net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include <net/inet_connection_sock.h>
  23 #include "core.h"
  24 #include "nl80211.h"
  25 #include "reg.h"
  26 #include "rdev-ops.h"
  27
  28 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  29                                    struct genl_info *info,
  30                                    struct cfg80211_crypto_settings *settings,
  31                                    int cipher_limit);
  32
  33 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
  34                             struct genl_info *info);
  35 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
  36                               struct genl_info *info);
  37
  38 /* the netlink family */
  39 static struct genl_family nl80211_fam = {
  40         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  41         .name = "nl80211",      /* have users key off the name instead */
  42         .hdrsize = 0,           /* no private header */
  43         .version = 1,           /* no particular meaning now */
  44         .maxattr = NL80211_ATTR_MAX,
  45         .netnsok = true,
  46         .pre_doit = nl80211_pre_doit,
  47         .post_doit = nl80211_post_doit,
  48 };
  49
  50 /* returns ERR_PTR values */
  51 static struct wireless_dev *
  52 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  53 {
  54         struct cfg80211_registered_device *rdev;
  55         struct wireless_dev *result = NULL;
  56         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  57         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  58         u64 wdev_id;
  59         int wiphy_idx = -1;
  60         int ifidx = -1;
  61
  62         assert_cfg80211_lock();
  63
  64         if (!have_ifidx && !have_wdev_id)
  65                 return ERR_PTR(-EINVAL);
  66
  67         if (have_ifidx)
  68                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  69         if (have_wdev_id) {
  70                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  71                 wiphy_idx = wdev_id >> 32;
  72         }
  73
  74         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  75                 struct wireless_dev *wdev;
  76
  77                 if (wiphy_net(&rdev->wiphy) != netns)
  78                         continue;
  79
  80                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  81                         continue;
  82
  83                 mutex_lock(&rdev->devlist_mtx);
  84                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
  85                         if (have_ifidx && wdev->netdev &&
  86                             wdev->netdev->ifindex == ifidx) {
  87                                 result = wdev;
  88                                 break;
  89                         }
  90                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
  91                                 result = wdev;
  92                                 break;
  93                         }
  94                 }
  95                 mutex_unlock(&rdev->devlist_mtx);
  96
  97                 if (result)
  98                         break;
  99         }
 100
 101         if (result)
 102                 return result;
 103         return ERR_PTR(-ENODEV);
 104 }
 105
 106 static struct cfg80211_registered_device *
 107 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 108 {
 109         struct cfg80211_registered_device *rdev = NULL, *tmp;
 110         struct net_device *netdev;
 111
 112         assert_cfg80211_lock();
 113
 114         if (!attrs[NL80211_ATTR_WIPHY] &&
 115             !attrs[NL80211_ATTR_IFINDEX] &&
 116             !attrs[NL80211_ATTR_WDEV])
 117                 return ERR_PTR(-EINVAL);
 118
 119         if (attrs[NL80211_ATTR_WIPHY])
 120                 rdev = cfg80211_rdev_by_wiphy_idx(
 121                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 122
 123         if (attrs[NL80211_ATTR_WDEV]) {
 124                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 125                 struct wireless_dev *wdev;
 126                 bool found = false;
 127
 128                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 129                 if (tmp) {
 130                         /* make sure wdev exists */
 131                         mutex_lock(&tmp->devlist_mtx);
 132                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 133                                 if (wdev->identifier != (u32)wdev_id)
 134                                         continue;
 135                                 found = true;
 136                                 break;
 137                         }
 138                         mutex_unlock(&tmp->devlist_mtx);
 139
 140                         if (!found)
 141                                 tmp = NULL;
 142
 143                         if (rdev && tmp != rdev)
 144                                 return ERR_PTR(-EINVAL);
 145                         rdev = tmp;
 146                 }
 147         }
 148
 149         if (attrs[NL80211_ATTR_IFINDEX]) {
 150                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 151                 netdev = dev_get_by_index(netns, ifindex);
 152                 if (netdev) {
 153                         if (netdev->ieee80211_ptr)
 154                                 tmp = wiphy_to_dev(
 155                                                 netdev->ieee80211_ptr->wiphy);
 156                         else
 157                                 tmp = NULL;
 158
 159                         dev_put(netdev);
 160
 161                         /* not wireless device -- return error */
 162                         if (!tmp)
 163                                 return ERR_PTR(-EINVAL);
 164
 165                         /* mismatch -- return error */
 166                         if (rdev && tmp != rdev)
 167                                 return ERR_PTR(-EINVAL);
 168
 169                         rdev = tmp;
 170                 }
 171         }
 172
 173         if (!rdev)
 174                 return ERR_PTR(-ENODEV);
 175
 176         if (netns != wiphy_net(&rdev->wiphy))
 177                 return ERR_PTR(-ENODEV);
 178
 179         return rdev;
 180 }
 181
 182 /*
 183  * This function returns a pointer to the driver
 184  * that the genl_info item that is passed refers to.
 185  * If successful, it returns non-NULL and also locks
 186  * the driver's mutex!
 187  *
 188  * This means that you need to call cfg80211_unlock_rdev()
 189  * before being allowed to acquire &cfg80211_mutex!
 190  *
 191  * This is necessary because we need to lock the global
 192  * mutex to get an item off the list safely, and then
 193  * we lock the rdev mutex so it doesn't go away under us.
 194  *
 195  * We don't want to keep cfg80211_mutex locked
 196  * for all the time in order to allow requests on
 197  * other interfaces to go through at the same time.
 198  *
 199  * The result of this can be a PTR_ERR and hence must
 200  * be checked with IS_ERR() for errors.
 201  */
 202 static struct cfg80211_registered_device *
 203 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 204 {
 205         struct cfg80211_registered_device *rdev;
 206
 207         mutex_lock(&cfg80211_mutex);
 208         rdev = __cfg80211_rdev_from_attrs(netns, info->attrs);
 209
 210         /* if it is not an error we grab the lock on
 211          * it to assure it won't be going away while
 212          * we operate on it */
 213         if (!IS_ERR(rdev))
 214                 mutex_lock(&rdev->mtx);
 215
 216         mutex_unlock(&cfg80211_mutex);
 217
 218         return rdev;
 219 }
 220
 221 /* policy for the attributes */
 222 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
 223         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 224         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 225                                       .len = 20-1 },
 226         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 227
 228         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 229         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 230         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 231         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 232         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 233
 234         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 235         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 236         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 237         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 238         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 239
 240         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 241         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 242         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 243
 244         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 245         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 246
 247         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 248         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 249                                     .len = WLAN_MAX_KEY_LEN },
 250         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 251         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 252         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 253         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 254         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 255
 256         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 257         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 258         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 259                                        .len = IEEE80211_MAX_DATA_LEN },
 260         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 261                                        .len = IEEE80211_MAX_DATA_LEN },
 262         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 263         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 264         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 265         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 266                                                .len = NL80211_MAX_SUPP_RATES },
 267         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 268         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 269         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 270         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 271                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 272         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 273
 274         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 275         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 276
 277         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 278         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 279         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 280         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 281                                            .len = NL80211_MAX_SUPP_RATES },
 282         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 283
 284         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 285         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 286
 287         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 288
 289         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 290         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 291                               .len = IEEE80211_MAX_DATA_LEN },
 292         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 293         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 294
 295         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 296                                 .len = IEEE80211_MAX_SSID_LEN },
 297         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 298         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 299         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 300         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 301         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 302         [NL80211_ATTR_STA_FLAGS2] = {
 303                 .len = sizeof(struct nl80211_sta_flag_update),
 304         },
 305         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 306         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 307         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 308         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 309         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 310         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 311         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 312         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 313         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 314                                  .len = WLAN_PMKID_LEN },
 315         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 316         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 317         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 318         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 319                                  .len = IEEE80211_MAX_DATA_LEN },
 320         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 321         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 322         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 323         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 324         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 325         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 326         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 327         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 328         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 329         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 330         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 331         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 332         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 333         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 334         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 335         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 336         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 337         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 338         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 339         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 340                                          .len = IEEE80211_MAX_DATA_LEN },
 341         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 342                                          .len = IEEE80211_MAX_DATA_LEN },
 343         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 344         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 345         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 346         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 347         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 348         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 349         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 350         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 351         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 352         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 353                                       .len = IEEE80211_MAX_DATA_LEN },
