 memcpy(&connect.ht_capa_mask,
6613                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6614                        sizeof(connect.ht_capa_mask));
6615
6616         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6617                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
6618                         kfree(connkeys);
6619                         return -EINVAL;
6620                 }
6621                 memcpy(&connect.ht_capa,
6622                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6623                        sizeof(connect.ht_capa));
6624         }
6625
6626         err = cfg80211_connect(rdev, dev, &connect, connkeys);
6627         if (err)
6628                 kfree(connkeys);
6629         return err;
6630 }
6631
6632 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
6633 {
6634         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6635         struct net_device *dev = info->user_ptr[1];
6636         u16 reason;
6637
6638         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6639                 reason = WLAN_REASON_DEAUTH_LEAVING;
6640         else
6641                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6642
6643         if (reason == 0)
6644                 return -EINVAL;
6645
6646         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6647             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6648                 return -EOPNOTSUPP;
6649
6650         return cfg80211_disconnect(rdev, dev, reason, true);
6651 }
6652
6653 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
6654 {
6655         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6656         struct net *net;
6657         int err;
6658         u32 pid;
6659
6660         if (!info->attrs[NL80211_ATTR_PID])
6661                 return -EINVAL;
6662
6663         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
6664
6665         net = get_net_ns_by_pid(pid);
6666         if (IS_ERR(net))
6667                 return PTR_ERR(net);
6668
6669         err = 0;
6670
6671         /* check if anything to do */
6672         if (!net_eq(wiphy_net(&rdev->wiphy), net))
6673                 err = cfg80211_switch_netns(rdev, net);
6674
6675         put_net(net);
6676         return err;
6677 }
6678
6679 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
6680 {
6681         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6682         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
6683                         struct cfg80211_pmksa *pmksa) = NULL;
6684         struct net_device *dev = info->user_ptr[1];
6685         struct cfg80211_pmksa pmksa;
6686
6687         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
6688
6689         if (!info->attrs[NL80211_ATTR_MAC])
6690                 return -EINVAL;
6691
6692         if (!info->attrs[NL80211_ATTR_PMKID])
6693                 return -EINVAL;
6694
6695         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
6696         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6697
6698         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6699             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6700                 return -EOPNOTSUPP;
6701
6702         switch (info->genlhdr->cmd) {
6703         case NL80211_CMD_SET_PMKSA:
6704                 rdev_ops = rdev->ops->set_pmksa;
6705                 break;
6706         case NL80211_CMD_DEL_PMKSA:
6707                 rdev_ops = rdev->ops->del_pmksa;
6708                 break;
6709         default:
6710                 WARN_ON(1);
6711                 break;
6712         }
6713
6714         if (!rdev_ops)
6715                 return -EOPNOTSUPP;
6716
6717         return rdev_ops(&rdev->wiphy, dev, &pmksa);
6718 }
6719
6720 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
6721 {
6722         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6723         struct net_device *dev = info->user_ptr[1];
6724
6725         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6726             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6727                 return -EOPNOTSUPP;
6728
6729         if (!rdev->ops->flush_pmksa)
6730                 return -EOPNOTSUPP;
6731
6732         return rdev_flush_pmksa(rdev, dev);
6733 }
6734
6735 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
6736 {
6737         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6738         struct net_device *dev = info->user_ptr[1];
6739         u8 action_code, dialog_token;
6740         u16 status_code;
6741         u8 *peer;
6742
6743         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
6744             !rdev->ops->tdls_mgmt)
6745                 return -EOPNOTSUPP;
6746
6747         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
6748             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
6749             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
6750             !info->attrs[NL80211_ATTR_IE] ||
6751             !info->attrs[NL80211_ATTR_MAC])
6752                 return -EINVAL;
6753
6754         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
6755         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
6756         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
6757         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
6758
6759         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
6760                               dialog_token, status_code,
6761                               nla_data(info->attrs[NL80211_ATTR_IE]),
6762                               nla_len(info->attrs[NL80211_ATTR_IE]));
6763 }
6764
6765 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
6766 {
6767         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6768         struct net_device *dev = info->user_ptr[1];
6769         enum nl80211_tdls_operation operation;
6770         u8 *peer;
6771
6772         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
6773             !rdev->ops->tdls_oper)
6774                 return -EOPNOTSUPP;
6775
6776         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
6777             !info->attrs[NL80211_ATTR_MAC])
6778                 return -EINVAL;
6779
6780         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
6781         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
6782
6783         return rdev_tdls_oper(rdev, dev, peer, operation);
6784 }
6785
6786 static int nl80211_remain_on_channel(struct sk_buff *skb,
6787                                      struct genl_info *info)
6788 {
6789         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6790         struct wireless_dev *wdev = info->user_ptr[1];
6791         struct cfg80211_chan_def chandef;
6792         struct sk_buff *msg;
6793         void *hdr;
6794         u64 cookie;
6795         u32 duration;
6796         int err;
6797
6798         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
6799             !info->attrs[NL80211_ATTR_DURATION])
6800                 return -EINVAL;
6801
6802         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
6803
6804         if (!rdev->ops->remain_on_channel ||
6805             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
6806                 return -EOPNOTSUPP;
6807
6808         /*
6809          * We should be on that channel for at least a minimum amount of
6810          * time (10ms) but no longer than the driver supports.
6811          */
6812         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
6813             duration > rdev->wiphy.max_remain_on_channel_duration)
6814                 return -EINVAL;
6815
6816         err = nl80211_parse_chandef(rdev, info, &chandef);
6817         if (err)
6818                 return err;
6819
6820         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6821         if (!msg)
6822                 return -ENOMEM;
6823
6824         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6825                              NL80211_CMD_REMAIN_ON_CHANNEL);
6826
6827         if (IS_ERR(hdr)) {
6828                 err = PTR_ERR(hdr);
6829                 goto free_msg;
6830         }
6831
6832         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
6833                                      duration, &cookie);
6834
6835         if (err)
6836                 goto free_msg;
6837
6838         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6839                 goto nla_put_failure;
6840
6841         genlmsg_end(msg, hdr);
6842
6843         return genlmsg_reply(msg, info);
6844
6845  nla_put_failure:
6846         err = -ENOBUFS;
6847  free_msg:
6848         nlmsg_free(msg);
6849         return err;
6850 }
6851
6852 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
6853                                             struct genl_info *info)
6854 {
6855         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6856         struct wireless_dev *wdev = info->user_ptr[1];
6857         u64 cookie;
6858
6859         if (!info->attrs[NL80211_ATTR_COOKIE])
6860                 return -EINVAL;
6861
6862         if (!rdev->ops->cancel_remain_on_channel)
6863                 return -EOPNOTSUPP;
6864
6865         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
6866
6867         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
6868 }
6869
6870 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
6871                            u8 *rates, u8 rates_len)
6872 {
6873         u8 i;
6874         u32 mask = 0;
6875
6876         for (i = 0; i < rates_len; i++) {
6877                 int rate = (rates[i] & 0x7f) * 5;
6878                 int ridx;
6879                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
6880                         struct ieee80211_rate *srate =
6881                                 &sband->bitrates[ridx];
6882                         if (rate == srate->bitrate) {
6883                                 mask |= 1 << ridx;
6884                                 break;
6885                         }
6886                 }
6887                 if (ridx == sband->n_bitrates)
6888                         return 0; /* rate not found */
6889         }
6890
6891         return mask;
6892 }
6893
6894 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
6895                                u8 *rates, u8 rates_len,
6896                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
6897 {
6898         u8 i;
6899
6900         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
6901
6902         for (i = 0; i < rates_len; i++) {
6903                 int ridx, rbit;
6904
6905                 ridx = rates[i] / 8;
6906                 rbit = BIT(rates[i] % 8);
6907
6908                 /* check validity */
6909                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
6910                         return false;
6911
6912                 /* check availability */
6913                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
6914                         mcs[ridx] |= rbit;
6915                 else
6916                         return false;
6917         }
6918
6919         return true;
6920 }
6921
6922 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
6923         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
6924                                     .len = NL80211_MAX_SUPP_RATES },
6925         [NL80211_TXRATE_MCS] = { .type = NLA_BINARY,
6926                                  .len = NL80211_MAX_SUPP_HT_RATES },
6927 };
6928
6929 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
6930                                        struct genl_info *info)
6931 {
6932         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
6933         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6934         struct cfg80211_bitrate_mask mask;
6935         int rem, i;
6936         struct net_device *dev = info->user_ptr[1];
6937         struct nlattr *tx_rates;
6938         struct ieee80211_supported_band *sband;
6939
6940         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
6941                 return -EINVAL;
6942
6943         if (!rdev->ops->set_bitrate_mask)
6944                 return -EOPNOTSUPP;
6945
6946         memset(&mask, 0, sizeof(mask));
6947         /* Default to all rates enabled */
6948         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
6949                 sband = rdev->wiphy.bands[i];
6950                 mask.control[i].legacy =
6951                         sband ? (1 << sband->n_bitrates) - 1 : 0;
6952                 if (sband)
6953                         memcpy(mask.control[i].mcs,
6954                                sband->ht_cap.mcs.rx_mask,
6955                                sizeof(mask.control[i].mcs));
6956                 else
6957                         memset(mask.control[i].mcs, 0,
6958                                sizeof(mask.control[i].mcs));
6959         }
6960
6961         /*
6962          * The nested attribute uses enum nl80211_band as the index. This maps
6963          * directly to the enum ieee80211_band values used in cfg80211.
6964          */
6965         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
6966         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
6967         {
6968                 enum ieee80211_band band = nla_type(tx_rates);
6969                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
6970                         return -EINVAL;
6971                 sband = rdev->wiphy.bands[band];
6972                 if (sband == NULL)
6973                         return -EINVAL;
6974                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
6975                           nla_len(tx_rates), nl80211_txattr_policy);
6976                 if (tb[NL80211_TXRATE_LEGACY]) {
6977                         mask.control[band].legacy = rateset_to_mask(
6978                                 sband,
6979                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
6980                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
6981                         if ((mask.control[band].legacy == 0) &&
6982                             nla_len(tb[NL80211_TXRATE_LEGACY]))
6983                                 return -EINVAL;
6984                 }
6985                 if (tb[NL80211_TXRATE_MCS]) {
6986                         if (!ht_rateset_to_mask(
6987                                         sband,
6988                                         nla_data(tb[NL80211_TXRATE_MCS]),
6989                                         nla_len(tb[NL80211_TXRATE_MCS]),
6990                                         mask.control[band].mcs))
6991                                 return -EINVAL;
6992                 }
6993
6994                 if (mask.control[band].legacy == 0) {
6995                         /* don't allow empty legacy rates if HT
6996                          * is not even supported. */
6997                         if (!rdev->wiphy.bands[band]->ht_cap.ht_supported)
6998                                 return -EINVAL;
6999
7000                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
7001                                 if (mask.control[band].mcs[i])
7002                                         break;
7003
7004                         /* legacy and mcs rates may not be both empty */
7005                         if (i == IEEE80211_HT_MCS_MASK_LEN)
7006                                 return -EINVAL;
7007                 }
7008         }
7009
7010         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
7011 }
7012
7013 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
7014 {
7015         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7016         struct wireless_dev *wdev = info->user_ptr[1];
7017         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
7018
7019         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
7020                 return -EINVAL;
7021
7022         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
7023                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
7024
7025         switch (wdev->iftype) {
7026         case NL80211_IFTYPE_STATION:
7027         case NL80211_IFTYPE_ADHOC:
7028         case NL80211_IFTYPE_P2P_CLIENT:
7029         case NL80211_IFTYPE_AP:
7030         case NL80211_IFTYPE_AP_VLAN:
7031         case NL80211_IFTYPE_MESH_POINT:
7032         case NL80211_IFTYPE_P2P_GO:
7033         case NL80211_IFTYPE_P2P_DEVICE:
7034                 break;
7035         default:
7036                 return -EOPNOTSUPP;
7037         }
7038
7039         /* not much point in registering if we can't reply */
7040         if (!rdev->ops->mgmt_tx)
7041                 return -EOPNOTSUPP;
7042
7043         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
7044                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
7045                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
7046 }
7047
7048 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
7049 {
7050         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7051         struct wireless_dev *wdev = info->user_ptr[1];
7052         struct cfg80211_chan_def chandef;
7053         int err;
7054         void *hdr = NULL;
7055         u64 cookie;
7056         struct sk_buff *msg = NULL;
7057         unsigned int wait = 0;
7058         bool offchan, no_cck, dont_wait_for_ack;
7059
7060         dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
7061
7062         if (!info->attrs[NL80211_ATTR_FRAME])
7063                 return -EINVAL;
7064
7065         if (!rdev->ops->mgmt_tx)
7066                 return -EOPNOTSUPP;
7067
7068         switch (wdev->iftype) {
7069         case NL80211_IFTYPE_STATION:
7070         case NL80211_IFTYPE_ADHOC:
7071         case NL80211_IFTYPE_P2P_CLIENT:
7072         case NL80211_IFTYPE_AP:
7073         case NL80211_IFTYPE_AP_VLAN:
7074         case NL80211_IFTYPE_MESH_POINT:
7075         case NL80211_IFTYPE_P2P_GO:
7076         case NL80211_IFTYPE_P2P_DEVICE:
7077                 break;
7078         default:
7079                 return -EOPNOTSUPP;
7080         }
7081
7082         if (info->attrs[NL80211_ATTR_DURATION]) {
7083                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7084                         return -EINVAL;
7085                 wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7086
7087                 /*
7088                  * We should wait on the channel for at least a minimum amount
7089                  * of time (10ms) but no longer than the driver supports.