 354         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 355         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 356         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 357                 .len = NL80211_HT_CAPABILITY_LEN
 358         },
 359         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 360         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 361         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 362         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 363         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 364         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 365         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 366         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 367         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 368         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 369         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 370         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 371         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 372         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 373 };
 374
 375 /* policy for the key attributes */
 376 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 377         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 378         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 379         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 380         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 381         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 382         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 383         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 384         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 385 };
 386
 387 /* policy for the key default flags */
 388 static const struct nla_policy
 389 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 390         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 391         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 392 };
 393
 394 /* policy for WoWLAN attributes */
 395 static const struct nla_policy
 396 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 397         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 398         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 399         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 400         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 401         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 402         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 403         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 404         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 405         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 406 };
 407
 408 static const struct nla_policy
 409 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 410         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 411         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 412         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 413         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 414         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 415         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 416         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 417                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 418         },
 419         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 420                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 421         },
 422         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 423         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 424         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 425 };
 426
 427 /* policy for GTK rekey offload attributes */
 428 static const struct nla_policy
 429 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 430         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 431         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 432         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 433 };
 434
 435 static const struct nla_policy
 436 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 437         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 438                                                  .len = IEEE80211_MAX_SSID_LEN },
 439         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 440 };
 441
 442 /* ifidx get helper */
 443 static int nl80211_get_ifidx(struct netlink_callback *cb)
 444 {
 445         int res;
 446
 447         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 448                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 449                           nl80211_policy);
 450         if (res)
 451                 return res;
 452
 453         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 454                 return -EINVAL;
 455
 456         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 457         if (!res)
 458                 return -EINVAL;
 459         return res;
 460 }
 461
 462 static int nl80211_prepare_netdev_dump(struct sk_buff *skb,
 463                                        struct netlink_callback *cb,
 464                                        struct cfg80211_registered_device **rdev,
 465                                        struct net_device **dev)
 466 {
 467         int ifidx = cb->args[0];
 468         int err;
 469
 470         if (!ifidx)
 471                 ifidx = nl80211_get_ifidx(cb);
 472         if (ifidx < 0)
 473                 return ifidx;
 474
 475         cb->args[0] = ifidx;
 476
 477         rtnl_lock();
 478
 479         *dev = __dev_get_by_index(sock_net(skb->sk), ifidx);
 480         if (!*dev) {
 481                 err = -ENODEV;
 482                 goto out_rtnl;
 483         }
 484
 485         *rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
 486         if (IS_ERR(*rdev)) {
 487                 err = PTR_ERR(*rdev);
 488                 goto out_rtnl;
 489         }
 490
 491         return 0;
 492  out_rtnl:
 493         rtnl_unlock();
 494         return err;
 495 }
 496
 497 static void nl80211_finish_netdev_dump(struct cfg80211_registered_device *rdev)
 498 {
 499         cfg80211_unlock_rdev(rdev);
 500         rtnl_unlock();
 501 }
 502
 503 /* IE validation */
 504 static bool is_valid_ie_attr(const struct nlattr *attr)
 505 {
 506         const u8 *pos;
 507         int len;
 508
 509         if (!attr)
 510                 return true;
 511
 512         pos = nla_data(attr);
 513         len = nla_len(attr);
 514
 515         while (len) {
 516                 u8 elemlen;
 517
 518                 if (len < 2)
 519                         return false;
 520                 len -= 2;
 521
 522                 elemlen = pos[1];
 523                 if (elemlen > len)
 524                         return false;
 525
 526                 len -= elemlen;
 527                 pos += 2 + elemlen;
 528         }
 529
 530         return true;
 531 }
 532
 533 /* message building helper */
 534 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 535                                    int flags, u8 cmd)
 536 {
 537         /* since there is no private header just add the generic one */
 538         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 539 }
 540
 541 static int nl80211_msg_put_channel(struct sk_buff *msg,
 542                                    struct ieee80211_channel *chan)
 543 {
 544         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 545                         chan->center_freq))
 546                 goto nla_put_failure;
 547
 548         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 549             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 550                 goto nla_put_failure;
 551         if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
 552             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN))
 553                 goto nla_put_failure;
 554         if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
 555             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IBSS))
 556                 goto nla_put_failure;
 557         if ((chan->flags & IEEE80211_CHAN_RADAR) &&
 558             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 559                 goto nla_put_failure;
 560
 561         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 562                         DBM_TO_MBM(chan->max_power)))
 563                 goto nla_put_failure;
 564
 565         return 0;
 566
 567  nla_put_failure:
 568         return -ENOBUFS;
 569 }
 570
 571 /* netlink command implementations */
 572
 573 struct key_parse {
 574         struct key_params p;
 575         int idx;
 576         int type;
 577         bool def, defmgmt;
 578         bool def_uni, def_multi;
 579 };
 580
 581 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 582 {
 583         struct nlattr *tb[NL80211_KEY_MAX + 1];
 584         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 585                                    nl80211_key_policy);
 586         if (err)
 587                 return err;
 588
 589         k->def = !!tb[NL80211_KEY_DEFAULT];
 590         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 591
 592         if (k->def) {
 593                 k->def_uni = true;
 594                 k->def_multi = true;
 595         }
 596         if (k->defmgmt)
 597                 k->def_multi = true;
 598
 599         if (tb[NL80211_KEY_IDX])
 600                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 601
 602         if (tb[NL80211_KEY_DATA]) {
 603                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 604                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 605         }
 606
 607         if (tb[NL80211_KEY_SEQ]) {
 608                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 609                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 610         }
 611
 612         if (tb[NL80211_KEY_CIPHER])
 613                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 614
 615         if (tb[NL80211_KEY_TYPE]) {
 616                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 617                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 618                         return -EINVAL;
 619         }
 620
 621         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 622                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 623                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 624                                        tb[NL80211_KEY_DEFAULT_TYPES],
 625                                        nl80211_key_default_policy);
 626                 if (err)
 627                         return err;
 628
 629                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 630                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 631         }
 632
 633         return 0;
 634 }
 635
 636 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 637 {
 638         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 639                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 640                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 641         }
 642
 643         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 644                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 645                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 646         }
 647
 648         if (info->attrs[NL80211_ATTR_KEY_IDX])
 649                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 650
 651         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 652                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 653
 654         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 655         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 656
 657         if (k->def) {
 658                 k->def_uni = true;
 659                 k->def_multi = true;
 660         }
 661         if (k->defmgmt)
 662                 k->def_multi = true;
 663
 664         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 665                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 666                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 667                         return -EINVAL;
 668         }
 669
 670         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 671                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 672                 int err = nla_parse_nested(
 673                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 674                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 675                                 nl80211_key_default_policy);
 676                 if (err)
 677                         return err;
 678
 679                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 680                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 681         }
 682
 683         return 0;
 684 }
 685
 686 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 687 {
 688         int err;
 689
 690         memset(k, 0, sizeof(*k));
 691         k->idx = -1;
 692         k->type = -1;
 693
 694         if (info->attrs[NL80211_ATTR_KEY])
 695                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 696         else
 697                 err = nl80211_parse_key_old(info, k);
 698
 699         if (err)
 700                 return err;
 701
 702         if (k->def && k->defmgmt)
 703                 return -EINVAL;
 704
 705         if (k->defmgmt) {
 706                 if (k->def_uni || !k->def_multi)
 707                         return -EINVAL;
 708         }
 709
 710         if (k->idx != -1) {
 711                 if (k->defmgmt) {
 712                         if (k->idx < 4 || k->idx > 5)
 713                                 return -EINVAL;
 714                 } else if (k->def) {
 715                         if (k->idx < 0 || k->idx > 3)
 716                                 return -EINVAL;
 717                 } else {
 718                         if (k->idx < 0 || k->idx > 5)
 719                                 return -EINVAL;
 720                 }
 721         }
 722
 723         return 0;
 724 }
 725
 726 static struct cfg80211_cached_keys *
 727 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 728                        struct nlattr *keys, bool *no_ht)
 729 {
 730         struct key_parse parse;
 731         struct nlattr *key;
 732         struct cfg80211_cached_keys *result;
 733         int rem, err, def = 0;
 734
 735         result = kzalloc(sizeof(*result), GFP_KERNEL);
 736         if (!result)
 737                 return ERR_PTR(-ENOMEM);
 738
 739         result->def = -1;
 740         result->defmgmt = -1;
 741