7090                  */
7091                 if (wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7092                     wait > rdev->wiphy.max_remain_on_channel_duration)
7093                         return -EINVAL;
7094
7095         }
7096
7097         offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
7098
7099         if (offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7100                 return -EINVAL;
7101
7102         no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7103
7104         err = nl80211_parse_chandef(rdev, info, &chandef);
7105         if (err)
7106                 return err;
7107
7108         if (!dont_wait_for_ack) {
7109                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7110                 if (!msg)
7111                         return -ENOMEM;
7112
7113                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7114                                      NL80211_CMD_FRAME);
7115
7116                 if (IS_ERR(hdr)) {
7117                         err = PTR_ERR(hdr);
7118                         goto free_msg;
7119                 }
7120         }
7121
7122         err = cfg80211_mlme_mgmt_tx(rdev, wdev, chandef.chan, offchan, wait,
7123                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
7124                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
7125                                     no_cck, dont_wait_for_ack, &cookie);
7126         if (err)
7127                 goto free_msg;
7128
7129         if (msg) {
7130                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7131                         goto nla_put_failure;
7132
7133                 genlmsg_end(msg, hdr);
7134                 return genlmsg_reply(msg, info);
7135         }
7136
7137         return 0;
7138
7139  nla_put_failure:
7140         err = -ENOBUFS;
7141  free_msg:
7142         nlmsg_free(msg);
7143         return err;
7144 }
7145
7146 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
7147 {
7148         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7149         struct wireless_dev *wdev = info->user_ptr[1];
7150         u64 cookie;
7151
7152         if (!info->attrs[NL80211_ATTR_COOKIE])
7153                 return -EINVAL;
7154
7155         if (!rdev->ops->mgmt_tx_cancel_wait)
7156                 return -EOPNOTSUPP;
7157
7158         switch (wdev->iftype) {
7159         case NL80211_IFTYPE_STATION:
7160         case NL80211_IFTYPE_ADHOC:
7161         case NL80211_IFTYPE_P2P_CLIENT:
7162         case NL80211_IFTYPE_AP:
7163         case NL80211_IFTYPE_AP_VLAN:
7164         case NL80211_IFTYPE_P2P_GO:
7165         case NL80211_IFTYPE_P2P_DEVICE:
7166                 break;
7167         default:
7168                 return -EOPNOTSUPP;
7169         }
7170
7171         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7172
7173         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
7174 }
7175
7176 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
7177 {
7178         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7179         struct wireless_dev *wdev;
7180         struct net_device *dev = info->user_ptr[1];
7181         u8 ps_state;
7182         bool state;
7183         int err;
7184
7185         if (!info->attrs[NL80211_ATTR_PS_STATE])
7186                 return -EINVAL;
7187
7188         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
7189
7190         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
7191                 return -EINVAL;
7192
7193         wdev = dev->ieee80211_ptr;
7194
7195         if (!rdev->ops->set_power_mgmt)
7196                 return -EOPNOTSUPP;
7197
7198         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
7199
7200         if (state == wdev->ps)
7201                 return 0;
7202
7203         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
7204         if (!err)
7205                 wdev->ps = state;
7206         return err;
7207 }
7208
7209 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
7210 {
7211         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7212         enum nl80211_ps_state ps_state;
7213         struct wireless_dev *wdev;
7214         struct net_device *dev = info->user_ptr[1];
7215         struct sk_buff *msg;
7216         void *hdr;
7217         int err;
7218
7219         wdev = dev->ieee80211_ptr;
7220
7221         if (!rdev->ops->set_power_mgmt)
7222                 return -EOPNOTSUPP;
7223
7224         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7225         if (!msg)
7226                 return -ENOMEM;
7227
7228         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7229                              NL80211_CMD_GET_POWER_SAVE);
7230         if (!hdr) {
7231                 err = -ENOBUFS;
7232                 goto free_msg;
7233         }
7234
7235         if (wdev->ps)
7236                 ps_state = NL80211_PS_ENABLED;
7237         else
7238                 ps_state = NL80211_PS_DISABLED;
7239
7240         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
7241                 goto nla_put_failure;
7242
7243         genlmsg_end(msg, hdr);
7244         return genlmsg_reply(msg, info);
7245
7246  nla_put_failure:
7247         err = -ENOBUFS;
7248  free_msg:
7249         nlmsg_free(msg);
7250         return err;
7251 }
7252
7253 static struct nla_policy
7254 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
7255         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
7256         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
7257         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
7258         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
7259         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
7260         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
7261 };
7262
7263 static int nl80211_set_cqm_txe(struct genl_info *info,
7264                                u32 rate, u32 pkts, u32 intvl)
7265 {
7266         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7267         struct wireless_dev *wdev;
7268         struct net_device *dev = info->user_ptr[1];
7269
7270         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
7271                 return -EINVAL;
7272
7273         wdev = dev->ieee80211_ptr;
7274
7275         if (!rdev->ops->set_cqm_txe_config)
7276                 return -EOPNOTSUPP;
7277
7278         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7279             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7280                 return -EOPNOTSUPP;
7281
7282         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
7283 }
7284
7285 static int nl80211_set_cqm_rssi(struct genl_info *info,
7286                                 s32 threshold, u32 hysteresis)
7287 {
7288         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7289         struct wireless_dev *wdev;
7290         struct net_device *dev = info->user_ptr[1];
7291
7292         if (threshold > 0)
7293                 return -EINVAL;
7294
7295         wdev = dev->ieee80211_ptr;
7296
7297         if (!rdev->ops->set_cqm_rssi_config)
7298                 return -EOPNOTSUPP;
7299
7300         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7301             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7302                 return -EOPNOTSUPP;
7303
7304         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
7305 }
7306
7307 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
7308 {
7309         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
7310         struct nlattr *cqm;
7311         int err;
7312
7313         cqm = info->attrs[NL80211_ATTR_CQM];
7314         if (!cqm) {
7315                 err = -EINVAL;
7316                 goto out;
7317         }
7318
7319         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
7320                                nl80211_attr_cqm_policy);
7321         if (err)
7322                 goto out;
7323
7324         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
7325             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
7326                 s32 threshold;
7327                 u32 hysteresis;
7328                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
7329                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
7330                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
7331         } else if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
7332                    attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
7333                    attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
7334                 u32 rate, pkts, intvl;
7335                 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
7336                 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
7337                 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
7338                 err = nl80211_set_cqm_txe(info, rate, pkts, intvl);
7339         } else
7340                 err = -EINVAL;
7341
7342 out:
7343         return err;
7344 }
7345
7346 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
7347 {
7348         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7349         struct net_device *dev = info->user_ptr[1];
7350         struct mesh_config cfg;
7351         struct mesh_setup setup;
7352         int err;
7353
7354         /* start with default */
7355         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
7356         memcpy(&setup, &default_mesh_setup, sizeof(setup));
7357
7358         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
7359                 /* and parse parameters if given */
7360                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
7361                 if (err)
7362                         return err;
7363         }
7364
7365         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
7366             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
7367                 return -EINVAL;
7368
7369         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
7370         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
7371
7372         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
7373             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
7374                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
7375                         return -EINVAL;
7376
7377         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
7378                 setup.beacon_interval =
7379                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
7380                 if (setup.beacon_interval < 10 ||
7381                     setup.beacon_interval > 10000)
7382                         return -EINVAL;
7383         }
7384
7385         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
7386                 setup.dtim_period =
7387                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
7388                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
7389                         return -EINVAL;
7390         }
7391
7392         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
7393                 /* parse additional setup parameters if given */
7394                 err = nl80211_parse_mesh_setup(info, &setup);
7395                 if (err)
7396                         return err;
7397         }
7398
7399         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7400                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
7401                 if (err)
7402                         return err;
7403         } else {
7404                 /* cfg80211_join_mesh() will sort it out */
7405                 setup.chandef.chan = NULL;
7406         }
7407
7408         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
7409 }
7410
7411 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
7412 {
7413         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7414         struct net_device *dev = info->user_ptr[1];
7415
7416         return cfg80211_leave_mesh(rdev, dev);
7417 }
7418
7419 #ifdef CONFIG_PM
7420 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
7421                                         struct cfg80211_registered_device *rdev)
7422 {
7423         struct nlattr *nl_pats, *nl_pat;
7424         int i, pat_len;
7425
7426         if (!rdev->wowlan->n_patterns)
7427                 return 0;
7428
7429         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
7430         if (!nl_pats)
7431                 return -ENOBUFS;
7432
7433         for (i = 0; i < rdev->wowlan->n_patterns; i++) {
7434                 nl_pat = nla_nest_start(msg, i + 1);
7435                 if (!nl_pat)
7436                         return -ENOBUFS;
7437                 pat_len = rdev->wowlan->patterns[i].pattern_len;
7438                 if (nla_put(msg, NL80211_WOWLAN_PKTPAT_MASK,
7439                             DIV_ROUND_UP(pat_len, 8),
7440                             rdev->wowlan->patterns[i].mask) ||
7441                     nla_put(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
7442                             pat_len, rdev->wowlan->patterns[i].pattern) ||
7443                     nla_put_u32(msg, NL80211_WOWLAN_PKTPAT_OFFSET,
7444                                 rdev->wowlan->patterns[i].pkt_offset))
7445                         return -ENOBUFS;
7446                 nla_nest_end(msg, nl_pat);
7447         }
7448         nla_nest_end(msg, nl_pats);
7449
7450         return 0;
7451 }
7452
7453 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
7454                                    struct cfg80211_wowlan_tcp *tcp)
7455 {
7456         struct nlattr *nl_tcp;
7457
7458         if (!tcp)
7459                 return 0;
7460
7461         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
7462         if (!nl_tcp)
7463                 return -ENOBUFS;
7464
7465         if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
7466             nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
7467             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
7468             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
7469             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
7470             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
7471                     tcp->payload_len, tcp->payload) ||
7472             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
7473                         tcp->data_interval) ||
7474             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
7475                     tcp->wake_len, tcp->wake_data) ||
7476             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
7477                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
7478                 return -ENOBUFS;
7479
7480         if (tcp->payload_seq.len &&
7481             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
7482                     sizeof(tcp->payload_seq), &tcp->payload_seq))
7483                 return -ENOBUFS;
7484
7485         if (tcp->payload_tok.len &&
7486             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
7487                     sizeof(tcp->payload_tok) + tcp->tokens_size,
7488                     &tcp->payload_tok))
7489                 return -ENOBUFS;
7490
7491         return 0;
7492 }
7493
7494 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
7495 {
7496         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7497         struct sk_buff *msg;
7498         void *hdr;
7499         u32 size = NLMSG_DEFAULT_SIZE;
7500
7501         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns &&
7502             !rdev->wiphy.wowlan.tcp)
7503                 return -EOPNOTSUPP;
7504
7505         if (rdev->wowlan && rdev->wowlan->tcp) {
7506                 /* adjust size to have room for all the data */
7507                 size += rdev->wowlan->tcp->tokens_size +
7508                         rdev->wowlan->tcp->payload_len +
7509                         rdev->wowlan->tcp->wake_len +
7510                         rdev->wowlan->tcp->wake_len / 8;
7511         }
7512
7513         msg = nlmsg_new(size, GFP_KERNEL);
7514         if (!msg)
7515                 return -ENOMEM;
7516
7517         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7518                              NL80211_CMD_GET_WOWLAN);
7519         if (!hdr)
7520                 goto nla_put_failure;
7521
7522         if (rdev->wowlan) {
7523                 struct nlattr *nl_wowlan;
7524
7525                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
7526                 if (!nl_wowlan)
7527                         goto nla_put_failure;
7528
7529                 if ((rdev->wowlan->any &&
7530                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
7531                     (rdev->wowlan->disconnect &&
7532                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
7533                     (rdev->wowlan->magic_pkt &&
7534                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
7535                     (rdev->wowlan->gtk_rekey_failure &&
7536                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
7537                     (rdev->wowlan->eap_identity_req &&
7538                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
7539                     (rdev->wowlan->four_way_handshake &&
7540                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
7541                     (rdev->wowlan->rfkill_release &&
7542                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
7543                         goto nla_put_failure;
7544
7545                 if (nl80211_send_wowlan_patterns(msg, rdev))
7546                         goto nla_put_failure;
7547
7548                 if (nl80211_send_wowlan_tcp(msg, rdev->wowlan->tcp))
7549                         goto nla_put_failure;
7550
7551                 nla_nest_end(msg, nl_wowlan);
7552         }
7553
7554         genlmsg_end(msg, hdr);
7555         return genlmsg_reply(msg, info);
7556
7557 nla_put_failure:
7558         nlmsg_free(msg);
7559         return -ENOBUFS;
7560 }
7561
7562 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
7563                                     struct nlattr *attr,
7564                                     struct cfg80211_wowlan *trig)
7565 {
7566         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
7567         struct cfg80211_wowlan_tcp *cfg;
7568         struct nl80211_wowlan_tcp_data_token *tok = NULL;
7569         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
7570         u32 size;
7571         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
7572         int err, port;
7573
7574         if (!rdev->wiphy.wowlan.tcp)
7575                 return -EINVAL;
7576
7577         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
7578                         nla_data(attr), nla_len(attr),
7579                         nl80211_wowlan_tcp_policy);
7580         if (err)
7581                 return err;
7582
7583         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
7584             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
7585             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
7586             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
7587             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
7588             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
7589             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
7590             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
7591                 return -EINVAL;
7592
7593         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