 742         nla_for_each_nested(key, keys, rem) {
 743                 memset(&parse, 0, sizeof(parse));
 744                 parse.idx = -1;
 745
 746                 err = nl80211_parse_key_new(key, &parse);
 747                 if (err)
 748                         goto error;
 749                 err = -EINVAL;
 750                 if (!parse.p.key)
 751                         goto error;
 752                 if (parse.idx < 0 || parse.idx > 4)
 753                         goto error;
 754                 if (parse.def) {
 755                         if (def)
 756                                 goto error;
 757                         def = 1;
 758                         result->def = parse.idx;
 759                         if (!parse.def_uni || !parse.def_multi)
 760                                 goto error;
 761                 } else if (parse.defmgmt)
 762                         goto error;
 763                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 764                                                      parse.idx, false, NULL);
 765                 if (err)
 766                         goto error;
 767                 result->params[parse.idx].cipher = parse.p.cipher;
 768                 result->params[parse.idx].key_len = parse.p.key_len;
 769                 result->params[parse.idx].key = result->data[parse.idx];
 770                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 771
 772                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 773                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 774                         if (no_ht)
 775                                 *no_ht = true;
 776                 }
 777         }
 778
 779         return result;
 780  error:
 781         kfree(result);
 782         return ERR_PTR(err);
 783 }
 784
 785 static int nl80211_key_allowed(struct wireless_dev *wdev)
 786 {
 787         ASSERT_WDEV_LOCK(wdev);
 788
 789         switch (wdev->iftype) {
 790         case NL80211_IFTYPE_AP:
 791         case NL80211_IFTYPE_AP_VLAN:
 792         case NL80211_IFTYPE_P2P_GO:
 793         case NL80211_IFTYPE_MESH_POINT:
 794                 break;
 795         case NL80211_IFTYPE_ADHOC:
 796                 if (!wdev->current_bss)
 797                         return -ENOLINK;
 798                 break;
 799         case NL80211_IFTYPE_STATION:
 800         case NL80211_IFTYPE_P2P_CLIENT:
 801                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 802                         return -ENOLINK;
 803                 break;
 804         default:
 805                 return -EINVAL;
 806         }
 807
 808         return 0;
 809 }
 810
 811 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 812 {
 813         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 814         int i;
 815
 816         if (!nl_modes)
 817                 goto nla_put_failure;
 818
 819         i = 0;
 820         while (ifmodes) {
 821                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 822                         goto nla_put_failure;
 823                 ifmodes >>= 1;
 824                 i++;
 825         }
 826
 827         nla_nest_end(msg, nl_modes);
 828         return 0;
 829
 830 nla_put_failure:
 831         return -ENOBUFS;
 832 }
 833
 834 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 835                                           struct sk_buff *msg)
 836 {
 837         struct nlattr *nl_combis;
 838         int i, j;
 839
 840         nl_combis = nla_nest_start(msg,
 841                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 842         if (!nl_combis)
 843                 goto nla_put_failure;
 844
 845         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 846                 const struct ieee80211_iface_combination *c;
 847                 struct nlattr *nl_combi, *nl_limits;
 848
 849                 c = &wiphy->iface_combinations[i];
 850
 851                 nl_combi = nla_nest_start(msg, i + 1);
 852                 if (!nl_combi)
 853                         goto nla_put_failure;
 854
 855                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 856                 if (!nl_limits)
 857                         goto nla_put_failure;
 858
 859                 for (j = 0; j < c->n_limits; j++) {
 860                         struct nlattr *nl_limit;
 861
 862                         nl_limit = nla_nest_start(msg, j + 1);
 863                         if (!nl_limit)
 864                                 goto nla_put_failure;
 865                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 866                                         c->limits[j].max))
 867                                 goto nla_put_failure;
 868                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 869                                                 c->limits[j].types))
 870                                 goto nla_put_failure;
 871                         nla_nest_end(msg, nl_limit);
 872                 }
 873
 874                 nla_nest_end(msg, nl_limits);
 875
 876                 if (c->beacon_int_infra_match &&
 877                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 878                         goto nla_put_failure;
 879                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 880                                 c->num_different_channels) ||
 881                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 882                                 c->max_interfaces))
 883                         goto nla_put_failure;
 884
 885                 nla_nest_end(msg, nl_combi);
 886         }
 887
 888         nla_nest_end(msg, nl_combis);
 889
 890         return 0;
 891 nla_put_failure:
 892         return -ENOBUFS;
 893 }
 894
 895 static int nl80211_send_wiphy(struct sk_buff *msg, u32 portid, u32 seq, int flags,
 896                               struct cfg80211_registered_device *dev)
 897 {
 898         void *hdr;
 899         struct nlattr *nl_bands, *nl_band;
 900         struct nlattr *nl_freqs, *nl_freq;
 901         struct nlattr *nl_rates, *nl_rate;
 902         struct nlattr *nl_cmds;
 903         enum ieee80211_band band;
 904         struct ieee80211_channel *chan;
 905         struct ieee80211_rate *rate;
 906         int i;
 907         const struct ieee80211_txrx_stypes *mgmt_stypes =
 908                                 dev->wiphy.mgmt_stypes;
 909
 910         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
 911         if (!hdr)
 912                 return -1;
 913
 914         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
 915             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy)) ||
 916             nla_put_u32(msg, NL80211_ATTR_GENERATION,
 917                         cfg80211_rdev_list_generation) ||
 918             nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 919                        dev->wiphy.retry_short) ||
 920             nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 921                        dev->wiphy.retry_long) ||
 922             nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 923                         dev->wiphy.frag_threshold) ||
 924             nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 925                         dev->wiphy.rts_threshold) ||
 926             nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
 927                        dev->wiphy.coverage_class) ||
 928             nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 929                        dev->wiphy.max_scan_ssids) ||
 930             nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
 931                        dev->wiphy.max_sched_scan_ssids) ||
 932             nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 933                         dev->wiphy.max_scan_ie_len) ||
 934             nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
 935                         dev->wiphy.max_sched_scan_ie_len) ||
 936             nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
 937                        dev->wiphy.max_match_sets))
 938                 goto nla_put_failure;
 939
 940         if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
 941             nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
 942                 goto nla_put_failure;
 943         if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
 944             nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
 945                 goto nla_put_failure;
 946         if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
 947             nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
 948                 goto nla_put_failure;
 949         if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
 950             nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
 951                 goto nla_put_failure;
 952         if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
 953             nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
 954                 goto nla_put_failure;
 955         if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
 956             nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
 957                 goto nla_put_failure;
 958
 959         if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
 960                     sizeof(u32) * dev->wiphy.n_cipher_suites,
 961                     dev->wiphy.cipher_suites))
 962                 goto nla_put_failure;
 963
 964         if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
 965                        dev->wiphy.max_num_pmkids))
 966                 goto nla_put_failure;
 967
 968         if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
 969             nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
 970                 goto nla_put_failure;
 971
 972         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
 973                         dev->wiphy.available_antennas_tx) ||
 974             nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
 975                         dev->wiphy.available_antennas_rx))
 976                 goto nla_put_failure;
 977
 978         if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
 979             nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
 980                         dev->wiphy.probe_resp_offload))
 981                 goto nla_put_failure;
 982
 983         if ((dev->wiphy.available_antennas_tx ||
 984              dev->wiphy.available_antennas_rx) && dev->ops->get_antenna) {
 985                 u32 tx_ant = 0, rx_ant = 0;
 986                 int res;
 987                 res = rdev_get_antenna(dev, &tx_ant, &rx_ant);
 988                 if (!res) {
 989                         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_TX,
 990                                         tx_ant) ||
 991                             nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_RX,
 992                                         rx_ant))
 993                                 goto nla_put_failure;
 994                 }
 995         }
 996
 997         if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
 998                                 dev->wiphy.interface_modes))
 999                 goto nla_put_failure;
1000
1001         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1002         if (!nl_bands)
1003                 goto nla_put_failure;
1004
1005         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
1006                 if (!dev->wiphy.bands[band])
1007                         continue;
1008
1009                 nl_band = nla_nest_start(msg, band);
1010                 if (!nl_band)
1011                         goto nla_put_failure;
1012
1013                 /* add HT info */
1014                 if (dev->wiphy.bands[band]->ht_cap.ht_supported &&
1015                     (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1016                              sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
1017                              &dev->wiphy.bands[band]->ht_cap.mcs) ||
1018                      nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1019                                  dev->wiphy.bands[band]->ht_cap.cap) ||
1020                      nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1021                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor) ||
1022                      nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1023                                 dev->wiphy.bands[band]->ht_cap.ampdu_density)))
1024                         goto nla_put_failure;
1025
1026                 /* add VHT info */
1027                 if (dev->wiphy.bands[band]->vht_cap.vht_supported &&
1028                     (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1029                              sizeof(dev->wiphy.bands[band]->vht_cap.vht_mcs),
1030                              &dev->wiphy.bands[band]->vht_cap.vht_mcs) ||
1031                      nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1032                                  dev->wiphy.bands[band]->vht_cap.cap)))
1033                         goto nla_put_failure;
1034
1035                 /* add frequencies */
1036                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
1037                 if (!nl_freqs)
1038                         goto nla_put_failure;
1039
1040                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
1041                         nl_freq = nla_nest_start(msg, i);
1042                         if (!nl_freq)
1043                                 goto nla_put_failure;
1044
1045                         chan = &dev->wiphy.bands[band]->channels[i];
1046
1047                         if (nl80211_msg_put_channel(msg, chan))
1048                                 goto nla_put_failure;
1049
1050                         nla_nest_end(msg, nl_freq);
1051                 }
1052
1053                 nla_nest_end(msg, nl_freqs);
1054
1055                 /* add bitrates */
1056                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1057                 if (!nl_rates)
1058                         goto nla_put_failure;
1059
1060                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
1061                         nl_rate = nla_nest_start(msg, i);
1062                         if (!nl_rate)
1063                                 goto nla_put_failure;
1064
1065                         rate = &dev->wiphy.bands[band]->bitrates[i];
1066                         if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1067                                         rate->bitrate))
1068                                 goto nla_put_failure;
1069                         if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1070                             nla_put_flag(msg,
1071                                          NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1072                                 goto nla_put_failure;
1073
1074                         nla_nest_end(msg, nl_rate);
1075                 }
1076
1077                 nla_nest_end(msg, nl_rates);
1078
1079                 nla_nest_end(msg, nl_band);
1080         }
1081         nla_nest_end(msg, nl_bands);
1082
1083         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1084         if (!nl_cmds)