7594         if (data_size > rdev->wiphy.wowlan.tcp->data_payload_max)
7595                 return -EINVAL;
7596
7597         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
7598                         rdev->wiphy.wowlan.tcp->data_interval_max)
7599                 return -EINVAL;
7600
7601         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
7602         if (wake_size > rdev->wiphy.wowlan.tcp->wake_payload_max)
7603                 return -EINVAL;
7604
7605         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
7606         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
7607                 return -EINVAL;
7608
7609         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
7610                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
7611
7612                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
7613                 tokens_size = tokln - sizeof(*tok);
7614
7615                 if (!tok->len || tokens_size % tok->len)
7616                         return -EINVAL;
7617                 if (!rdev->wiphy.wowlan.tcp->tok)
7618                         return -EINVAL;
7619                 if (tok->len > rdev->wiphy.wowlan.tcp->tok->max_len)
7620                         return -EINVAL;
7621                 if (tok->len < rdev->wiphy.wowlan.tcp->tok->min_len)
7622                         return -EINVAL;
7623                 if (tokens_size > rdev->wiphy.wowlan.tcp->tok->bufsize)
7624                         return -EINVAL;
7625                 if (tok->offset + tok->len > data_size)
7626                         return -EINVAL;
7627         }
7628
7629         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
7630                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
7631                 if (!rdev->wiphy.wowlan.tcp->seq)
7632                         return -EINVAL;
7633                 if (seq->len == 0 || seq->len > 4)
7634                         return -EINVAL;
7635                 if (seq->len + seq->offset > data_size)
7636                         return -EINVAL;
7637         }
7638
7639         size = sizeof(*cfg);
7640         size += data_size;
7641         size += wake_size + wake_mask_size;
7642         size += tokens_size;
7643
7644         cfg = kzalloc(size, GFP_KERNEL);
7645         if (!cfg)
7646                 return -ENOMEM;
7647         cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
7648         cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
7649         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
7650                ETH_ALEN);
7651         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
7652                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
7653         else
7654                 port = 0;
7655 #ifdef CONFIG_INET
7656         /* allocate a socket and port for it and use it */
7657         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
7658                             IPPROTO_TCP, &cfg->sock, 1);
7659         if (err) {
7660                 kfree(cfg);
7661                 return err;
7662         }
7663         if (inet_csk_get_port(cfg->sock->sk, port)) {
7664                 sock_release(cfg->sock);
7665                 kfree(cfg);
7666                 return -EADDRINUSE;
7667         }
7668         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
7669 #else
7670         if (!port) {
7671                 kfree(cfg);
7672                 return -EINVAL;
7673         }
7674         cfg->src_port = port;
7675 #endif
7676
7677         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
7678         cfg->payload_len = data_size;
7679         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
7680         memcpy((void *)cfg->payload,
7681                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
7682                data_size);
7683         if (seq)
7684                 cfg->payload_seq = *seq;
7685         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
7686         cfg->wake_len = wake_size;
7687         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
7688         memcpy((void *)cfg->wake_data,
7689                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
7690                wake_size);
7691         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
7692                          data_size + wake_size;
7693         memcpy((void *)cfg->wake_mask,
7694                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
7695                wake_mask_size);
7696         if (tok) {
7697                 cfg->tokens_size = tokens_size;
7698                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
7699         }
7700
7701         trig->tcp = cfg;
7702
7703         return 0;
7704 }
7705
7706 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
7707 {
7708         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7709         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
7710         struct cfg80211_wowlan new_triggers = {};
7711         struct cfg80211_wowlan *ntrig;
7712         struct wiphy_wowlan_support *wowlan = &rdev->wiphy.wowlan;
7713         int err, i;
7714         bool prev_enabled = rdev->wowlan;
7715
7716         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns &&
7717             !rdev->wiphy.wowlan.tcp)
7718                 return -EOPNOTSUPP;
7719
7720         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
7721                 cfg80211_rdev_free_wowlan(rdev);
7722                 rdev->wowlan = NULL;
7723                 goto set_wakeup;
7724         }
7725
7726         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
7727                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
7728                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
7729                         nl80211_wowlan_policy);
7730         if (err)
7731                 return err;
7732
7733         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
7734                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
7735                         return -EINVAL;
7736                 new_triggers.any = true;
7737         }
7738
7739         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
7740                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
7741                         return -EINVAL;
7742                 new_triggers.disconnect = true;
7743         }
7744
7745         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
7746                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
7747                         return -EINVAL;
7748                 new_triggers.magic_pkt = true;
7749         }
7750
7751         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
7752                 return -EINVAL;
7753
7754         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
7755                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
7756                         return -EINVAL;
7757                 new_triggers.gtk_rekey_failure = true;
7758         }
7759
7760         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
7761                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
7762                         return -EINVAL;
7763                 new_triggers.eap_identity_req = true;
7764         }
7765
7766         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
7767                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
7768                         return -EINVAL;
7769                 new_triggers.four_way_handshake = true;
7770         }
7771
7772         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
7773                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
7774                         return -EINVAL;
7775                 new_triggers.rfkill_release = true;
7776         }
7777
7778         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
7779                 struct nlattr *pat;
7780                 int n_patterns = 0;
7781                 int rem, pat_len, mask_len, pkt_offset;
7782                 struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
7783
7784                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
7785                                     rem)
7786                         n_patterns++;
7787                 if (n_patterns > wowlan->n_patterns)
7788                         return -EINVAL;
7789
7790                 new_triggers.patterns = kcalloc(n_patterns,
7791                                                 sizeof(new_triggers.patterns[0]),
7792                                                 GFP_KERNEL);
7793                 if (!new_triggers.patterns)
7794                         return -ENOMEM;
7795
7796                 new_triggers.n_patterns = n_patterns;
7797                 i = 0;
7798
7799                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
7800                                     rem) {
7801                         nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
7802                                   nla_data(pat), nla_len(pat), NULL);
7803                         err = -EINVAL;
7804                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
7805                             !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
7806                                 goto error;
7807                         pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
7808                         mask_len = DIV_ROUND_UP(pat_len, 8);
7809                         if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
7810                             mask_len)
7811                                 goto error;
7812                         if (pat_len > wowlan->pattern_max_len ||
7813                             pat_len < wowlan->pattern_min_len)
7814                                 goto error;
7815
7816                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET])
7817                                 pkt_offset = 0;
7818                         else
7819                                 pkt_offset = nla_get_u32(
7820                                         pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET]);
7821                         if (pkt_offset > wowlan->max_pkt_offset)
7822                                 goto error;
7823                         new_triggers.patterns[i].pkt_offset = pkt_offset;
7824
7825                         new_triggers.patterns[i].mask =
7826                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
7827                         if (!new_triggers.patterns[i].mask) {
7828                                 err = -ENOMEM;
7829                                 goto error;
7830                         }
7831                         new_triggers.patterns[i].pattern =
7832                                 new_triggers.patterns[i].mask + mask_len;
7833                         memcpy(new_triggers.patterns[i].mask,
7834                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
7835                                mask_len);
7836                         new_triggers.patterns[i].pattern_len = pat_len;
7837                         memcpy(new_triggers.patterns[i].pattern,
7838                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
7839                                pat_len);
7840                         i++;
7841                 }
7842         }
7843
7844         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
7845                 err = nl80211_parse_wowlan_tcp(
7846                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
7847                         &new_triggers);
7848                 if (err)
7849                         goto error;
7850         }
7851
7852         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
7853         if (!ntrig) {
7854                 err = -ENOMEM;
7855                 goto error;
7856         }
7857         cfg80211_rdev_free_wowlan(rdev);
7858         rdev->wowlan = ntrig;
7859
7860  set_wakeup:
7861         if (rdev->ops->set_wakeup && prev_enabled != !!rdev->wowlan)
7862                 rdev_set_wakeup(rdev, rdev->wowlan);
7863
7864         return 0;
7865  error:
7866         for (i = 0; i < new_triggers.n_patterns; i++)
7867                 kfree(new_triggers.patterns[i].mask);
7868         kfree(new_triggers.patterns);
7869         if (new_triggers.tcp && new_triggers.tcp->sock)
7870                 sock_release(new_triggers.tcp->sock);
7871         kfree(new_triggers.tcp);
7872         return err;
7873 }
7874 #endif
7875
7876 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
7877 {
7878         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7879         struct net_device *dev = info->user_ptr[1];
7880         struct wireless_dev *wdev = dev->ieee80211_ptr;
7881         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
7882         struct cfg80211_gtk_rekey_data rekey_data;
7883         int err;
7884
7885         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
7886                 return -EINVAL;
7887
7888         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
7889                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
7890                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
7891                         nl80211_rekey_policy);
7892         if (err)
7893                 return err;
7894
7895         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
7896                 return -ERANGE;
7897         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
7898                 return -ERANGE;
7899         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
7900                 return -ERANGE;
7901
7902         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
7903                NL80211_KEK_LEN);
7904         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
7905                NL80211_KCK_LEN);
7906         memcpy(rekey_data.replay_ctr,
7907                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
7908                NL80211_REPLAY_CTR_LEN);
7909
7910         wdev_lock(wdev);
7911         if (!wdev->current_bss) {
7912                 err = -ENOTCONN;
7913                 goto out;
7914         }
7915
7916         if (!rdev->ops->set_rekey_data) {
7917                 err = -EOPNOTSUPP;
7918                 goto out;
7919         }
7920
7921         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
7922  out:
7923         wdev_unlock(wdev);
7924         return err;
7925 }
7926
7927 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
7928                                              struct genl_info *info)
7929 {
7930         struct net_device *dev = info->user_ptr[1];
7931         struct wireless_dev *wdev = dev->ieee80211_ptr;
7932
7933         if (wdev->iftype != NL80211_IFTYPE_AP &&
7934             wdev->iftype != NL80211_IFTYPE_P2P_GO)
7935                 return -EINVAL;
7936
7937         if (wdev->ap_unexpected_nlportid)
7938                 return -EBUSY;
7939
7940         wdev->ap_unexpected_nlportid = info->snd_portid;
7941         return 0;
7942 }
7943
7944 static int nl80211_probe_client(struct sk_buff *skb,
7945                                 struct genl_info *info)
7946 {
7947         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7948         struct net_device *dev = info->user_ptr[1];
7949         struct wireless_dev *wdev = dev->ieee80211_ptr;
7950         struct sk_buff *msg;
7951         void *hdr;
7952         const u8 *addr;
7953         u64 cookie;
7954         int err;
7955
7956         if (wdev->iftype != NL80211_IFTYPE_AP &&
7957             wdev->iftype != NL80211_IFTYPE_P2P_GO)
7958                 return -EOPNOTSUPP;
7959
7960         if (!info->attrs[NL80211_ATTR_MAC])
7961                 return -EINVAL;
7962
7963         if (!rdev->ops->probe_client)
7964                 return -EOPNOTSUPP;
7965
7966         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7967         if (!msg)
7968                 return -ENOMEM;
7969
7970         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7971                              NL80211_CMD_PROBE_CLIENT);
7972
7973         if (IS_ERR(hdr)) {
7974                 err = PTR_ERR(hdr);
7975                 goto free_msg;
7976         }
7977
7978         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7979
7980         err = rdev_probe_client(rdev, dev, addr, &cookie);
7981         if (err)
7982                 goto free_msg;
7983
7984         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7985                 goto nla_put_failure;
7986
7987         genlmsg_end(msg, hdr);
7988
7989         return genlmsg_reply(msg, info);
7990
7991  nla_put_failure:
7992         err = -ENOBUFS;
7993  free_msg:
7994         nlmsg_free(msg);
7995         return err;
7996 }
7997
7998 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
7999 {
8000         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8001         struct cfg80211_beacon_registration *reg, *nreg;
8002         int rv;
8003
8004         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
8005                 return -EOPNOTSUPP;
8006
8007         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
8008         if (!nreg)
8009                 return -ENOMEM;
8010
8011         /* First, check if already registered. */
8012         spin_lock_bh(&rdev->beacon_registrations_lock);
8013         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
8014                 if (reg->nlportid == info->snd_portid) {
8015                         rv = -EALREADY;
8016                         goto out_err;
8017                 }
8018         }
8019         /* Add it to the list */
8020         nreg->nlportid = info->snd_portid;
8021         list_add(&nreg->list, &rdev->beacon_registrations);
8022
8023         spin_unlock_bh(&rdev->beacon_registrations_lock);
8024
8025         return 0;
8026 out_err:
8027         spin_unlock_bh(&rdev->beacon_registrations_lock);
8028         kfree(nreg);
8029         return rv;
8030 }
8031
8032 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
8033 {
8034         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8035         struct wireless_dev *wdev = info->user_ptr[1];
8036         int err;
8037
8038         if (!rdev->ops->start_p2p_device)
8039                 return -EOPNOTSUPP;
8040
8041         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
8042                 return -EOPNOTSUPP;
8043
8044         if (wdev->p2p_started)
8045                 return 0;
8046
8047         mutex_lock(&rdev->devlist_mtx);
8048         err = cfg80211_can_add_interface(rdev, wdev->iftype);
8049         mutex_unlock(&rdev->devlist_mtx);
8050         if (err)
8051                 return err;
8052
8053         err = rdev_start_p2p_device(rdev, wdev);
8054         if (err)
8055                 return err;
8056
8057         wdev->p2p_started = true;
8058         mutex_lock(&rdev->devlist_mtx);
8059         rdev->opencount++;
8060         mutex_unlock(&rdev->devlist_mtx);
8061
8062         return 0;
8063 }
8064
8065 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
8066 {
8067         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8068         struct wireless_dev *wdev = info->user_ptr[1];
8069
8070         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
8071                 return -EOPNOTSUPP;
8072
8073         if (!rdev->ops->stop_p2p_device)
8074                 return -EOPNOTSUPP;
8075
8076         if (!wdev->p2p_started)
8077                 return 0;
8078
8079         rdev_stop_p2p_device(rdev, wdev);
8080         wdev->p2p_started = false;
8081
8082         mutex_lock(&rdev->devlist_mtx);
8083         rdev->opencount--;
8084         mutex_unlock(&rdev->devlist_mtx);
8085
8086         if (WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev)) {
8087                 rdev->scan_req->aborted = true;
8088                 ___cfg80211_scan_done(rdev, true);
8089         }
8090
8091         return 0;
8092 }
8093
8094 static int nl80211_get_protocol_features(struct sk_buff *skb,
8095                                          struct genl_info *info)
8096 {
8097         void *hdr;
8098         struct sk_buff *msg;
8099
8100         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8101         if (!msg)
8102                 return -ENOMEM;
8103
8104         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8105                              NL80211_CMD_GET_PROTOCOL_FEATURES);
8106         if (!hdr)
8107                 goto nla_put_failure;
8108
8109         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
8110                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
8111                 goto nla_put_failure;
8112
8113         genlmsg_end(msg, hdr);
8114         return genlmsg_reply(msg, info);
8115
8116  nla_put_failure:
8117         kfree_skb(msg);
8118         return -ENOBUFS;
8119 }
8120
8121 #define NL80211_FLAG_NEED_WIPHY         0x01
8122 #define NL80211_FLAG_NEED_NETDEV        0x02
8123 #define NL80211_FLAG_NEED_RTNL          0x04
8124 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
8125 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
8126                                          NL80211_FLAG_CHECK_NETDEV_UP)
8127 #define NL80211_FLAG_NEED_WDEV          0x10
8128 /* If a netdev is associated, it must be UP, P2P must be started */
8129 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
8130                                          NL80211_FLAG_CHECK_NETDEV_UP)
8131
8132 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
8133                             struct genl_info *info)
8134 {
8135         struct cfg80211_registered_device *rdev;
8136         struct wireless_dev *wdev;
8137         struct net_device *dev;
8138         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
8139
8140         if (rtnl)
8141                 rtnl_lock();
8142
8143         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
8144                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
8145                 if (IS_ERR(rdev)) {
8146                         if (rtnl)
8147                                 rtnl_unlock();
8148                         return PTR_ERR(rdev);
8149                 }
8150                 info->user_ptr[0] = rdev;
8151         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
8152                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
8153                 mutex_lock(&cfg80211_mutex);
8154                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
8155                                                   info->attrs);
8156                 if (IS_ERR(wdev)) {
8157                         mutex_unlock(&cfg80211_mutex);
8158                         if (rtnl)
8159                                 rtnl_unlock();
8160                         return PTR_ERR(wdev);
8161                 }
8162
8163                 dev = wdev->netdev;
8164                 rdev = wiphy_to_dev(wdev->wiphy);
8165
8166                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
8167                         if (!dev) {
8168                                 mutex_unlock(&cfg80211_mutex);
8169                                 if (rtnl)
8170                                         rtnl_unlock();
8171                                 return -EINVAL;
8172                         }
8173
8174                         info->user_ptr[1] = dev;
8175                 } else {
8176                         info->user_ptr[1] = wdev;
8177                 }
8178
8179                 if (dev) {
8180                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
8181                             !netif_running(dev)) {
8182                                 mutex_unlock(&cfg80211_mutex);
8183                                 if (rtnl)
8184                                         rtnl_unlock();
8185                                 return -ENETDOWN;
8186                         }
8187
8188                         dev_hold(dev);
8189                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
8190                         if (!wdev->p2p_started) {
8191                                 mutex_unlock(&cfg80211_mutex);
8192                                 if (rtnl)
8193                                         rtnl_unlock();
8194                                 return -ENETDOWN;
8195                         }
8196                 }
8197
8198                 cfg80211_lock_rdev(rdev);
8199
8200                 mutex_unlock(&cfg80211_mutex);
8201
8202                 info->user_ptr[0] = rdev;
8203         }
8204
8205         return 0;
8206 }
8207
8208 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
8209                               struct genl_info *info)
8210 {
8211         if (info->user_ptr[0])
8212                 cfg80211_unlock_rdev(info->user_ptr[0]);
8213         if (info->user_ptr[1]) {
8214                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
8215                         struct wireless_dev *wdev = info->user_ptr[1];
8216
8217                         if (wdev->netdev)
8218                                 dev_put(wdev->netdev);
8219                 } else {
8220                         dev_put(info->user_ptr[1]);
8221                 }
8222         }
8223         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
8224                 rtnl_unlock();
8225 }
8226
8227 static struct genl_ops nl80211_ops[] = {
8228         {
8229                 .cmd = NL80211_CMD_GET_WIPHY,
8230                 .doit = nl80211_get_wiphy,
8231                 .dumpit = nl80211_dump_wiphy,
8232                 .policy = nl80211_policy,
8233                 /* can be retrieved by unprivileged users */
8234                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
8235         },
8236         {
8237                 .cmd = NL80211_CMD_SET_WIPHY,
8238                 .doit = nl80211_set_wiphy,
8239                 .policy = nl80211_policy,
8240                 .flags = GENL_ADMIN_PERM,
8241                 .internal_flags = NL80211_FLAG_NEED_RTNL,
8242         },
8243         {
8244                 .cmd = NL80211_CMD_GET_INTERFACE,
8245                 .doit = nl80211_get_interface,
8246                 .dumpit = nl80211_dump_interface,
8247                 .policy = nl80211_policy,
8248                 /* can be retrieved by unprivileged users */
8249                 .internal_flags = NL80211_FLAG_NEED_WDEV,
8250         },
8251         {
8252                 .cmd = NL80211_CMD_SET_INTERFACE,
8253                 .doit = nl80211_set_interface,
8254                 .policy = nl80211_policy,
8255                 .flags = GENL_ADMIN_PERM,
8256                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8257                                   NL80211_FLAG_NEED_RTNL,
8258         },
8259         {
8260                 .cmd = NL80211_CMD_NEW_INTERFACE,
8261                 .doit = nl80211_new_interface,
8262                 .policy = nl80211_policy,
8263                 .flags = GENL_ADMIN_PERM,
8264                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8265                                   NL80211_FLAG_NEED_RTNL,
8266         },
8267         {
8268                 .cmd = NL80211_CMD_DEL_INTERFACE,
8269                 .doit = nl80211_del_interface,
8270                 .policy = nl80211_policy,
8271                 .flags = GENL_ADMIN_PERM,
8272                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8273                                   NL80211_FLAG_NEED_RTNL,
8274         },
8275         {
8276                 .cmd = NL80211_CMD_GET_KEY,
8277                 .doit = nl80211_get_key,
8278                 .policy = nl80211_policy,
8279                 .flags = GENL_ADMIN_PERM,
8280                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8281                                   NL80211_FLAG_NEED_RTNL,
8282         },
8283         {
8284                 .cmd = NL80211_CMD_SET_KEY,
8285                 .doit = nl80211_set_key,
8286                 .policy = nl80211_policy,
8287                 .flags = GENL_ADMIN_PERM,
8288                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8289                                   NL80211_FLAG_NEED_RTNL,
8290         },
8291         {
8292                 .cmd = NL80211_CMD_NEW_KEY,
8293                 .doit = nl80211_new_key,
8294                 .policy = nl80211_policy,
8295                 .flags = GENL_ADMIN_PERM,
8296                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8297                                   NL80211_FLAG_NEED_RTNL,
8298         },
8299         {
8300                 .cmd = NL80211_CMD_DEL_KEY,
8301                 .doit = nl80211_del_key,
8302                 .policy = nl80211_policy,
8303                 .flags = GENL_ADMIN_PERM,
8304                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8305                                   NL80211_FLAG_NEED_RTNL,
8306         },
8307         {
8308                 .cmd = NL80211_CMD_SET_BEACON,
8309                 .policy = nl80211_policy,
8310                 .flags = GENL_ADMIN_PERM,
8311                 .doit = nl80211_set_beacon,
8312                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8313                                   NL80211_FLAG_NEED_RTNL,
8314         },
8315         {
8316                 .cmd = NL80211_CMD_START_AP,
8317                 .policy = nl80211_policy,
8318                 .flags = GENL_ADMIN_PERM,
8319                 .doit = nl80211_start_ap,
8320                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8321                                   NL80211_FLAG_NEED_RTNL,
8322         },
8323         {
8324                 .cmd = NL80211_CMD_STOP_AP,
8325                 .policy = nl80211_policy,
8326                 .flags = GENL_ADMIN_PERM,
8327                 .doit = nl80211_stop_ap,
8328                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8329                                   NL80211_FLAG_NEED_RTNL,
8330         },
8331         {
8332                 .cmd = NL80211_CMD_GET_STATION,
8333                 .doit = nl80211_get_station,
8334                 .dumpit = nl80211_dump_station,
8335                 .policy = nl80211_policy,
8336                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8337                                   NL80211_FLAG_NEED_RTNL,
8338         },
8339         {
8340                 .cmd = NL80211_CMD_SET_STATION,
8341                 .doit = nl80211_set_station,
8342                 .policy = nl80211_policy,
8343                 .flags = GENL_ADMIN_PERM,
8344                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8345                                   NL80211_FLAG_NEED_RTNL,
8346         },
8347         {
8348                 .cmd = NL80211_CMD_NEW_STATION,
8349                 .doit = nl80211_new_station,
8350                 .policy = nl80211_policy,
8351                 .flags = GENL_ADMIN_PERM,
8352                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8353                                   NL80211_FLAG_NEED_RTNL,
8354         },
8355         {
8356                 .cmd = NL80211_CMD_DEL_STATION,
8357                 .doit = nl80211_del_station,
8358                 .policy = nl80211_policy,
8359                 .flags = GENL_ADMIN_PERM,
8360                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8361                                   NL80211_FLAG_NEED_RTNL,
8362         },
8363         {
8364                 .cmd = NL80211_CMD_GET_MPATH,
8365                 .doit = nl80211_get_mpath,
8366                 .dumpit = nl80211_dump_mpath,
8367                 .policy = nl80211_policy,
8368                 .flags = GENL_ADMIN_PERM,
8369                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8370                                   NL80211_FLAG_NEED_RTNL,
8371         },
8372         {
8373                 .cmd = NL80211_CMD_SET_MPATH,
8374                 .doit = nl80211_set_mpath,
8375                 .policy = nl80211_policy,
8376                 .flags = GENL_ADMIN_PERM,
8377                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8378                                   NL80211_FLAG_NEED_RTNL,
8379         },
8380         {
8381                 .cmd = NL80211_CMD_NEW_MPATH,
8382                 .doit = nl80211_new_mpath,
8383                 .policy = nl80211_policy,
8384                 .flags = GENL_ADMIN_PERM,
8385                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8386                                   NL80211_FLAG_NEED_RTNL,
8387         },
8388         {
8389                 .cmd = NL80211_CMD_DEL_MPATH,
8390                 .doit = nl80211_del_mpath,
8391                 .policy = nl80211_policy,
8392                 .flags = GENL_ADMIN_PERM,
8393                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8394                                   NL80211_FLAG_NEED_RTNL,
8395         },
8396         {
8397                 .cmd = NL80211_CMD_SET_BSS,
8398                 .doit = nl80211_set_bss,
8399                 .policy = nl80211_policy,
8400                 .flags = GENL_ADMIN_PERM,
8401                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8402                                   NL80211_FLAG_NEED_RTNL,
8403         },
8404         {
8405                 .cmd = NL80211_CMD_GET_REG,
8406                 .doit = nl80211_get_reg,
8407                 .policy = nl80211_policy,
8408                 /* can be retrieved by unprivileged users */
8409         },
8410         {
8411                 .cmd = NL80211_CMD_SET_REG,
8412                 .doit = nl80211_set_reg,
8413                 .policy = nl80211_policy,
8414                 .flags = GENL_ADMIN_PERM,
8415         },
8416         {
8417                 .cmd = NL80211_CMD_REQ_SET_REG,
8418                 .doit = nl80211_req_set_reg,
8419                 .policy = nl80211_policy,
8420                 .flags = GENL_ADMIN_PERM,
8421         },
8422         {
8423                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
8424                 .doit = nl80211_get_mesh_config,
8425                 .policy = nl80211_policy,
8426                 /* can be retrieved by unprivileged users */
8427                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8428                                   NL80211_FLAG_NEED_RTNL,
8429         },
8430         {
8431                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
8432                 .doit = nl80211_update_mesh_config,
8433                 .policy = nl80211_policy,
8434                 .flags = GENL_ADMIN_PERM,
8435                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8436                                   NL80211_FLAG_NEED_RTNL,
8437         },
8438         {
8439                 .cmd = NL80211_CMD_TRIGGER_SCAN,
8440                 .doit = nl80211_trigger_scan,
8441                 .policy = nl80211_policy,
8442                 .flags = GENL_ADMIN_PERM,
8443                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8444                                   NL80211_FLAG_NEED_RTNL,
8445         },
8446         {
8447                 .cmd = NL80211_CMD_GET_SCAN,
8448                 .policy = nl80211_policy,
8449                 .dumpit = nl80211_dump_scan,
8450         },
8451         {
8452                 .cmd = NL80211_CMD_START_SCHED_SCAN,
8453                 .doit = nl80211_start_sched_scan,
8454                 .policy = nl80211_policy,
8455                 .flags = GENL_ADMIN_PERM,
8456                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8457                                   NL80211_FLAG_NEED_RTNL,
8458         },
8459         {
8460                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
8461                 .doit = nl80211_stop_sched_scan,
8462                 .policy = nl80211_policy,
8463                 .flags = GENL_ADMIN_PERM,
8464                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8465                                   NL80211_FLAG_NEED_RTNL,
8466         },
8467         {
8468                 .cmd = NL80211_CMD_AUTHENTICATE,
8469                 .doit = nl80211_authenticate,
8470                 .policy = nl80211_policy,
8471                 .flags = GENL_ADMIN_PERM,
8472                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8473                                   NL80211_FLAG_NEED_RTNL,
8474         },
8475         {
8476                 .cmd = NL80211_CMD_ASSOCIATE,
8477                 .doit = nl80211_associate,
8478                 .policy = nl80211_policy,
8479                 .flags = GENL_ADMIN_PERM,
8480                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8481                                   NL80211_FLAG_NEED_RTNL,
8482         },
8483         {
8484                 .cmd = NL80211_CMD_DEAUTHENTICATE,
8485                 .doit = nl80211_deauthenticate,
8486                 .policy = nl80211_policy,
8487                 .flags = GENL_ADMIN_PERM,
8488                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8489                                   NL80211_FLAG_NEED_RTNL,
8490         },
8491         {
8492                 .cmd = NL80211_CMD_DISASSOCIATE,
8493                 .doit = nl80211_disassociate,
8494                 .policy = nl80211_policy,
8495                 .flags = GENL_ADMIN_PERM,
8496                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8497                                   NL80211_FLAG_NEED_RTNL,
8498         },
8499         {
8500                 .cmd = NL80211_CMD_JOIN_IBSS,
8501                 .doit = nl80211_join_ibss,
8502                 .policy = nl80211_policy,
8503                 .flags = GENL_ADMIN_PERM,
8504                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8505                                   NL80211_FLAG_NEED_RTNL,
8506         },
8507         {
8508                 .cmd = NL80211_CMD_LEAVE_IBSS,
8509                 .doit = nl80211_leave_ibss,
8510                 .policy = nl80211_policy,
8511                 .flags = GENL_ADMIN_PERM,
8512                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8513                                   NL80211_FLAG_NEED_RTNL,
8514         },
8515 #ifdef CONFIG_NL80211_TESTMODE
8516         {
8517                 .cmd = NL80211_CMD_TESTMODE,
8518                 .doit = nl80211_testmode_do,
8519                 .dumpit = nl80211_testmode_dump,
8520                 .policy = nl80211_policy,
8521                 .flags = GENL_ADMIN_PERM,
8522                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8523                                   NL80211_FLAG_NEED_RTNL,
8524         },
8525 #endif
8526         {
8527                 .cmd = NL80211_CMD_CONNECT,
8528                 .doit = nl80211_connect,
8529                 .policy = nl80211_policy,
8530                 .flags = GENL_ADMIN_PERM,
8531                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8532                                   NL80211_FLAG_NEED_RTNL,
8533         },
8534         {
8535                 .cmd = NL80211_CMD_DISCONNECT,
8536                 .doit = nl80211_disconnect,
8537                 .policy = nl80211_policy,
8538                 .flags = GENL_ADMIN_PERM,
8539                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8540                                   NL80211_FLAG_NEED_RTNL,
8541         },
8542         {