1085                 goto nla_put_failure;
1086
1087         i = 0;
1088 #define CMD(op, n)                                              \
1089          do {                                                   \
1090                 if (dev->ops->op) {                             \
1091                         i++;                                    \
1092                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1093                                 goto nla_put_failure;           \
1094                 }                                               \
1095         } while (0)
1096
1097         CMD(add_virtual_intf, NEW_INTERFACE);
1098         CMD(change_virtual_intf, SET_INTERFACE);
1099         CMD(add_key, NEW_KEY);
1100         CMD(start_ap, START_AP);
1101         CMD(add_station, NEW_STATION);
1102         CMD(add_mpath, NEW_MPATH);
1103         CMD(update_mesh_config, SET_MESH_CONFIG);
1104         CMD(change_bss, SET_BSS);
1105         CMD(auth, AUTHENTICATE);
1106         CMD(assoc, ASSOCIATE);
1107         CMD(deauth, DEAUTHENTICATE);
1108         CMD(disassoc, DISASSOCIATE);
1109         CMD(join_ibss, JOIN_IBSS);
1110         CMD(join_mesh, JOIN_MESH);
1111         CMD(set_pmksa, SET_PMKSA);
1112         CMD(del_pmksa, DEL_PMKSA);
1113         CMD(flush_pmksa, FLUSH_PMKSA);
1114         if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1115                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1116         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1117         CMD(mgmt_tx, FRAME);
1118         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1119         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1120                 i++;
1121                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1122                         goto nla_put_failure;
1123         }
1124         if (dev->ops->set_monitor_channel || dev->ops->start_ap ||
1125             dev->ops->join_mesh) {
1126                 i++;
1127                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1128                         goto nla_put_failure;
1129         }
1130         CMD(set_wds_peer, SET_WDS_PEER);
1131         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1132                 CMD(tdls_mgmt, TDLS_MGMT);
1133                 CMD(tdls_oper, TDLS_OPER);
1134         }
1135         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1136                 CMD(sched_scan_start, START_SCHED_SCAN);
1137         CMD(probe_client, PROBE_CLIENT);
1138         CMD(set_noack_map, SET_NOACK_MAP);
1139         if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1140                 i++;
1141                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1142                         goto nla_put_failure;
1143         }
1144         CMD(start_p2p_device, START_P2P_DEVICE);
1145         CMD(set_mcast_rate, SET_MCAST_RATE);
1146
1147 #ifdef CONFIG_NL80211_TESTMODE
1148         CMD(testmode_cmd, TESTMODE);
1149 #endif
1150
1151 #undef CMD
1152
1153         if (dev->ops->connect || dev->ops->auth) {
1154                 i++;
1155                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1156                         goto nla_put_failure;
1157         }
1158
1159         if (dev->ops->disconnect || dev->ops->deauth) {
1160                 i++;
1161                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1162                         goto nla_put_failure;
1163         }
1164
1165         nla_nest_end(msg, nl_cmds);
1166
1167         if (dev->ops->remain_on_channel &&
1168             (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1169             nla_put_u32(msg, NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1170                         dev->wiphy.max_remain_on_channel_duration))
1171                 goto nla_put_failure;
1172
1173         if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1174             nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1175                 goto nla_put_failure;
1176
1177         if (mgmt_stypes) {
1178                 u16 stypes;
1179                 struct nlattr *nl_ftypes, *nl_ifs;
1180                 enum nl80211_iftype ift;
1181
1182                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1183                 if (!nl_ifs)
1184                         goto nla_put_failure;
1185
1186                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1187                         nl_ftypes = nla_nest_start(msg, ift);
1188                         if (!nl_ftypes)
1189                                 goto nla_put_failure;
1190                         i = 0;
1191                         stypes = mgmt_stypes[ift].tx;
1192                         while (stypes) {
1193                                 if ((stypes & 1) &&
1194                                     nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1195                                                 (i << 4) | IEEE80211_FTYPE_MGMT))
1196                                         goto nla_put_failure;
1197                                 stypes >>= 1;
1198                                 i++;
1199                         }
1200                         nla_nest_end(msg, nl_ftypes);
1201                 }
1202
1203                 nla_nest_end(msg, nl_ifs);
1204
1205                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1206                 if (!nl_ifs)
1207                         goto nla_put_failure;
1208
1209                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1210                         nl_ftypes = nla_nest_start(msg, ift);
1211                         if (!nl_ftypes)
1212                                 goto nla_put_failure;
1213                         i = 0;
1214                         stypes = mgmt_stypes[ift].rx;
1215                         while (stypes) {
1216                                 if ((stypes & 1) &&
1217                                     nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1218                                                 (i << 4) | IEEE80211_FTYPE_MGMT))
1219                                         goto nla_put_failure;
1220                                 stypes >>= 1;
1221                                 i++;
1222                         }
1223                         nla_nest_end(msg, nl_ftypes);
1224                 }
1225                 nla_nest_end(msg, nl_ifs);
1226         }
1227
1228 #ifdef CONFIG_PM
1229         if (dev->wiphy.wowlan.flags || dev->wiphy.wowlan.n_patterns) {
1230                 struct nlattr *nl_wowlan;
1231
1232                 nl_wowlan = nla_nest_start(msg,
1233                                 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1234                 if (!nl_wowlan)
1235                         goto nla_put_failure;
1236
1237                 if (((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY) &&
1238                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1239                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT) &&
1240                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1241                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1242                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1243                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1244                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1245                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1246                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1247                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1248                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1249                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1250                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1251                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1252                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1253                     goto nla_put_failure;
1254                 if (dev->wiphy.wowlan.n_patterns) {
1255                         struct nl80211_wowlan_pattern_support pat = {
1256                                 .max_patterns = dev->wiphy.wowlan.n_patterns,
1257                                 .min_pattern_len =
1258                                         dev->wiphy.wowlan.pattern_min_len,
1259                                 .max_pattern_len =
1260                                         dev->wiphy.wowlan.pattern_max_len,
1261                                 .max_pkt_offset =
1262                                         dev->wiphy.wowlan.max_pkt_offset,
1263                         };
1264                         if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1265                                     sizeof(pat), &pat))
1266                                 goto nla_put_failure;
1267                 }
1268
1269                 nla_nest_end(msg, nl_wowlan);
1270         }
1271 #endif
1272
1273         if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1274                                 dev->wiphy.software_iftypes))
1275                 goto nla_put_failure;
1276
1277         if (nl80211_put_iface_combinations(&dev->wiphy, msg))
1278                 goto nla_put_failure;
1279
1280         if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1281             nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1282                         dev->wiphy.ap_sme_capa))
1283                 goto nla_put_failure;
1284
1285         if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS,
1286                         dev->wiphy.features))
1287                 goto nla_put_failure;
1288
1289         if (dev->wiphy.ht_capa_mod_mask &&
1290             nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1291                     sizeof(*dev->wiphy.ht_capa_mod_mask),
1292                     dev->wiphy.ht_capa_mod_mask))
1293                 goto nla_put_failure;
1294
1295         if (dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1296             dev->wiphy.max_acl_mac_addrs &&
1297             nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1298                         dev->wiphy.max_acl_mac_addrs))
1299                 goto nla_put_failure;
1300
1301         return genlmsg_end(msg, hdr);
1302
1303  nla_put_failure:
1304         genlmsg_cancel(msg, hdr);
1305         return -EMSGSIZE;
1306 }
1307
1308 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1309 {
1310         int idx = 0, ret;
1311         int start = cb->args[0];
1312         struct cfg80211_registered_device *dev;
1313
1314         mutex_lock(&cfg80211_mutex);
1315         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1316                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1317                         continue;
1318                 if (++idx <= start)
1319                         continue;
1320                 ret = nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).portid,
1321                                          cb->nlh->nlmsg_seq, NLM_F_MULTI,
1322                                          dev);
1323                 if (ret < 0) {
1324                         /*
1325                          * If sending the wiphy data didn't fit (ENOBUFS or
1326                          * EMSGSIZE returned), this SKB is still empty (so
1327                          * it's not too big because another wiphy dataset is
1328                          * already in the skb) and we've not tried to adjust
1329                          * the dump allocation yet ... then adjust the alloc
1330                          * size to be bigger, and return 1 but with the empty
1331                          * skb. This results in an empty message being RX'ed
1332                          * in userspace, but that is ignored.
1333                          *
1334                          * We can then retry with the larger buffer.
1335                          */
1336                         if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1337                             !skb->len &&
1338                             cb->min_dump_alloc < 4096) {
1339                                 cb->min_dump_alloc = 4096;
1340                                 mutex_unlock(&cfg80211_mutex);
1341                                 return 1;
1342                         }
1343                         idx--;
1344                         break;
1345                 }
1346         }
1347         mutex_unlock(&cfg80211_mutex);
1348
1349         cb->args[0] = idx;
1350
1351         return skb->len;
1352 }
1353
1354 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1355 {
1356         struct sk_buff *msg;
1357         struct cfg80211_registered_device *dev = info->user_ptr[0];
1358
1359         msg = nlmsg_new(4096, GFP_KERNEL);
1360         if (!msg)
1361                 return -ENOMEM;
1362
1363         if (nl80211_send_wiphy(msg, info->snd_portid, info->snd_seq, 0, dev) < 0) {
1364                 nlmsg_free(msg);
1365                 return -ENOBUFS;
1366         }
1367
1368         return genlmsg_reply(msg, info);
1369 }
1370
1371 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1372         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1373         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1374         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1375         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1376         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1377 };
1378
1379 static int parse_txq_params(struct nlattr *tb[],
1380                             struct ieee80211_txq_params *txq_params)
1381 {
1382         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1383             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1384             !tb[NL80211_TXQ_ATTR_AIFS])
1385                 return -EINVAL;
1386
1387         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1388         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1389         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1390         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1391         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1392
1393         if (txq_params->ac >= NL80211_NUM_ACS)
1394                 return -EINVAL;
1395
1396         return 0;
1397 }
1398
1399 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1400 {
1401         /*
1402          * You can only set the channel explicitly for WDS interfaces,
1403          * all others have their channel managed via their respective
1404          * "establish a connection" command (connect, join, ...)
1405          *
1406          * For AP/GO and mesh mode, the channel can be set with the
1407          * channel userspace API, but is only stored and passed to the
1408          * low-level driver when the AP starts or the mesh is joined.
1409          * This is for backward compatibility, userspace can also give
1410          * the channel in the start-ap or join-mesh commands instead.
1411          *
1412          * Monitors are special as they are normally slaved to
1413          * whatever else is going on, so they have their own special
1414          * operation to set the monitor channel if possible.