8543                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
8544                 .doit = nl80211_wiphy_netns,
8545                 .policy = nl80211_policy,
8546                 .flags = GENL_ADMIN_PERM,
8547                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8548                                   NL80211_FLAG_NEED_RTNL,
8549         },
8550         {
8551                 .cmd = NL80211_CMD_GET_SURVEY,
8552                 .policy = nl80211_policy,
8553                 .dumpit = nl80211_dump_survey,
8554         },
8555         {
8556                 .cmd = NL80211_CMD_SET_PMKSA,
8557                 .doit = nl80211_setdel_pmksa,
8558                 .policy = nl80211_policy,
8559                 .flags = GENL_ADMIN_PERM,
8560                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8561                                   NL80211_FLAG_NEED_RTNL,
8562         },
8563         {
8564                 .cmd = NL80211_CMD_DEL_PMKSA,
8565                 .doit = nl80211_setdel_pmksa,
8566                 .policy = nl80211_policy,
8567                 .flags = GENL_ADMIN_PERM,
8568                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8569                                   NL80211_FLAG_NEED_RTNL,
8570         },
8571         {
8572                 .cmd = NL80211_CMD_FLUSH_PMKSA,
8573                 .doit = nl80211_flush_pmksa,
8574                 .policy = nl80211_policy,
8575                 .flags = GENL_ADMIN_PERM,
8576                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8577                                   NL80211_FLAG_NEED_RTNL,
8578         },
8579         {
8580                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
8581                 .doit = nl80211_remain_on_channel,
8582                 .policy = nl80211_policy,
8583                 .flags = GENL_ADMIN_PERM,
8584                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8585                                   NL80211_FLAG_NEED_RTNL,
8586         },
8587         {
8588                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
8589                 .doit = nl80211_cancel_remain_on_channel,
8590                 .policy = nl80211_policy,
8591                 .flags = GENL_ADMIN_PERM,
8592                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8593                                   NL80211_FLAG_NEED_RTNL,
8594         },
8595         {
8596                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
8597                 .doit = nl80211_set_tx_bitrate_mask,
8598                 .policy = nl80211_policy,
8599                 .flags = GENL_ADMIN_PERM,
8600                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8601                                   NL80211_FLAG_NEED_RTNL,
8602         },
8603         {
8604                 .cmd = NL80211_CMD_REGISTER_FRAME,
8605                 .doit = nl80211_register_mgmt,
8606                 .policy = nl80211_policy,
8607                 .flags = GENL_ADMIN_PERM,
8608                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8609                                   NL80211_FLAG_NEED_RTNL,
8610         },
8611         {
8612                 .cmd = NL80211_CMD_FRAME,
8613                 .doit = nl80211_tx_mgmt,
8614                 .policy = nl80211_policy,
8615                 .flags = GENL_ADMIN_PERM,
8616                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8617                                   NL80211_FLAG_NEED_RTNL,
8618         },
8619         {
8620                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
8621                 .doit = nl80211_tx_mgmt_cancel_wait,
8622                 .policy = nl80211_policy,
8623                 .flags = GENL_ADMIN_PERM,
8624                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8625                                   NL80211_FLAG_NEED_RTNL,
8626         },
8627         {
8628                 .cmd = NL80211_CMD_SET_POWER_SAVE,
8629                 .doit = nl80211_set_power_save,
8630                 .policy = nl80211_policy,
8631                 .flags = GENL_ADMIN_PERM,
8632                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8633                                   NL80211_FLAG_NEED_RTNL,
8634         },
8635         {
8636                 .cmd = NL80211_CMD_GET_POWER_SAVE,
8637                 .doit = nl80211_get_power_save,
8638                 .policy = nl80211_policy,
8639                 /* can be retrieved by unprivileged users */
8640                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8641                                   NL80211_FLAG_NEED_RTNL,
8642         },
8643         {
8644                 .cmd = NL80211_CMD_SET_CQM,
8645                 .doit = nl80211_set_cqm,
8646                 .policy = nl80211_policy,
8647                 .flags = GENL_ADMIN_PERM,
8648                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8649                                   NL80211_FLAG_NEED_RTNL,
8650         },
8651         {
8652                 .cmd = NL80211_CMD_SET_CHANNEL,
8653                 .doit = nl80211_set_channel,
8654                 .policy = nl80211_policy,
8655                 .flags = GENL_ADMIN_PERM,
8656                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8657                                   NL80211_FLAG_NEED_RTNL,
8658         },
8659         {
8660                 .cmd = NL80211_CMD_SET_WDS_PEER,
8661                 .doit = nl80211_set_wds_peer,
8662                 .policy = nl80211_policy,
8663                 .flags = GENL_ADMIN_PERM,
8664                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8665                                   NL80211_FLAG_NEED_RTNL,
8666         },
8667         {
8668                 .cmd = NL80211_CMD_JOIN_MESH,
8669                 .doit = nl80211_join_mesh,
8670                 .policy = nl80211_policy,
8671                 .flags = GENL_ADMIN_PERM,
8672                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8673                                   NL80211_FLAG_NEED_RTNL,
8674         },
8675         {
8676                 .cmd = NL80211_CMD_LEAVE_MESH,
8677                 .doit = nl80211_leave_mesh,
8678                 .policy = nl80211_policy,
8679                 .flags = GENL_ADMIN_PERM,
8680                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8681                                   NL80211_FLAG_NEED_RTNL,
8682         },
8683 #ifdef CONFIG_PM
8684         {
8685                 .cmd = NL80211_CMD_GET_WOWLAN,
8686                 .doit = nl80211_get_wowlan,
8687                 .policy = nl80211_policy,
8688                 /* can be retrieved by unprivileged users */
8689                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8690                                   NL80211_FLAG_NEED_RTNL,
8691         },
8692         {
8693                 .cmd = NL80211_CMD_SET_WOWLAN,
8694                 .doit = nl80211_set_wowlan,
8695                 .policy = nl80211_policy,
8696                 .flags = GENL_ADMIN_PERM,
8697                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8698                                   NL80211_FLAG_NEED_RTNL,
8699         },
8700 #endif
8701         {
8702                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
8703                 .doit = nl80211_set_rekey_data,
8704                 .policy = nl80211_policy,
8705                 .flags = GENL_ADMIN_PERM,
8706                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8707                                   NL80211_FLAG_NEED_RTNL,
8708         },
8709         {
8710                 .cmd = NL80211_CMD_TDLS_MGMT,
8711                 .doit = nl80211_tdls_mgmt,
8712                 .policy = nl80211_policy,
8713                 .flags = GENL_ADMIN_PERM,
8714                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8715                                   NL80211_FLAG_NEED_RTNL,
8716         },
8717         {
8718                 .cmd = NL80211_CMD_TDLS_OPER,
8719                 .doit = nl80211_tdls_oper,
8720                 .policy = nl80211_policy,
8721                 .flags = GENL_ADMIN_PERM,
8722                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8723                                   NL80211_FLAG_NEED_RTNL,
8724         },
8725         {
8726                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
8727                 .doit = nl80211_register_unexpected_frame,
8728                 .policy = nl80211_policy,
8729                 .flags = GENL_ADMIN_PERM,
8730                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8731                                   NL80211_FLAG_NEED_RTNL,
8732         },
8733         {
8734                 .cmd = NL80211_CMD_PROBE_CLIENT,
8735                 .doit = nl80211_probe_client,
8736                 .policy = nl80211_policy,
8737                 .flags = GENL_ADMIN_PERM,
8738                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8739                                   NL80211_FLAG_NEED_RTNL,
8740         },
8741         {
8742                 .cmd = NL80211_CMD_REGISTER_BEACONS,
8743                 .doit = nl80211_register_beacons,
8744                 .policy = nl80211_policy,
8745                 .flags = GENL_ADMIN_PERM,
8746                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8747                                   NL80211_FLAG_NEED_RTNL,
8748         },
8749         {
8750                 .cmd = NL80211_CMD_SET_NOACK_MAP,
8751                 .doit = nl80211_set_noack_map,
8752                 .policy = nl80211_policy,
8753                 .flags = GENL_ADMIN_PERM,
8754                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8755                                   NL80211_FLAG_NEED_RTNL,
8756         },
8757         {
8758                 .cmd = NL80211_CMD_START_P2P_DEVICE,
8759                 .doit = nl80211_start_p2p_device,
8760                 .policy = nl80211_policy,
8761                 .flags = GENL_ADMIN_PERM,
8762                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8763                                   NL80211_FLAG_NEED_RTNL,
8764         },
8765         {
8766                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
8767                 .doit = nl80211_stop_p2p_device,
8768                 .policy = nl80211_policy,
8769                 .flags = GENL_ADMIN_PERM,
8770                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8771                                   NL80211_FLAG_NEED_RTNL,
8772         },
8773         {
8774                 .cmd = NL80211_CMD_SET_MCAST_RATE,
8775                 .doit = nl80211_set_mcast_rate,
8776                 .policy = nl80211_policy,
8777                 .flags = GENL_ADMIN_PERM,
8778                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8779                                   NL80211_FLAG_NEED_RTNL,
8780         },
8781         {
8782                 .cmd = NL80211_CMD_SET_MAC_ACL,
8783                 .doit = nl80211_set_mac_acl,
8784                 .policy = nl80211_policy,
8785                 .flags = GENL_ADMIN_PERM,
8786                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8787                                   NL80211_FLAG_NEED_RTNL,
8788         },
8789         {
8790                 .cmd = NL80211_CMD_RADAR_DETECT,
8791                 .doit = nl80211_start_radar_detection,
8792                 .policy = nl80211_policy,
8793                 .flags = GENL_ADMIN_PERM,
8794                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8795                                   NL80211_FLAG_NEED_RTNL,
8796         },
8797         {
8798                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
8799                 .doit = nl80211_get_protocol_features,
8800                 .policy = nl80211_policy,
8801         },
8802 };
8803
8804 static struct genl_multicast_group nl80211_mlme_mcgrp = {
8805         .name = "mlme",
8806 };
8807
8808 /* multicast groups */
8809 static struct genl_multicast_group nl80211_config_mcgrp = {
8810         .name = "config",
8811 };
8812 static struct genl_multicast_group nl80211_scan_mcgrp = {
8813         .name = "scan",
8814 };
8815 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
8816         .name = "regulatory",
8817 };
8818
8819 /* notification functions */
8820
8821 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
8822 {
8823         struct sk_buff *msg;
8824
8825         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8826         if (!msg)
8827                 return;
8828
8829         if (nl80211_send_wiphy(rdev, msg, 0, 0, 0,
8830                                false, NULL, NULL, NULL) < 0) {
8831                 nlmsg_free(msg);
8832                 return;
8833         }
8834
8835         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8836                                 nl80211_config_mcgrp.id, GFP_KERNEL);
8837 }
8838
8839 static int nl80211_add_scan_req(struct sk_buff *msg,
8840                                 struct cfg80211_registered_device *rdev)
8841 {
8842         struct cfg80211_scan_request *req = rdev->scan_req;
8843         struct nlattr *nest;
8844         int i;
8845
8846         ASSERT_RDEV_LOCK(rdev);
8847
8848         if (WARN_ON(!req))
8849                 return 0;
8850
8851         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
8852         if (!nest)
8853                 goto nla_put_failure;
8854         for (i = 0; i < req->n_ssids; i++) {
8855                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
8856                         goto nla_put_failure;
8857         }
8858         nla_nest_end(msg, nest);
8859
8860         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
8861         if (!nest)
8862                 goto nla_put_failure;
8863         for (i = 0; i < req->n_channels; i++) {
8864                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
8865                         goto nla_put_failure;
8866         }
8867         nla_nest_end(msg, nest);
8868
8869         if (req->ie &&
8870             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
8871                 goto nla_put_failure;
8872
8873         if (req->flags)
8874                 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags);
8875
8876         return 0;
8877  nla_put_failure:
8878         return -ENOBUFS;
8879 }
8880
8881 static int nl80211_send_scan_msg(struct sk_buff *msg,
8882                                  struct cfg80211_registered_device *rdev,
8883                                  struct wireless_dev *wdev,
8884                                  u32 portid, u32 seq, int flags,
8885                                  u32 cmd)
8886 {
8887         void *hdr;
8888
8889         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
8890         if (!hdr)
8891                 return -1;
8892
8893         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8894             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
8895                                          wdev->netdev->ifindex)) ||
8896             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
8897                 goto nla_put_failure;
8898
8899         /* ignore errors and send incomplete event anyway */
8900         nl80211_add_scan_req(msg, rdev);
8901
8902         return genlmsg_end(msg, hdr);
8903
8904  nla_put_failure:
8905         genlmsg_cancel(msg, hdr);
8906         return -EMSGSIZE;
8907 }
8908
8909 static int
8910 nl80211_send_sched_scan_msg(struct sk_buff *msg,
8911                             struct cfg80211_registered_device *rdev,
8912                             struct net_device *netdev,
8913                             u32 portid, u32 seq, int flags, u32 cmd)
8914 {
8915         void *hdr;
8916
8917         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
8918         if (!hdr)
8919                 return -1;
8920
8921         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8922             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
8923                 goto nla_put_failure;
8924
8925         return genlmsg_end(msg, hdr);
8926
8927  nla_put_failure:
8928         genlmsg_cancel(msg, hdr);
8929         return -EMSGSIZE;
8930 }
8931
8932 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
8933                              struct wireless_dev *wdev)
8934 {
8935         struct sk_buff *msg;
8936
8937         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8938         if (!msg)
8939                 return;
8940
8941         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
8942                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
8943                 nlmsg_free(msg);
8944                 return;
8945         }
8946
8947         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8948                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
8949 }
8950
8951 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
8952                             struct wireless_dev *wdev)
8953 {
8954         struct sk_buff *msg;
8955
8956         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8957         if (!msg)
8958                 return;
8959
8960         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
8961                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
8962                 nlmsg_free(msg);
8963                 return;
8964         }
8965
8966         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8967                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
8968 }
8969
8970 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
8971                                struct wireless_dev *wdev)
8972 {
8973         struct sk_buff *msg;
8974
8975         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8976         if (!msg)
8977                 return;
8978
8979         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
8980                                   NL80211_CMD_SCAN_ABORTED) < 0) {
8981                 nlmsg_free(msg);
8982                 return;
8983         }
8984
8985         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8986                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
8987 }
8988
8989 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
8990                                      struct net_device *netdev)
8991 {
8992         struct sk_buff *msg;
8993
8994         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8995         if (!msg)
8996                 return;
8997
8998         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
8999                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
9000                 nlmsg_free(msg);
9001                 return;
9002         }
9003
9004         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9005                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9006 }
9007
9008 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
9009                              struct net_device *netdev, u32 cmd)
9010 {
9011         struct sk_buff *msg;
9012
9013         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9014         if (!msg)
9015                 return;
9016
9017         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
9018                 nlmsg_free(msg);
9019                 return;
9020         }
9021
9022         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9023                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9024 }
9025
9026 /*
9027  * This can happen on global regulatory changes or device specific settings
9028  * based on custom world regulatory domains.
9029  */
9030 void nl80211_send_reg_change_event(struct regulatory_request *request)
9031 {
9032         struct sk_buff *msg;
9033         void *hdr;
9034
9035         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9036         if (!msg)
9037                 return;
9038
9039         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
9040         if (!hdr) {
9041                 nlmsg_free(msg);
9042                 return;
9043         }
9044
9045         /* Userspace can always count this one always being set */
9046         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
9047                 goto nla_put_failure;
9048
9049         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
9050                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9051                                NL80211_REGDOM_TYPE_WORLD))
9052                         goto nla_put_failure;
9053         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
9054                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9055                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
9056                         goto nla_put_failure;
9057         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
9058                    request->intersect) {
9059                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9060                                NL80211_REGDOM_TYPE_INTERSECTION))
9061                         goto nla_put_failure;
9062         } else {
9063                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9064                                NL80211_REGDOM_TYPE_COUNTRY) ||
9065                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
9066                                    request->alpha2))
9067                         goto nla_put_failure;
9068         }
9069
9070         if (request->wiphy_idx != WIPHY_IDX_INVALID &&
9071             nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
9072                 goto nla_put_failure;
9073
9074         genlmsg_end(msg, hdr);
9075
9076         rcu_read_lock();
9077         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
9078                                 GFP_ATOMIC);
9079         rcu_read_unlock();
9080
9081         return;
9082
9083 nla_put_failure:
9084         genlmsg_cancel(msg, hdr);
9085         nlmsg_free(msg);
9086 }
9087
9088 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
9089                                     struct net_device *netdev,
9090                                     const u8 *buf, size_t len,
9091                                     enum nl80211_commands cmd, gfp_t gfp)
9092 {
9093         struct sk_buff *msg;
9094         void *hdr;
9095
9096         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9097         if (!msg)
9098                 return;
9099
9100         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9101         if (!hdr) {
9102                 nlmsg_free(msg);
9103                 return;
9104         }
9105
9106         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9107             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9108             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
9109                 goto nla_put_failure;
9110
9111         genlmsg_end(msg, hdr);
9112
9113         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9114                                 nl80211_mlme_mcgrp.id, gfp);
9115         return;
9116
9117  nla_put_failure:
9118         genlmsg_cancel(msg, hdr);
9119         nlmsg_free(msg);
9120 }
9121
9122 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
9123                           struct net_device *netdev, const u8 *buf,
9124                           size_t len, gfp_t gfp)
9125 {
9126         nl80211_send_mlme_event(rdev, netdev, buf, len,
9127                                 NL80211_CMD_AUTHENTICATE, gfp);
9128 }
9129
9130 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
9131                            struct net_device *netdev, const u8 *buf,
9132                            size_t len, gfp_t gfp)
9133 {
9134         nl80211_send_mlme_event(rdev, netdev, buf, len,
9135                                 NL80211_CMD_ASSOCIATE, gfp);
9136 }
9137
9138 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
9139                          struct net_device *netdev, const u8 *buf,
9140                          size_t len, gfp_t gfp)
9141 {
9142         nl80211_send_mlme_event(rdev, netdev, buf, len,
9143                                 NL80211_CMD_DEAUTHENTICATE, gfp);
9144 }
9145
9146 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
9147                            struct net_device *netdev, const u8 *buf,
9148                            size_t len, gfp_t gfp)
9149 {
9150         nl80211_send_mlme_event(rdev, netdev, buf, len,
9151                                 NL80211_CMD_DISASSOCIATE, gfp);
9152 }
9153
9154 void cfg80211_send_unprot_deauth(struct net_device *dev, const u8 *buf,
9155                                  size_t len)
9156 {
9157         struct wireless_dev *wdev = dev->ieee80211_ptr;
9158         struct wiphy *wiphy = wdev->wiphy;
9159         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9160
9161         trace_cfg80211_send_unprot_deauth(dev);
9162         nl80211_send_mlme_event(rdev, dev, buf, len,
9163                                 NL80211_CMD_UNPROT_DEAUTHENTICATE, GFP_ATOMIC);
9164 }
9165 EXPORT_SYMBOL(cfg80211_send_unprot_deauth);
9166
9167 void cfg80211_send_unprot_disassoc(struct net_device *dev, const u8 *buf,
9168                                    size_t len)
9169 {
9170         struct wireless_dev *wdev = dev->ieee80211_ptr;
9171         struct wiphy *wiphy = wdev->wiphy;
9172         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9173
9174         trace_cfg80211_send_unprot_disassoc(dev);
9175         nl80211_send_mlme_event(rdev, dev, buf, len,
9176                                 NL80211_CMD_UNPROT_DISASSOCIATE, GFP_ATOMIC);
9177 }
9178 EXPORT_SYMBOL(cfg80211_send_unprot_disassoc);
9179
9180 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
9181                                       struct net_device *netdev, int cmd,
9182                                       const u8 *addr, gfp_t gfp)
9183 {
9184         struct sk_buff *msg;
9185         void *hdr;
9186
9187         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9188         if (!msg)
9189                 return;
9190
9191         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9192         if (!hdr) {
9193                 nlmsg_free(msg);
9194                 return;
9195         }
9196
9197         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9198             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9199             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
9200             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
9201                 goto nla_put_failure;
9202
9203         genlmsg_end(msg, hdr);
9204
9205         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9206                                 nl80211_mlme_mcgrp.id, gfp);
9207         return;
9208
9209  nla_put_failure:
9210         genlmsg_cancel(msg, hdr);
9211         nlmsg_free(msg);
9212 }
9213
9214 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
9215                                struct net_device *netdev, const u8 *addr,
9216                                gfp_t gfp)
9217 {
9218         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
9219                                   addr, gfp);
9220 }
9221
9222 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
9223                                 struct net_device *netdev, const u8 *addr,
9224                                 gfp_t gfp)
9225 {
9226         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
9227                                   addr, gfp);
9228 }
9229
9230 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
9231                                  struct net_device *netdev, const u8 *bssid,
9232                                  const u8 *req_ie, size_t req_ie_len,
9233                                  const u8 *resp_ie, size_t resp_ie_len,
9234                                  u16 status, gfp_t gfp)
9235 {
9236         struct sk_buff *msg;
9237         void *hdr;
9238
9239         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9240         if (!msg)
9241                 return;
9242
9243         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
9244         if (!hdr) {
9245                 nlmsg_free(msg);
9246                 return;
9247         }
9248
9249         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9250             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9251             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
9252             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
9253             (req_ie &&
9254              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
9255             (resp_ie &&
9256              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
9257                 goto nla_put_failure;
9258
9259         genlmsg_end(msg, hdr);
9260
9261         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9262                                 nl80211_mlme_mcgrp.id, gfp);
9263         return;
9264
9265  nla_put_failure:
9266         genlmsg_cancel(msg, hdr);
9267         nlmsg_free(msg);
9268
9269 }
9270
9271 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
9272                          struct net_device *netdev, const u8 *bssid,
9273                          const u8 *req_ie, size_t req_ie_len,
9274                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
9275 {
9276         struct sk_buff *msg;
9277         void *hdr;
9278
9279         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9280         if (!msg)
9281                 return;
9282
9283         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
9284         if (!hdr) {
9285                 nlmsg_free(msg);
9286                 return;
9287         }
9288
9289         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9290             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9291             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
9292             (req_ie &&
9293              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
9294             (resp_ie &&
9295              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
9296                 goto nla_put_failure;
9297
9298         genlmsg_end(msg, hdr);
9299
9300         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9301                                 nl80211_mlme_mcgrp.id, gfp);
9302         return;
9303
9304  nla_put_failure:
9305         genlmsg_cancel(msg, hdr);
9306         nlmsg_free(msg);
9307
9308 }
9309
9310 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
9311                                struct net_device *netdev, u16 reason,
9312                                const u8 *ie, size_t ie_len, bool from_ap)
9313 {
9314         struct sk_buff *msg;
9315         void *hdr;
9316
9317         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9318         if (!msg)
9319                 return;
9320
9321         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
9322         if (!hdr) {
9323                 nlmsg_free(msg);
9324                 return;
9325         }
9326
9327         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9328             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9329             (from_ap && reason &&
9330              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
9331             (from_ap &&
9332              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
9333             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
9334                 goto nla_put_failure;
9335
9336         genlmsg_end(msg, hdr);
9337
9338         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9339                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
9340         return;
9341
9342  nla_put_failure:
9343         genlmsg_cancel(msg, hdr);
9344         nlmsg_free(msg);
9345
9346 }
9347
9348 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
9349                              struct net_device *netdev, const u8 *bssid,
9350                              gfp_t gfp)
9351 {
9352         struct sk_buff *msg;
9353         void *hdr;
9354
9355         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9356         if (!msg)
9357                 return;
9358
9359         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
9360         if (!hdr) {
9361                 nlmsg_free(msg);
9362                 return;
9363         }
9364
9365         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9366             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9367             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
9368                 goto nla_put_failure;
9369
9370         genlmsg_end(msg, hdr);
9371
9372         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9373                                 nl80211_mlme_mcgrp.id, gfp);
9374         return;
9375
9376  nla_put_failure:
9377         genlmsg_cancel(msg, hdr);
9378         nlmsg_free(msg);
9379 }
9380
9381 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
9382                                         const u8* ie, u8 ie_len, gfp_t gfp)
9383 {
9384         struct wireless_dev *wdev = dev->ieee80211_ptr;
9385         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9386         struct sk_buff *msg;
9387         void *hdr;
9388
9389         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
9390                 return;
9391
9392         trace_cfg80211_notify_new_peer_candidate(dev, addr);
9393
9394         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9395         if (!msg)
9396                 return;
9397
9398         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
9399         if (!hdr) {
9400                 nlmsg_free(msg);
9401                 return;
9402         }
9403
9404         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9405             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9406             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
9407             (ie_len && ie &&
9408              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
9409                 goto nla_put_failure;
9410
9411         genlmsg_end(msg, hdr);
9412
9413         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9414                                 nl80211_mlme_mcgrp.id, gfp);
9415         return;
9416
9417  nla_put_failure:
9418         genlmsg_cancel(msg, hdr);
9419         nlmsg_free(msg);
9420 }
9421 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
9422
9423 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
9424                                  struct net_device *netdev, const u8 *addr,
9425                                  enum nl80211_key_type key_type, int key_id,
9426                                  const u8 *tsc, gfp_t gfp)
9427 {
9428         struct sk_buff *msg;
9429         void *hdr;
9430
9431         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9432         if (!msg)
9433                 return;
9434
9435         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
9436         if (!hdr) {
9437                 nlmsg_free(msg);
9438                 return;
9439         }
9440
9441         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9442             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9443             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
9444             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
9445             (key_id != -1 &&
9446              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
9447             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
9448                 goto nla_put_failure;
9449
9450         genlmsg_end(msg, hdr);
9451
9452         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9453                                 nl80211_mlme_mcgrp.id, gfp);
9454         return;
9455
9456  nla_put_failure:
9457         genlmsg_cancel(msg, hdr);
9458         nlmsg_free(msg);
9459 }
9460
9461 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
9462                                     struct ieee80211_channel *channel_before,
9463                                     struct ieee80211_channel *channel_after)
9464 {
9465         struct sk_buff *msg;
9466         void *hdr;
9467         struct nlattr *nl_freq;
9468
9469         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
9470         if (!msg)
9471                 return;
9472
9473         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
9474         if (!hdr) {
9475                 nlmsg_free(msg);
9476                 return;
9477         }
9478
9479         /*
9480          * Since we are applying the beacon hint to a wiphy we know its
9481          * wiphy_idx is valid
9482          */
9483         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
9484                 goto nla_put_failure;
9485
9486         /* Before */
9487         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
9488         if (!nl_freq)
9489                 goto nla_put_failure;
9490         if (nl80211_msg_put_channel(msg, channel_before, false))
9491                 goto nla_put_failure;
9492         nla_nest_end(msg, nl_freq);
9493
9494         /* After */
9495         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
9496         if (!nl_freq)
9497                 goto nla_put_failure;
9498         if (nl80211_msg_put_channel(msg, channel_after, false))
9499                 goto nla_put_failure;
9500         nla_nest_end(msg, nl_freq);
9501
9502         genlmsg_end(msg, hdr);
9503
9504         rcu_read_lock();
9505         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
9506                                 GFP_ATOMIC);
9507         rcu_read_unlock();
9508
9509         return;
9510
9511 nla_put_failure:
9512         genlmsg_cancel(msg, hdr);
9513         nlmsg_free(msg);
9514 }
9515
9516 static void nl80211_send_remain_on_chan_event(
9517         int cmd, struct cfg80211_registered_device *rdev,
9518         struct wireless_dev *wdev, u64 cookie,
9519         struct ieee80211_channel *chan,
9520         unsigned int duration, gfp_t gfp)
9521 {
9522         struct sk_buff *msg;
9523         void *hdr;
9524
9525         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9526         if (!msg)
9527                 return;
9528
9529         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9530         if (!hdr) {
9531                 nlmsg_free(msg);
9532                 return;
9533         }
9534
9535         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9536             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9537                                          wdev->netdev->ifindex)) ||