1415          */
1416         return !wdev ||
1417                 wdev->iftype == NL80211_IFTYPE_AP ||
1418                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1419                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1420                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1421 }
1422
1423 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1424                                  struct genl_info *info,
1425                                  struct cfg80211_chan_def *chandef)
1426 {
1427         u32 control_freq;
1428
1429         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1430                 return -EINVAL;
1431
1432         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1433
1434         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1435         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1436         chandef->center_freq1 = control_freq;
1437         chandef->center_freq2 = 0;
1438
1439         /* Primary channel not allowed */
1440         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1441                 return -EINVAL;
1442
1443         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1444                 enum nl80211_channel_type chantype;
1445
1446                 chantype = nla_get_u32(
1447                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1448
1449                 switch (chantype) {
1450                 case NL80211_CHAN_NO_HT:
1451                 case NL80211_CHAN_HT20:
1452                 case NL80211_CHAN_HT40PLUS:
1453                 case NL80211_CHAN_HT40MINUS:
1454                         cfg80211_chandef_create(chandef, chandef->chan,
1455                                                 chantype);
1456                         break;
1457                 default:
1458                         return -EINVAL;
1459                 }
1460         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1461                 chandef->width =
1462                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1463                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1464                         chandef->center_freq1 =
1465                                 nla_get_u32(
1466                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1467                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1468                         chandef->center_freq2 =
1469                                 nla_get_u32(
1470                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1471         }
1472
1473         if (!cfg80211_chandef_valid(chandef))
1474                 return -EINVAL;
1475
1476         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1477                                      IEEE80211_CHAN_DISABLED))
1478                 return -EINVAL;
1479
1480         return 0;
1481 }
1482
1483 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1484                                  struct wireless_dev *wdev,
1485                                  struct genl_info *info)
1486 {
1487         struct cfg80211_chan_def chandef;
1488         int result;
1489         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1490
1491         if (wdev)
1492                 iftype = wdev->iftype;
1493
1494         if (!nl80211_can_set_dev_channel(wdev))
1495                 return -EOPNOTSUPP;
1496
1497         result = nl80211_parse_chandef(rdev, info, &chandef);
1498         if (result)
1499                 return result;
1500
1501         mutex_lock(&rdev->devlist_mtx);
1502         switch (iftype) {
1503         case NL80211_IFTYPE_AP:
1504         case NL80211_IFTYPE_P2P_GO:
1505                 if (wdev->beacon_interval) {
1506                         result = -EBUSY;
1507                         break;
1508                 }
1509                 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef)) {
1510                         result = -EINVAL;
1511                         break;
1512                 }
1513                 wdev->preset_chandef = chandef;
1514                 result = 0;
1515                 break;
1516         case NL80211_IFTYPE_MESH_POINT:
1517                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
1518                 break;
1519         case NL80211_IFTYPE_MONITOR:
1520                 result = cfg80211_set_monitor_channel(rdev, &chandef);
1521                 break;
1522         default:
1523                 result = -EINVAL;
1524         }
1525         mutex_unlock(&rdev->devlist_mtx);
1526
1527         return result;
1528 }
1529
1530 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1531 {
1532         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1533         struct net_device *netdev = info->user_ptr[1];
1534
1535         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1536 }
1537
1538 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1539 {
1540         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1541         struct net_device *dev = info->user_ptr[1];
1542         struct wireless_dev *wdev = dev->ieee80211_ptr;
1543         const u8 *bssid;
1544
1545         if (!info->attrs[NL80211_ATTR_MAC])
1546                 return -EINVAL;
1547
1548         if (netif_running(dev))
1549                 return -EBUSY;
1550
1551         if (!rdev->ops->set_wds_peer)
1552                 return -EOPNOTSUPP;
1553
1554         if (wdev->iftype != NL80211_IFTYPE_WDS)
1555                 return -EOPNOTSUPP;
1556
1557         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1558         return rdev_set_wds_peer(rdev, dev, bssid);
1559 }
1560
1561
1562 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1563 {
1564         struct cfg80211_registered_device *rdev;
1565         struct net_device *netdev = NULL;
1566         struct wireless_dev *wdev;
1567         int result = 0, rem_txq_params = 0;
1568         struct nlattr *nl_txq_params;
1569         u32 changed;
1570         u8 retry_short = 0, retry_long = 0;
1571         u32 frag_threshold = 0, rts_threshold = 0;
1572         u8 coverage_class = 0;
1573
1574         /*
1575          * Try to find the wiphy and netdev. Normally this
1576          * function shouldn't need the netdev, but this is
1577          * done for backward compatibility -- previously
1578          * setting the channel was done per wiphy, but now
1579          * it is per netdev. Previous userland like hostapd
1580          * also passed a netdev to set_wiphy, so that it is
1581          * possible to let that go to the right netdev!
1582          */
1583         mutex_lock(&cfg80211_mutex);
1584
1585         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1586                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1587
1588                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1589                 if (netdev && netdev->ieee80211_ptr) {
1590                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1591                         mutex_lock(&rdev->mtx);
1592                 } else
1593                         netdev = NULL;
1594         }
1595
1596         if (!netdev) {
1597                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
1598                                                   info->attrs);
1599                 if (IS_ERR(rdev)) {
1600                         mutex_unlock(&cfg80211_mutex);
1601                         return PTR_ERR(rdev);
1602                 }
1603                 wdev = NULL;
1604                 netdev = NULL;
1605                 result = 0;
1606
1607                 mutex_lock(&rdev->mtx);
1608         } else
1609                 wdev = netdev->ieee80211_ptr;
1610
1611         /*
1612          * end workaround code, by now the rdev is available
1613          * and locked, and wdev may or may not be NULL.
1614          */
1615
1616         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1617                 result = cfg80211_dev_rename(
1618                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1619
1620         mutex_unlock(&cfg80211_mutex);
1621
1622         if (result)
1623                 goto bad_res;
1624
1625         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1626                 struct ieee80211_txq_params txq_params;
1627                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1628
1629                 if (!rdev->ops->set_txq_params) {
1630                         result = -EOPNOTSUPP;
1631                         goto bad_res;
1632                 }
1633
1634                 if (!netdev) {
1635                         result = -EINVAL;
1636                         goto bad_res;
1637                 }
1638
1639                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1640                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
1641                         result = -EINVAL;
1642                         goto bad_res;
1643                 }
1644
1645                 if (!netif_running(netdev)) {
1646                         result = -ENETDOWN;
1647                         goto bad_res;
1648                 }
1649
1650                 nla_for_each_nested(nl_txq_params,
1651                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1652                                     rem_txq_params) {
1653                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1654                                   nla_data(nl_txq_params),
1655                                   nla_len(nl_txq_params),
1656                                   txq_params_policy);
1657                         result = parse_txq_params(tb, &txq_params);
1658                         if (result)
1659                                 goto bad_res;
1660
1661                         result = rdev_set_txq_params(rdev, netdev,
1662                                                      &txq_params);
1663                         if (result)
1664                                 goto bad_res;
1665                 }
1666         }
1667
1668         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1669                 result = __nl80211_set_channel(rdev,
1670                                 nl80211_can_set_dev_channel(wdev) ? wdev : NULL,
1671                                 info);
1672                 if (result)
1673                         goto bad_res;
1674         }
1675
1676         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1677                 struct wireless_dev *txp_wdev = wdev;
1678                 enum nl80211_tx_power_setting type;
1679                 int idx, mbm = 0;
1680
1681                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
1682                         txp_wdev = NULL;
1683
1684                 if (!rdev->ops->set_tx_power) {
1685                         result = -EOPNOTSUPP;
1686                         goto bad_res;
1687                 }
1688
1689                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1690                 type = nla_get_u32(info->attrs[idx]);
1691
1692                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1693                     (type != NL80211_TX_POWER_AUTOMATIC)) {
1694                         result = -EINVAL;
1695                         goto bad_res;
1696                 }
1697
1698                 if (type != NL80211_TX_POWER_AUTOMATIC) {
1699                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1700                         mbm = nla_get_u32(info->attrs[idx]);
1701                 }
1702
1703                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
1704                 if (result)
1705                         goto bad_res;
1706         }
1707
1708         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
1709             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
1710                 u32 tx_ant, rx_ant;
1711                 if ((!rdev->wiphy.available_antennas_tx &&
1712                      !rdev->wiphy.available_antennas_rx) ||
1713                     !rdev->ops->set_antenna) {
1714                         result = -EOPNOTSUPP;
1715                         goto bad_res;
1716                 }
1717
1718                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
1719                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
1720
1721                 /* reject antenna configurations which don't match the
1722                  * available antenna masks, except for the "all" mask */
1723                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
1724                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
1725                         result = -EINVAL;
1726                         goto bad_res;
1727                 }
1728
1729                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
1730                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
1731
1732                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
1733                 if (result)
1734                         goto bad_res;
1735         }
1736
1737         changed = 0;
1738
1739         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
1740                 retry_short = nla_get_u8(
1741                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
1742                 if (retry_short == 0) {
1743                         result = -EINVAL;
1744                         goto bad_res;
1745                 }
1746                 changed |= WIPHY_PARAM_RETRY_SHORT;
1747         }
1748
1749         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
1750                 retry_long = nla_get_u8(
1751                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
1752                 if (retry_long == 0) {
1753                         result = -EINVAL;
1754                         goto bad_res;
1755                 }
1756                 changed |= WIPHY_PARAM_RETRY_LONG;
1757         }
1758
1759         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
1760                 frag_threshold = nla_get_u32(
1761                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
1762                 if (frag_threshold < 256) {
1763                         result = -EINVAL;
1764                         goto bad_res;
1765                 }
1766                 if (frag_threshold != (u32) -1) {
1767                         /*
1768                          * Fragments (apart from the last one) are required to
1769                          * have even length. Make the fragmentation code
1770                          * simpler by stripping LSB should someone try to use
1771                          * odd threshold value.
1772                          */
1773                         frag_threshold &= ~0x1;
1774                 }
1775                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
1776         }
1777
1778         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
1779                 rts_threshold = nla_get_u32(
1780                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
1781                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
1782         }
1783
1784         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
1785                 coverage_class = nla_get_u8(
1786                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
1787                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
1788         }
1789
1790         if (changed) {
1791                 u8 old_retry_short, old_retry_long;
1792                 u32 old_frag_threshold, old_rts_threshold;
1793                 u8 old_coverage_class;
1794
1795                 if (!rdev->ops->set_wiphy_params) {
1796                         result = -EOPNOTSUPP;
1797                         goto bad_res;
1798                 }
1799
1800                 old_retry_short = rdev->wiphy.retry_short;
1801                 old_retry_long = rdev->wiphy.retry_long;
1802                 old_frag_threshold = rdev->wiphy.frag_threshold;
1803                 old_rts_threshold = rdev->wiphy.rts_threshold;
1804                 old_coverage_class = rdev->wiphy.coverage_class;
1805
1806                 if (changed & WIPHY_PARAM_RETRY_SHORT)
1807                         rdev->wiphy.retry_short = retry_short;
1808                 if (changed & WIPHY_PARAM_RETRY_LONG)
1809                         rdev->wiphy.retry_long = retry_long;
1810                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
1811                         rdev->wiphy.frag_threshold = frag_threshold;
1812                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
1813                         rdev->wiphy.rts_threshold = rts_threshold;
1814                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
1815                         rdev->wiphy.coverage_class = coverage_class;
1816
1817                 result = rdev_set_wiphy_params(rdev, changed);
1818                 if (result) {
1819                         rdev->wiphy.retry_short = old_retry_short;
1820                         rdev->wiphy.retry_long = old_retry_long;
1821                         rdev->wiphy.frag_threshold = old_frag_threshold;
1822                         rdev->wiphy.rts_threshold = old_rts_threshold;
1823                         rdev->wiphy.coverage_class = old_coverage_class;
1824                 }
1825         }
1826
1827  bad_res:
1828         mutex_unlock(&rdev->mtx);
1829         if (netdev)
1830                 dev_put(netdev);
1831         return result;
1832 }
1833
1834 static inline u64 wdev_id(struct wireless_dev *wdev)
1835 {
1836         return (u64)wdev->identifier |
1837                ((u64)wiphy_to_dev(wdev->wiphy)->wiphy_idx << 32);
1838 }
1839
1840 static int nl80211_send_chandef(struct sk_buff *msg,
1841                                  struct cfg80211_chan_def *chandef)
1842 {
1843         WARN_ON(!cfg80211_chandef_valid(chandef));
1844
1845         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
1846                         chandef->chan->center_freq))
1847                 return -ENOBUFS;
1848         switch (chandef->width) {
1849         case NL80211_CHAN_WIDTH_20_NOHT:
1850         case NL80211_CHAN_WIDTH_20:
1851         case NL80211_CHAN_WIDTH_40:
1852                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
1853                                 cfg80211_get_chandef_type(chandef)))
1854                         return -ENOBUFS;
1855                 break;
1856         default:
1857                 break;
1858         }
1859         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
1860                 return -ENOBUFS;
1861         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
1862                 return -ENOBUFS;
1863         if (chandef->center_freq2 &&
1864             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
1865                 return -ENOBUFS;
1866         return 0;
1867 }
1868
1869 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
1870                               struct cfg80211_registered_device *rdev,
1871                               struct wireless_dev *wdev)
1872 {
1873         struct net_device *dev = wdev->netdev;
1874         void *hdr;
1875
1876         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
1877         if (!hdr)
1878                 return -1;
1879
1880         if (dev &&
1881             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
1882              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
1883                 goto nla_put_failure;
1884
1885         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1886             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
1887             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
1888             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
1889             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1890                         rdev->devlist_generation ^
1891                         (cfg80211_rdev_list_generation << 2)))
1892                 goto nla_put_failure;
1893
1894         if (rdev->ops->get_channel) {
1895                 int ret;
1896                 struct cfg80211_chan_def chandef;
1897
1898                 ret = rdev_get_channel(rdev, wdev, &chandef);
1899                 if (ret == 0) {
1900                         if (nl80211_send_chandef(msg, &chandef))
1901                                 goto nla_put_failure;
1902                 }
1903         }
1904
1905         if (wdev->ssid_len) {
1906                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
1907                         goto nla_put_failure;
1908         }
1909
1910         return genlmsg_end(msg, hdr);
1911
1912  nla_put_failure:
1913         genlmsg_cancel(msg, hdr);
1914         return -EMSGSIZE;
1915 }
1916
1917 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
1918 {
1919         int wp_idx = 0;
1920         int if_idx = 0;
1921         int wp_start = cb->args[0];
1922         int if_start = cb->args[1];
1923         struct cfg80211_registered_device *rdev;
1924         struct wireless_dev *wdev;
1925
1926         mutex_lock(&cfg80211_mutex);
1927         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1928                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1929                         continue;
1930                 if (wp_idx < wp_start) {
1931                         wp_idx++;
1932                         continue;
1933                 }
1934                 if_idx = 0;
1935
1936                 mutex_lock(&rdev->devlist_mtx);
1937                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
1938                         if (if_idx < if_start) {
1939                                 if_idx++;
1940                                 continue;
1941                         }
1942                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
1943                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
1944                                                rdev, wdev) < 0) {
1945                                 mutex_unlock(&rdev->devlist_mtx);
1946                                 goto out;
1947                         }
1948                         if_idx++;
1949                 }
1950                 mutex_unlock(&rdev->devlist_mtx);
1951
1952                 wp_idx++;
1953         }
1954  out:
1955         mutex_unlock(&cfg80211_mutex);
1956
1957         cb->args[0] = wp_idx;
1958         cb->args[1] = if_idx;
1959
1960         return skb->len;
1961 }
1962
1963 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
1964 {
1965         struct sk_buff *msg;
1966         struct cfg80211_registered_device *dev = info->user_ptr[0];
1967         struct wireless_dev *wdev = info->user_ptr[1];
1968
1969         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1970         if (!msg)
1971                 return -ENOMEM;
1972
1973         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
1974                                dev, wdev) < 0) {
1975                 nlmsg_free(msg);
1976                 return -ENOBUFS;
1977         }
1978
1979         return genlmsg_reply(msg, info);
1980 }
1981
1982 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
1983         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
1984         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
1985         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
1986         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
1987         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
1988 };
1989
1990 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
1991 {
1992         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
1993         int flag;
1994
1995         *mntrflags = 0;
1996
1997         if (!nla)
1998                 return -EINVAL;
1999
2000         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2001                              nla, mntr_flags_policy))
2002                 return -EINVAL;
2003
2004         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2005                 if (flags[flag])
2006                         *mntrflags |= (1<<flag);
2007
2008         return 0;
2009 }
2010
2011 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2012                                struct net_device *netdev, u8 use_4addr,
2013                                enum nl80211_iftype iftype)
2014 {
2015         if (!use_4addr) {
2016                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2017                         return -EBUSY;
2018                 return 0;
2019         }
2020
2021         switch (iftype) {
2022         case NL80211_IFTYPE_AP_VLAN:
2023                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2024                         return 0;
2025                 break;
2026         case NL80211_IFTYPE_STATION:
2027                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2028                         return 0;
2029                 break;
2030         default:
2031                 break;
2032         }
2033
2034         return -EOPNOTSUPP;
2035 }
2036
2037 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2038 {
2039         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2040         struct vif_params params;
2041         int err;
2042         enum nl80211_iftype otype, ntype;
2043         struct net_device *dev = info->user_ptr[1];
2044         u32 _flags, *flags = NULL;
2045         bool change = false;
2046
2047         memset(&params, 0, sizeof(params));
2048
2049         otype = ntype = dev->ieee80211_ptr->iftype;
2050
2051         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2052                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2053                 if (otype != ntype)
2054                         change = true;
2055                 if (ntype > NL80211_IFTYPE_MAX)
2056                         return -EINVAL;
2057         }
2058
2059         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2060                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2061
2062                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2063                         return -EINVAL;
2064                 if (netif_running(dev))
2065                         return -EBUSY;
2066
2067                 wdev_lock(wdev);
2068                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2069                              IEEE80211_MAX_MESH_ID_LEN);
2070                 wdev->mesh_id_up_len =
2071                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2072                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2073                        wdev->mesh_id_up_len);
2074                 wdev_unlock(wdev);
2075         }
2076
2077         if (info->attrs[NL80211_ATTR_4ADDR]) {
2078                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2079                 change = true;
2080                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2081                 if (err)
2082                         return err;
2083         } else {
2084                 params.use_4addr = -1;
2085         }
2086
2087         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2088                 if (ntype != NL80211_IFTYPE_MONITOR)
2089                         return -EINVAL;
2090                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2091                                           &_flags);
2092                 if (err)
2093                         return err;
2094
2095                 flags = &_flags;
2096                 change = true;
2097         }
2098
2099         if (change)
2100                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2101         else
2102                 err = 0;
2103
2104         if (!err && params.use_4addr != -1)
2105                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2106
2107         return err;
2108 }
2109
2110 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2111 {
2112         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2113         struct vif_params params;
2114         struct wireless_dev *wdev;
2115         struct sk_buff *msg;
2116         int err;
2117         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2118         u32 flags;
2119
2120         memset(&params, 0, sizeof(params));
2121
2122         if (!info->attrs[NL80211_ATTR_IFNAME])
2123                 return -EINVAL;
2124
2125         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2126                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2127                 if (type > NL80211_IFTYPE_MAX)
2128                         return -EINVAL;
2129         }
2130
2131         if (!rdev->ops->add_virtual_intf ||
2132             !(rdev->wiphy.interface_modes & (1 << type)))
2133                 return -EOPNOTSUPP;
2134
2135         if (type == NL80211_IFTYPE_P2P_DEVICE && info->attrs[NL80211_ATTR_MAC]) {
2136                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2137                            ETH_ALEN);
2138                 if (!is_valid_ether_addr(params.macaddr))
2139                         return -EADDRNOTAVAIL;
2140         }
2141
2142         if (info->attrs[NL80211_ATTR_4ADDR]) {
2143                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2144                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2145                 if (err)
2146                         return err;
2147         }
2148
2149         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2150         if (!msg)
2151                 return -ENOMEM;
2152
2153         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2154                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2155                                   &flags);
2156         wdev = rdev_add_virtual_intf(rdev,
2157                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2158                                 type, err ? NULL : &flags, &params);
2159         if (IS_ERR(wdev)) {
2160                 nlmsg_free(msg);
2161                 return PTR_ERR(wdev);
2162         }
2163
2164         switch (type) {
2165         case NL80211_IFTYPE_MESH_POINT:
2166                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2167                         break;
2168                 wdev_lock(wdev);
2169                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2170                              IEEE80211_MAX_MESH_ID_LEN);
2171                 wdev->mesh_id_up_len =
2172                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2173                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2174                        wdev->mesh_id_up_len);
2175                 wdev_unlock(wdev);
2176                 break;
2177         case NL80211_IFTYPE_P2P_DEVICE:
2178                 /*
2179                  * P2P Device doesn't have a netdev, so doesn't go
2180                  * through the netdev notifier and must be added here
2181                  */
2182                 mutex_init(&wdev->mtx);
2183                 INIT_LIST_HEAD(&wdev->event_list);
2184                 spin_lock_init(&wdev->event_lock);
2185                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2186                 spin_lock_init(&wdev->mgmt_registrations_lock);
2187
2188                 mutex_lock(&rdev->devlist_mtx);
2189                 wdev->identifier = ++rdev->wdev_id;
2190                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2191                 rdev->devlist_generation++;
2192                 mutex_unlock(&rdev->devlist_mtx);
2193                 break;
2194         default:
2195                 break;
2196         }
2197
2198         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2199                                rdev, wdev) < 0) {
2200                 nlmsg_free(msg);
2201                 return -ENOBUFS;
2202         }
2203
2204         return genlmsg_reply(msg, info);
2205 }
2206
2207 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2208 {
2209         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2210         struct wireless_dev *wdev = info->user_ptr[1];
2211
2212         if (!rdev->ops->del_virtual_intf)
2213                 return -EOPNOTSUPP;
2214
2215         /*
2216          * If we remove a wireless device without a netdev then clear
2217          * user_ptr[1] so that nl80211_post_doit won't dereference it
2218          * to check if it needs to do dev_put(). Otherwise it crashes
2219          * since the wdev has been freed, unlike with a netdev where
2220          * we need the dev_put() for the netdev to really be freed.