9538             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
9539             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
9540             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
9541                         NL80211_CHAN_NO_HT) ||
9542             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
9543                 goto nla_put_failure;
9544
9545         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
9546             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
9547                 goto nla_put_failure;
9548
9549         genlmsg_end(msg, hdr);
9550
9551         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9552                                 nl80211_mlme_mcgrp.id, gfp);
9553         return;
9554
9555  nla_put_failure:
9556         genlmsg_cancel(msg, hdr);
9557         nlmsg_free(msg);
9558 }
9559
9560 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
9561                                struct ieee80211_channel *chan,
9562                                unsigned int duration, gfp_t gfp)
9563 {
9564         struct wiphy *wiphy = wdev->wiphy;
9565         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9566
9567         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
9568         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
9569                                           rdev, wdev, cookie, chan,
9570                                           duration, gfp);
9571 }
9572 EXPORT_SYMBOL(cfg80211_ready_on_channel);
9573
9574 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
9575                                         struct ieee80211_channel *chan,
9576                                         gfp_t gfp)
9577 {
9578         struct wiphy *wiphy = wdev->wiphy;
9579         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9580
9581         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
9582         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
9583                                           rdev, wdev, cookie, chan, 0, gfp);
9584 }
9585 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
9586
9587 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
9588                       struct station_info *sinfo, gfp_t gfp)
9589 {
9590         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
9591         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9592         struct sk_buff *msg;
9593
9594         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
9595
9596         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9597         if (!msg)
9598                 return;
9599
9600         if (nl80211_send_station(msg, 0, 0, 0,
9601                                  rdev, dev, mac_addr, sinfo) < 0) {
9602                 nlmsg_free(msg);
9603                 return;
9604         }
9605
9606         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9607                                 nl80211_mlme_mcgrp.id, gfp);
9608 }
9609 EXPORT_SYMBOL(cfg80211_new_sta);
9610
9611 void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
9612 {
9613         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
9614         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9615         struct sk_buff *msg;
9616         void *hdr;
9617
9618         trace_cfg80211_del_sta(dev, mac_addr);
9619
9620         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9621         if (!msg)
9622                 return;
9623
9624         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
9625         if (!hdr) {
9626                 nlmsg_free(msg);
9627                 return;
9628         }
9629
9630         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9631             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
9632                 goto nla_put_failure;
9633
9634         genlmsg_end(msg, hdr);
9635
9636         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9637                                 nl80211_mlme_mcgrp.id, gfp);
9638         return;
9639
9640  nla_put_failure:
9641         genlmsg_cancel(msg, hdr);
9642         nlmsg_free(msg);
9643 }
9644 EXPORT_SYMBOL(cfg80211_del_sta);
9645
9646 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
9647                           enum nl80211_connect_failed_reason reason,
9648                           gfp_t gfp)
9649 {
9650         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
9651         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9652         struct sk_buff *msg;
9653         void *hdr;
9654
9655         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
9656         if (!msg)
9657                 return;
9658
9659         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
9660         if (!hdr) {
9661                 nlmsg_free(msg);
9662                 return;
9663         }
9664
9665         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9666             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
9667             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
9668                 goto nla_put_failure;
9669
9670         genlmsg_end(msg, hdr);
9671
9672         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9673                                 nl80211_mlme_mcgrp.id, gfp);
9674         return;
9675
9676  nla_put_failure:
9677         genlmsg_cancel(msg, hdr);
9678         nlmsg_free(msg);
9679 }
9680 EXPORT_SYMBOL(cfg80211_conn_failed);
9681
9682 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
9683                                        const u8 *addr, gfp_t gfp)
9684 {
9685         struct wireless_dev *wdev = dev->ieee80211_ptr;
9686         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9687         struct sk_buff *msg;
9688         void *hdr;
9689         int err;
9690         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
9691
9692         if (!nlportid)
9693                 return false;
9694
9695         msg = nlmsg_new(100, gfp);
9696         if (!msg)
9697                 return true;
9698
9699         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9700         if (!hdr) {
9701                 nlmsg_free(msg);
9702                 return true;
9703         }
9704
9705         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9706             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9707             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
9708                 goto nla_put_failure;
9709
9710         err = genlmsg_end(msg, hdr);
9711         if (err < 0) {
9712                 nlmsg_free(msg);
9713                 return true;
9714         }
9715
9716         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
9717         return true;
9718
9719  nla_put_failure:
9720         genlmsg_cancel(msg, hdr);
9721         nlmsg_free(msg);
9722         return true;
9723 }
9724
9725 bool cfg80211_rx_spurious_frame(struct net_device *dev,
9726                                 const u8 *addr, gfp_t gfp)
9727 {
9728         struct wireless_dev *wdev = dev->ieee80211_ptr;
9729         bool ret;
9730
9731         trace_cfg80211_rx_spurious_frame(dev, addr);
9732
9733         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
9734                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
9735                 trace_cfg80211_return_bool(false);
9736                 return false;
9737         }
9738         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
9739                                          addr, gfp);
9740         trace_cfg80211_return_bool(ret);
9741         return ret;
9742 }
9743 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
9744
9745 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
9746                                         const u8 *addr, gfp_t gfp)
9747 {
9748         struct wireless_dev *wdev = dev->ieee80211_ptr;
9749         bool ret;
9750
9751         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
9752
9753         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
9754                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
9755                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
9756                 trace_cfg80211_return_bool(false);
9757                 return false;
9758         }
9759         ret = __nl80211_unexpected_frame(dev,
9760                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
9761                                          addr, gfp);
9762         trace_cfg80211_return_bool(ret);
9763         return ret;
9764 }
9765 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
9766
9767 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
9768                       struct wireless_dev *wdev, u32 nlportid,
9769                       int freq, int sig_dbm,
9770                       const u8 *buf, size_t len, gfp_t gfp)
9771 {
9772         struct net_device *netdev = wdev->netdev;
9773         struct sk_buff *msg;
9774         void *hdr;
9775
9776         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9777         if (!msg)
9778                 return -ENOMEM;
9779
9780         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
9781         if (!hdr) {
9782                 nlmsg_free(msg);
9783                 return -ENOMEM;
9784         }
9785
9786         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9787             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9788                                         netdev->ifindex)) ||
9789             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
9790             (sig_dbm &&
9791              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
9792             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
9793                 goto nla_put_failure;
9794
9795         genlmsg_end(msg, hdr);
9796
9797         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
9798
9799  nla_put_failure:
9800         genlmsg_cancel(msg, hdr);
9801         nlmsg_free(msg);
9802         return -ENOBUFS;
9803 }
9804
9805 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
9806                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
9807 {
9808         struct wiphy *wiphy = wdev->wiphy;
9809         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9810         struct net_device *netdev = wdev->netdev;
9811         struct sk_buff *msg;
9812         void *hdr;
9813
9814         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
9815
9816         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9817         if (!msg)
9818                 return;
9819
9820         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
9821         if (!hdr) {
9822                 nlmsg_free(msg);
9823                 return;
9824         }
9825
9826         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9827             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9828                                    netdev->ifindex)) ||
9829             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
9830             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
9831             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
9832                 goto nla_put_failure;
9833
9834         genlmsg_end(msg, hdr);
9835
9836         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
9837         return;
9838
9839  nla_put_failure:
9840         genlmsg_cancel(msg, hdr);
9841         nlmsg_free(msg);
9842 }
9843 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
9844
9845 void cfg80211_cqm_rssi_notify(struct net_device *dev,
9846                               enum nl80211_cqm_rssi_threshold_event rssi_event,
9847                               gfp_t gfp)
9848 {
9849         struct wireless_dev *wdev = dev->ieee80211_ptr;
9850         struct wiphy *wiphy = wdev->wiphy;
9851         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9852         struct sk_buff *msg;
9853         struct nlattr *pinfoattr;
9854         void *hdr;
9855
9856         trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
9857
9858         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9859         if (!msg)
9860                 return;
9861
9862         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
9863         if (!hdr) {
9864                 nlmsg_free(msg);
9865                 return;
9866         }
9867
9868         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9869             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
9870                 goto nla_put_failure;
9871
9872         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
9873         if (!pinfoattr)
9874                 goto nla_put_failure;
9875
9876         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
9877                         rssi_event))
9878                 goto nla_put_failure;
9879
9880         nla_nest_end(msg, pinfoattr);
9881
9882         genlmsg_end(msg, hdr);
9883
9884         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9885                                 nl80211_mlme_mcgrp.id, gfp);
9886         return;
9887
9888  nla_put_failure:
9889         genlmsg_cancel(msg, hdr);
9890         nlmsg_free(msg);
9891 }
9892 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
9893
9894 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
9895                                      struct net_device *netdev, const u8 *bssid,
9896                                      const u8 *replay_ctr, gfp_t gfp)
9897 {
9898         struct sk_buff *msg;
9899         struct nlattr *rekey_attr;
9900         void *hdr;
9901
9902         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9903         if (!msg)
9904                 return;
9905
9906         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
9907         if (!hdr) {
9908                 nlmsg_free(msg);
9909                 return;
9910         }
9911
9912         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9913             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9914             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
9915                 goto nla_put_failure;
9916
9917         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
9918         if (!rekey_attr)
9919                 goto nla_put_failure;
9920
9921         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
9922                     NL80211_REPLAY_CTR_LEN, replay_ctr))
9923                 goto nla_put_failure;
9924
9925         nla_nest_end(msg, rekey_attr);
9926
9927         genlmsg_end(msg, hdr);
9928
9929         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9930                                 nl80211_mlme_mcgrp.id, gfp);
9931         return;
9932
9933  nla_put_failure:
9934         genlmsg_cancel(msg, hdr);
9935         nlmsg_free(msg);
9936 }
9937
9938 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
9939                                const u8 *replay_ctr, gfp_t gfp)
9940 {
9941         struct wireless_dev *wdev = dev->ieee80211_ptr;
9942         struct wiphy *wiphy = wdev->wiphy;
9943         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9944
9945         trace_cfg80211_gtk_rekey_notify(dev, bssid);
9946         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
9947 }
9948 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
9949
9950 static void
9951 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
9952                                struct net_device *netdev, int index,
9953                                const u8 *bssid, bool preauth, gfp_t gfp)
9954 {
9955         struct sk_buff *msg;
9956         struct nlattr *attr;
9957         void *hdr;
9958
9959         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9960         if (!msg)
9961                 return;
9962
9963         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
9964         if (!hdr) {
9965                 nlmsg_free(msg);
9966                 return;
9967         }
9968
9969         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9970             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
9971                 goto nla_put_failure;
9972
9973         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
9974         if (!attr)
9975                 goto nla_put_failure;
9976
9977         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
9978             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
9979             (preauth &&
9980              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
9981                 goto nla_put_failure;
9982
9983         nla_nest_end(msg, attr);
9984
9985         genlmsg_end(msg, hdr);
9986
9987         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9988                                 nl80211_mlme_mcgrp.id, gfp);
9989         return;
9990
9991  nla_put_failure:
9992         genlmsg_cancel(msg, hdr);
9993         nlmsg_free(msg);
9994 }
9995
9996 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
9997                                      const u8 *bssid, bool preauth, gfp_t gfp)
9998 {
9999         struct wireless_dev *wdev = dev->ieee80211_ptr;
10000         struct wiphy *wiphy = wdev->wiphy;
10001         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10002
10003         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
10004         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
10005 }
10006 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
10007
10008 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
10009                                      struct net_device *netdev,
10010                                      struct cfg80211_chan_def *chandef,
10011                                      gfp_t gfp)
10012 {
10013         struct sk_buff *msg;
10014         void *hdr;
10015
10016         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10017         if (!msg)
10018                 return;
10019
10020         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
10021         if (!hdr) {
10022                 nlmsg_free(msg);
10023                 return;
10024         }
10025
10026         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
10027                 goto nla_put_failure;
10028
10029         if (nl80211_send_chandef(msg, chandef))
10030                 goto nla_put_failure;
10031
10032         genlmsg_end(msg, hdr);
10033
10034         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10035                                 nl80211_mlme_mcgrp.id, gfp);
10036         return;
10037
10038  nla_put_failure:
10039         genlmsg_cancel(msg, hdr);
10040         nlmsg_free(msg);
10041 }
10042
10043 void cfg80211_ch_switch_notify(struct net_device *dev,
10044                                struct cfg80211_chan_def *chandef)
10045 {
10046         struct wireless_dev *wdev = dev->ieee80211_ptr;
10047         struct wiphy *wiphy = wdev->wiphy;
10048         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10049