2221          */
2222         if (!wdev->netdev)
2223                 info->user_ptr[1] = NULL;
2224
2225         return rdev_del_virtual_intf(rdev, wdev);
2226 }
2227
2228 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2229 {
2230         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2231         struct net_device *dev = info->user_ptr[1];
2232         u16 noack_map;
2233
2234         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2235                 return -EINVAL;
2236
2237         if (!rdev->ops->set_noack_map)
2238                 return -EOPNOTSUPP;
2239
2240         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2241
2242         return rdev_set_noack_map(rdev, dev, noack_map);
2243 }
2244
2245 struct get_key_cookie {
2246         struct sk_buff *msg;
2247         int error;
2248         int idx;
2249 };
2250
2251 static void get_key_callback(void *c, struct key_params *params)
2252 {
2253         struct nlattr *key;
2254         struct get_key_cookie *cookie = c;
2255
2256         if ((params->key &&
2257              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2258                      params->key_len, params->key)) ||
2259             (params->seq &&
2260              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2261                      params->seq_len, params->seq)) ||
2262             (params->cipher &&
2263              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2264                          params->cipher)))
2265                 goto nla_put_failure;
2266
2267         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2268         if (!key)
2269                 goto nla_put_failure;
2270
2271         if ((params->key &&
2272              nla_put(cookie->msg, NL80211_KEY_DATA,
2273                      params->key_len, params->key)) ||
2274             (params->seq &&
2275              nla_put(cookie->msg, NL80211_KEY_SEQ,
2276                      params->seq_len, params->seq)) ||
2277             (params->cipher &&
2278              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2279                          params->cipher)))
2280                 goto nla_put_failure;
2281
2282         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2283                 goto nla_put_failure;
2284
2285         nla_nest_end(cookie->msg, key);
2286
2287         return;
2288  nla_put_failure:
2289         cookie->error = 1;
2290 }
2291
2292 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2293 {
2294         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2295         int err;
2296         struct net_device *dev = info->user_ptr[1];
2297         u8 key_idx = 0;
2298         const u8 *mac_addr = NULL;
2299         bool pairwise;
2300         struct get_key_cookie cookie = {
2301                 .error = 0,
2302         };
2303         void *hdr;
2304         struct sk_buff *msg;
2305
2306         if (info->attrs[NL80211_ATTR_KEY_IDX])
2307                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2308
2309         if (key_idx > 5)
2310                 return -EINVAL;
2311
2312         if (info->attrs[NL80211_ATTR_MAC])
2313                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2314
2315         pairwise = !!mac_addr;
2316         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2317                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2318                 if (kt >= NUM_NL80211_KEYTYPES)
2319                         return -EINVAL;
2320                 if (kt != NL80211_KEYTYPE_GROUP &&
2321                     kt != NL80211_KEYTYPE_PAIRWISE)
2322                         return -EINVAL;
2323                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2324         }
2325
2326         if (!rdev->ops->get_key)
2327                 return -EOPNOTSUPP;
2328
2329         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2330         if (!msg)
2331                 return -ENOMEM;
2332
2333         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2334                              NL80211_CMD_NEW_KEY);
2335         if (IS_ERR(hdr))
2336                 return PTR_ERR(hdr);
2337
2338         cookie.msg = msg;
2339         cookie.idx = key_idx;
2340
2341         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2342             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2343                 goto nla_put_failure;
2344         if (mac_addr &&
2345             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2346                 goto nla_put_failure;
2347
2348         if (pairwise && mac_addr &&
2349             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2350                 return -ENOENT;
2351
2352         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2353                            get_key_callback);
2354
2355         if (err)
2356                 goto free_msg;
2357
2358         if (cookie.error)
2359                 goto nla_put_failure;
2360
2361         genlmsg_end(msg, hdr);
2362         return genlmsg_reply(msg, info);
2363
2364  nla_put_failure:
2365         err = -ENOBUFS;
2366  free_msg:
2367         nlmsg_free(msg);
2368         return err;
2369 }
2370
2371 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2372 {
2373         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2374         struct key_parse key;
2375         int err;
2376         struct net_device *dev = info->user_ptr[1];
2377
2378         err = nl80211_parse_key(info, &key);
2379         if (err)
2380                 return err;
2381
2382         if (key.idx < 0)
2383                 return -EINVAL;
2384
2385         /* only support setting default key */
2386         if (!key.def && !key.defmgmt)
2387                 return -EINVAL;
2388
2389         wdev_lock(dev->ieee80211_ptr);
2390
2391         if (key.def) {
2392                 if (!rdev->ops->set_default_key) {
2393                         err = -EOPNOTSUPP;
2394                         goto out;
2395                 }
2396
2397                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2398                 if (err)
2399                         goto out;
2400
2401                 err = rdev_set_default_key(rdev, dev, key.idx,
2402                                                  key.def_uni, key.def_multi);
2403
2404                 if (err)
2405                         goto out;
2406
2407 #ifdef CONFIG_CFG80211_WEXT
2408                 dev->ieee80211_ptr->wext.default_key = key.idx;
2409 #endif
2410         } else {
2411                 if (key.def_uni || !key.def_multi) {
2412                         err = -EINVAL;
2413                         goto out;
2414                 }
2415
2416                 if (!rdev->ops->set_default_mgmt_key) {
2417                         err = -EOPNOTSUPP;
2418                         goto out;
2419                 }
2420
2421                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2422                 if (err)
2423                         goto out;
2424
2425                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2426                 if (err)
2427                         goto out;
2428
2429 #ifdef CONFIG_CFG80211_WEXT
2430                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2431 #endif
2432         }
2433
2434  out:
2435         wdev_unlock(dev->ieee80211_ptr);
2436
2437         return err;
2438 }
2439
2440 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2441 {
2442         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2443         int err;
2444         struct net_device *dev = info->user_ptr[1];
2445         struct key_parse key;
2446         const u8 *mac_addr = NULL;
2447
2448         err = nl80211_parse_key(info, &key);
2449         if (err)
2450                 return err;
2451
2452         if (!key.p.key)
2453                 return -EINVAL;
2454
2455         if (info->attrs[NL80211_ATTR_MAC])
2456                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2457
2458         if (key.type == -1) {
2459                 if (mac_addr)
2460                         key.type = NL80211_KEYTYPE_PAIRWISE;
2461                 else
2462                         key.type = NL80211_KEYTYPE_GROUP;
2463         }
2464
2465         /* for now */
2466         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2467             key.type != NL80211_KEYTYPE_GROUP)
2468                 return -EINVAL;
2469
2470         if (!rdev->ops->add_key)
2471                 return -EOPNOTSUPP;
2472
2473         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2474                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2475                                            mac_addr))
2476                 return -EINVAL;
2477
2478         wdev_lock(dev->ieee80211_ptr);
2479         err = nl80211_key_allowed(dev->ieee80211_ptr);
2480         if (!err)
2481                 err = rdev_add_key(rdev, dev, key.idx,
2482                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2483                                     mac_addr, &key.p);
2484         wdev_unlock(dev->ieee80211_ptr);
2485
2486         return err;
2487 }
2488
2489 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2490 {
2491         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2492         int err;
2493         struct net_device *dev = info->user_ptr[1];
2494         u8 *mac_addr = NULL;
2495         struct key_parse key;
2496
2497         err = nl80211_parse_key(info, &key);
2498         if (err)
2499                 return err;
2500
2501         if (info->attrs[NL80211_ATTR_MAC])
2502                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2503
2504         if (key.type == -1) {
2505                 if (mac_addr)
2506                         key.type = NL80211_KEYTYPE_PAIRWISE;
2507                 else
2508                         key.type = NL80211_KEYTYPE_GROUP;
2509         }
2510
2511         /* for now */
2512         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2513             key.type != NL80211_KEYTYPE_GROUP)
2514                 return -EINVAL;
2515
2516         if (!rdev->ops->del_key)
2517                 return -EOPNOTSUPP;
2518
2519         wdev_lock(dev->ieee80211_ptr);
2520         err = nl80211_key_allowed(dev->ieee80211_ptr);
2521
2522         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2523             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2524                 err = -ENOENT;
2525
2526         if (!err)
2527                 err = rdev_del_key(rdev, dev, key.idx,
2528                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2529                                    mac_addr);
2530
2531 #ifdef CONFIG_CFG80211_WEXT
2532         if (!err) {
2533                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
2534                         dev->ieee80211_ptr->wext.default_key = -1;
2535                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2536                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2537         }
2538 #endif
2539         wdev_unlock(dev->ieee80211_ptr);
2540
2541         return err;
2542 }
2543
2544 /* This function returns an error or the number of nested attributes */
2545 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
2546 {
2547         struct nlattr *attr;
2548         int n_entries = 0, tmp;
2549
2550         nla_for_each_nested(attr, nl_attr, tmp) {
2551                 if (nla_len(attr) != ETH_ALEN)
2552                         return -EINVAL;
2553
2554                 n_entries++;
2555         }
2556
2557         return n_entries;
2558 }
2559
2560 /*
2561  * This function parses ACL information and allocates memory for ACL data.