10050         trace_cfg80211_ch_switch_notify(dev, chandef);
10051
10052         wdev_lock(wdev);
10053
10054         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
10055                     wdev->iftype != NL80211_IFTYPE_P2P_GO))
10056                 goto out;
10057
10058         wdev->channel = chandef->chan;
10059         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL);
10060 out:
10061         wdev_unlock(wdev);
10062         return;
10063 }
10064 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
10065
10066 void cfg80211_cqm_txe_notify(struct net_device *dev,
10067                              const u8 *peer, u32 num_packets,
10068                              u32 rate, u32 intvl, gfp_t gfp)
10069 {
10070         struct wireless_dev *wdev = dev->ieee80211_ptr;
10071         struct wiphy *wiphy = wdev->wiphy;
10072         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10073         struct sk_buff *msg;
10074         struct nlattr *pinfoattr;
10075         void *hdr;
10076
10077         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
10078         if (!msg)
10079                 return;
10080
10081         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10082         if (!hdr) {
10083                 nlmsg_free(msg);
10084                 return;
10085         }
10086
10087         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10088             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10089             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
10090                 goto nla_put_failure;
10091
10092         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10093         if (!pinfoattr)
10094                 goto nla_put_failure;
10095
10096         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
10097                 goto nla_put_failure;
10098
10099         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
10100                 goto nla_put_failure;
10101
10102         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
10103                 goto nla_put_failure;
10104
10105         nla_nest_end(msg, pinfoattr);
10106
10107         genlmsg_end(msg, hdr);
10108
10109         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10110                                 nl80211_mlme_mcgrp.id, gfp);
10111         return;
10112
10113  nla_put_failure:
10114         genlmsg_cancel(msg, hdr);
10115         nlmsg_free(msg);
10116 }
10117 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
10118
10119 void
10120 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
10121                      struct cfg80211_chan_def *chandef,
10122                      enum nl80211_radar_event event,
10123                      struct net_device *netdev, gfp_t gfp)
10124 {
10125         struct sk_buff *msg;
10126         void *hdr;
10127
10128         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10129         if (!msg)
10130                 return;
10131
10132         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
10133         if (!hdr) {
10134                 nlmsg_free(msg);
10135                 return;
10136         }
10137
10138         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
10139                 goto nla_put_failure;
10140
10141         /* NOP and radar events don't need a netdev parameter */
10142         if (netdev) {
10143                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
10144
10145                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10146                     nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10147                         goto nla_put_failure;
10148         }
10149
10150         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
10151                 goto nla_put_failure;
10152
10153         if (nl80211_send_chandef(msg, chandef))
10154                 goto nla_put_failure;
10155
10156         if (genlmsg_end(msg, hdr) < 0) {
10157                 nlmsg_free(msg);
10158                 return;
10159         }
10160
10161         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10162                                 nl80211_mlme_mcgrp.id, gfp);
10163         return;
10164
10165  nla_put_failure:
10166         genlmsg_cancel(msg, hdr);
10167         nlmsg_free(msg);
10168 }
10169
10170 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
10171                                  const u8 *peer, u32 num_packets, gfp_t gfp)
10172 {
10173         struct wireless_dev *wdev = dev->ieee80211_ptr;
10174         struct wiphy *wiphy = wdev->wiphy;
10175         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10176         struct sk_buff *msg;
10177         struct nlattr *pinfoattr;
10178         void *hdr;
10179
10180         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
10181
10182         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10183         if (!msg)
10184                 return;
10185
10186         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10187         if (!hdr) {
10188                 nlmsg_free(msg);
10189                 return;
10190         }
10191
10192         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10193             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10194             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
10195                 goto nla_put_failure;
10196
10197         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10198         if (!pinfoattr)
10199                 goto nla_put_failure;
10200
10201         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
10202                 goto nla_put_failure;
10203
10204         nla_nest_end(msg, pinfoattr);
10205
10206         genlmsg_end(msg, hdr);
10207
10208         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10209                                 nl80211_mlme_mcgrp.id, gfp);
10210         return;
10211
10212  nla_put_failure:
10213         genlmsg_cancel(msg, hdr);
10214         nlmsg_free(msg);
10215 }
10216 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
10217
10218 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
10219                            u64 cookie, bool acked, gfp_t gfp)
10220 {
10221         struct wireless_dev *wdev = dev->ieee80211_ptr;
10222         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10223         struct sk_buff *msg;
10224         void *hdr;
10225         int err;
10226
10227         trace_cfg80211_probe_status(dev, addr, cookie, acked);
10228
10229         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10230
10231         if (!msg)
10232                 return;
10233
10234         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
10235         if (!hdr) {
10236                 nlmsg_free(msg);
10237                 return;
10238         }
10239
10240         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10241             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10242             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
10243             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
10244             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
10245                 goto nla_put_failure;
10246
10247         err = genlmsg_end(msg, hdr);
10248         if (err < 0) {
10249                 nlmsg_free(msg);
10250                 return;
10251         }
10252
10253         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10254                                 nl80211_mlme_mcgrp.id, gfp);
10255         return;
10256
10257  nla_put_failure:
10258         genlmsg_cancel(msg, hdr);
10259         nlmsg_free(msg);
10260 }
10261 EXPORT_SYMBOL(cfg80211_probe_status);
10262
10263 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
10264                                  const u8 *frame, size_t len,
10265                                  int freq, int sig_dbm)
10266 {
10267         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10268         struct sk_buff *msg;
10269         void *hdr;
10270         struct cfg80211_beacon_registration *reg;
10271
10272         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
10273
10274         spin_lock_bh(&rdev->beacon_registrations_lock);
10275         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
10276                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
10277                 if (!msg) {
10278                         spin_unlock_bh(&rdev->beacon_registrations_lock);
10279                         return;
10280                 }
10281
10282                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
10283                 if (!hdr)
10284                         goto nla_put_failure;
10285
10286                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10287                     (freq &&
10288                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
10289                     (sig_dbm &&
10290                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
10291                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
10292                         goto nla_put_failure;
10293
10294                 genlmsg_end(msg, hdr);
10295
10296                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
10297         }
10298         spin_unlock_bh(&rdev->beacon_registrations_lock);
10299         return;
10300
10301  nla_put_failure:
10302         spin_unlock_bh(&rdev->beacon_registrations_lock);
10303         if (hdr)
10304                 genlmsg_cancel(msg, hdr);
10305         nlmsg_free(msg);
10306 }
10307 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
10308
10309 #ifdef CONFIG_PM
10310 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
10311                                    struct cfg80211_wowlan_wakeup *wakeup,
10312                                    gfp_t gfp)
10313 {
10314         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10315         struct sk_buff *msg;
10316         void *hdr;
10317         int err, size = 200;
10318
10319         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
10320
10321         if (wakeup)
10322                 size += wakeup->packet_present_len;
10323
10324         msg = nlmsg_new(size, gfp);
10325         if (!msg)
10326                 return;
10327
10328         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
10329         if (!hdr)
10330                 goto free_msg;
10331
10332         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10333             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10334                 goto free_msg;
10335
10336         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10337                                         wdev->netdev->ifindex))
10338                 goto free_msg;
10339
10340         if (wakeup) {
10341                 struct nlattr *reasons;
10342
10343                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
10344
10345                 if (wakeup->disconnect &&
10346                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
10347                         goto free_msg;
10348                 if (wakeup->magic_pkt &&
10349                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
10350                         goto free_msg;
10351                 if (wakeup->gtk_rekey_failure &&
10352                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
10353                         goto free_msg;
10354                 if (wakeup->eap_identity_req &&
10355                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
10356                         goto free_msg;
10357                 if (wakeup->four_way_handshake &&
10358                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
10359                         goto free_msg;
10360                 if (wakeup->rfkill_release &&
10361                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
10362                         goto free_msg;
10363
10364                 if (wakeup->pattern_idx >= 0 &&
10365                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
10366                                 wakeup->pattern_idx))
10367                         goto free_msg;
10368
10369                 if (wakeup->tcp_match)
10370                         nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH);
10371
10372                 if (wakeup->tcp_connlost)
10373                         nla_put_flag(msg,
10374                                      NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST);
10375
10376                 if (wakeup->tcp_nomoretokens)
10377                         nla_put_flag(msg,
10378                                 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS);
10379
10380                 if (wakeup->packet) {
10381                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
10382                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
10383
10384                         if (!wakeup->packet_80211) {
10385                                 pkt_attr =
10386                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
10387                                 len_attr =
10388                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
10389                         }
10390
10391                         if (wakeup->packet_len &&
10392                             nla_put_u32(msg, len_attr, wakeup->packet_len))
10393                                 goto free_msg;
10394
10395                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
10396                                     wakeup->packet))
10397                                 goto free_msg;
10398                 }
10399
10400                 nla_nest_end(msg, reasons);
10401         }
10402
10403         err = genlmsg_end(msg, hdr);
10404         if (err < 0)
10405                 goto free_msg;
10406
10407         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10408                                 nl80211_mlme_mcgrp.id, gfp);
10409         return;
10410
10411  free_msg:
10412         nlmsg_free(msg);
10413 }
10414 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
10415 #endif
10416
10417 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
10418                                 enum nl80211_tdls_operation oper,
10419                                 u16 reason_code, gfp_t gfp)
10420 {
10421         struct wireless_dev *wdev = dev->ieee80211_ptr;
10422         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10423         struct sk_buff *msg;
10424         void *hdr;
10425         int err;
10426
10427         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
10428                                          reason_code);
10429
10430         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10431         if (!msg)
10432                 return;
10433
10434         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
10435         if (!hdr) {
10436                 nlmsg_free(msg);
10437                 return;
10438         }
10439
10440         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10441             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10442             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
10443             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
10444             (reason_code > 0 &&
10445              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
10446                 goto nla_put_failure;
10447
10448         err = genlmsg_end(msg, hdr);
10449         if (err < 0) {
10450                 nlmsg_free(msg);
10451                 return;
10452         }
10453
10454         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10455                                 nl80211_mlme_mcgrp.id, gfp);
10456         return;
10457
10458  nla_put_failure:
10459         genlmsg_cancel(msg, hdr);
10460         nlmsg_free(msg);
10461 }
10462 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
10463
10464 static int nl80211_netlink_notify(struct notifier_block * nb,
10465                                   unsigned long state,
10466                                   void *_notify)
10467 {
10468         struct netlink_notify *notify = _notify;
10469         struct cfg80211_registered_device *rdev;
10470         struct wireless_dev *wdev;
10471         struct cfg80211_beacon_registration *reg, *tmp;
10472
10473         if (state != NETLINK_URELEASE)
10474                 return NOTIFY_DONE;
10475
10476         rcu_read_lock();
10477
10478         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
10479                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list)
10480                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
10481
10482                 spin_lock_bh(&rdev->beacon_registrations_lock);
10483                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
10484                                          list) {
10485                         if (reg->nlportid == notify->portid) {
10486                                 list_del(&reg->list);
10487                                 kfree(reg);
10488                                 break;
10489                         }
10490                 }
10491                 spin_unlock_bh(&rdev->beacon_registrations_lock);
10492         }
10493
10494         rcu_read_unlock();
10495
10496         return NOTIFY_DONE;
10497 }
10498
10499 static struct notifier_block nl80211_netlink_notifier = {
10500         .notifier_call = nl80211_netlink_notify,
10501 };
10502
10503 /* initialisation/exit functions */
10504
10505 int nl80211_init(void)
10506 {
10507         int err;
10508
10509         err = genl_register_family_with_ops(&nl80211_fam,
10510                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
10511         if (err)
10512                 return err;
10513
10514         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
10515         if (err)
10516                 goto err_out;
10517
10518         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
10519         if (err)
10520                 goto err_out;
10521
10522         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
10523         if (err)
10524                 goto err_out;
10525
10526         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
10527         if (err)
10528                 goto err_out;
10529
10530 #ifdef CONFIG_NL80211_TESTMODE
10531         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
10532         if (err)
10533                 goto err_out;
10534 #endif
10535
10536         err = netlink_register_notifier(&nl80211_netlink_notifier);
10537         if (err)
10538                 goto err_out;
10539
10540         return 0;
10541  err_out:
10542         genl_unregister_family(&nl80211_fam);
10543         return err;
10544 }
10545
10546 void nl80211_exit(void)
10547 {
10548         netlink_unregister_notifier(&nl80211_netlink_notifier);
10549         genl_unregister_family(&nl80211_fam);
10550 }