2562  * On successful return, the calling function is responsible to free the
2563  * ACL buffer returned by this function.
2564  */
2565 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
2566                                                 struct genl_info *info)
2567 {
2568         enum nl80211_acl_policy acl_policy;
2569         struct nlattr *attr;
2570         struct cfg80211_acl_data *acl;
2571         int i = 0, n_entries, tmp;
2572
2573         if (!wiphy->max_acl_mac_addrs)
2574                 return ERR_PTR(-EOPNOTSUPP);
2575
2576         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
2577                 return ERR_PTR(-EINVAL);
2578
2579         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
2580         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
2581             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
2582                 return ERR_PTR(-EINVAL);
2583
2584         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
2585                 return ERR_PTR(-EINVAL);
2586
2587         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
2588         if (n_entries < 0)
2589                 return ERR_PTR(n_entries);
2590
2591         if (n_entries > wiphy->max_acl_mac_addrs)
2592                 return ERR_PTR(-ENOTSUPP);
2593
2594         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
2595                       GFP_KERNEL);
2596         if (!acl)
2597                 return ERR_PTR(-ENOMEM);
2598
2599         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
2600                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
2601                 i++;
2602         }
2603
2604         acl->n_acl_entries = n_entries;
2605         acl->acl_policy = acl_policy;
2606
2607         return acl;
2608 }
2609
2610 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
2611 {
2612         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2613         struct net_device *dev = info->user_ptr[1];
2614         struct cfg80211_acl_data *acl;
2615         int err;
2616
2617         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2618             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2619                 return -EOPNOTSUPP;
2620
2621         if (!dev->ieee80211_ptr->beacon_interval)
2622                 return -EINVAL;
2623
2624         acl = parse_acl_data(&rdev->wiphy, info);
2625         if (IS_ERR(acl))
2626                 return PTR_ERR(acl);
2627
2628         err = rdev_set_mac_acl(rdev, dev, acl);
2629
2630         kfree(acl);
2631
2632         return err;
2633 }
2634
2635 static int nl80211_parse_beacon(struct genl_info *info,
2636                                 struct cfg80211_beacon_data *bcn)
2637 {
2638         bool haveinfo = false;
2639
2640         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]) ||
2641             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]) ||
2642             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
2643             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2644                 return -EINVAL;
2645
2646         memset(bcn, 0, sizeof(*bcn));
2647
2648         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
2649                 bcn->head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2650                 bcn->head_len = nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2651                 if (!bcn->head_len)
2652                         return -EINVAL;
2653                 haveinfo = true;
2654         }
2655
2656         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
2657                 bcn->tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2658                 bcn->tail_len =
2659                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2660                 haveinfo = true;
2661         }
2662
2663         if (!haveinfo)
2664                 return -EINVAL;
2665
2666         if (info->attrs[NL80211_ATTR_IE]) {
2667                 bcn->beacon_ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2668                 bcn->beacon_ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2669         }
2670
2671         if (info->attrs[NL80211_ATTR_IE_PROBE_RESP]) {
2672                 bcn->proberesp_ies =
2673                         nla_data(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2674                 bcn->proberesp_ies_len =
2675                         nla_len(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2676         }
2677
2678         if (info->attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
2679                 bcn->assocresp_ies =
2680                         nla_data(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2681                 bcn->assocresp_ies_len =
2682                         nla_len(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2683         }
2684
2685         if (info->attrs[NL80211_ATTR_PROBE_RESP]) {
2686                 bcn->probe_resp =
2687                         nla_data(info->attrs[NL80211_ATTR_PROBE_RESP]);
2688                 bcn->probe_resp_len =
2689                         nla_len(info->attrs[NL80211_ATTR_PROBE_RESP]);
2690         }
2691
2692         return 0;
2693 }
2694
2695 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
2696                                    struct cfg80211_ap_settings *params)
2697 {
2698         struct wireless_dev *wdev;
2699         bool ret = false;
2700
2701         mutex_lock(&rdev->devlist_mtx);
2702
2703         list_for_each_entry(wdev, &rdev->wdev_list, list) {
2704                 if (wdev->iftype != NL80211_IFTYPE_AP &&
2705                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
2706                         continue;
2707
2708                 if (!wdev->preset_chandef.chan)
2709                         continue;
2710
2711                 params->chandef = wdev->preset_chandef;
2712                 ret = true;
2713                 break;
2714         }
2715
2716         mutex_unlock(&rdev->devlist_mtx);
2717
2718         return ret;
2719 }
2720
2721 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
2722                                     enum nl80211_auth_type auth_type,
2723                                     enum nl80211_commands cmd)
2724 {
2725         if (auth_type > NL80211_AUTHTYPE_MAX)
2726                 return false;
2727
2728         switch (cmd) {
2729         case NL80211_CMD_AUTHENTICATE:
2730                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
2731                     auth_type == NL80211_AUTHTYPE_SAE)
2732                         return false;
2733                 return true;
2734         case NL80211_CMD_CONNECT:
2735         case NL80211_CMD_START_AP:
2736                 /* SAE not supported yet */
2737                 if (auth_type == NL80211_AUTHTYPE_SAE)
2738                         return false;
2739                 return true;
2740         default:
2741                 return false;
2742         }
2743 }
2744
2745 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
2746 {
2747         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2748         struct net_device *dev = info->user_ptr[1];
2749         struct wireless_dev *wdev = dev->ieee80211_ptr;
2750         struct cfg80211_ap_settings params;
2751         int err;
2752         u8 radar_detect_width = 0;
2753
2754         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2755             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2756                 return -EOPNOTSUPP;
2757
2758         if (!rdev->ops->start_ap)
2759                 return -EOPNOTSUPP;
2760
2761         if (wdev->beacon_interval)
2762                 return -EALREADY;
2763
2764         memset(&params, 0, sizeof(params));
2765
2766         /* these are required for START_AP */
2767         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
2768             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
2769             !info->attrs[NL80211_ATTR_BEACON_HEAD])
2770                 return -EINVAL;
2771
2772         err = nl80211_parse_beacon(info, &params.beacon);
2773         if (err)
2774                 return err;
2775
2776         params.beacon_interval =
2777                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
2778         params.dtim_period =
2779                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
2780
2781         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
2782         if (err)
2783                 return err;
2784
2785         /*
2786          * In theory, some of these attributes should be required here
2787          * but since they were not used when the command was originally
2788          * added, keep them optional for old user space programs to let
2789          * them continue to work with drivers that do not need the
2790          * additional information -- drivers must check!
2791          */
2792         if (info->attrs[NL80211_ATTR_SSID]) {
2793                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2794                 params.ssid_len =
2795                         nla_len(info->attrs[NL80211_ATTR_SSID]);
2796                 if (params.ssid_len == 0 ||
2797                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
2798                         return -EINVAL;
2799         }
2800
2801         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
2802                 params.hidden_ssid = nla_get_u32(
2803                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
2804                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
2805                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
2806                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
2807                         return -EINVAL;
2808         }
2809
2810         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
2811
2812         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
2813                 params.auth_type = nla_get_u32(
2814                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
2815                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
2816                                              NL80211_CMD_START_AP))
2817                         return -EINVAL;
2818         } else
2819                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
2820
2821         err = nl80211_crypto_settings(rdev, info, &params.crypto,
2822                                       NL80211_MAX_NR_CIPHER_SUITES);
2823         if (err)
2824                 return err;
2825
2826         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
2827                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
2828                         return -EOPNOTSUPP;
2829                 params.inactivity_timeout = nla_get_u16(
2830                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
2831         }
2832
2833         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
2834                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2835                         return -EINVAL;
2836                 params.p2p_ctwindow =
2837                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
2838                 if (params.p2p_ctwindow > 127)
2839                         return -EINVAL;
2840                 if (params.p2p_ctwindow != 0 &&
2841                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
2842                         return -EINVAL;
2843         }
2844
2845         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
2846                 u8 tmp;
2847
2848                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2849                         return -EINVAL;
2850                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
2851                 if (tmp > 1)
2852                         return -EINVAL;
2853                 params.p2p_opp_ps = tmp;
2854                 if (params.p2p_opp_ps != 0 &&
2855                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
2856                         return -EINVAL;
2857         }
2858
2859         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2860                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
2861                 if (err)
2862                         return err;
2863         } else if (wdev->preset_chandef.chan) {
2864                 params.chandef = wdev->preset_chandef;
2865         } else if (!nl80211_get_ap_channel(rdev, &params))
2866                 return -EINVAL;
2867
2868         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
2869                 return -EINVAL;
2870
2871         err = cfg80211_chandef_dfs_required(wdev->wiphy, &params.chandef);
2872         if (err < 0)
2873                 return err;
2874         if (err) {
2875                 radar_detect_width = BIT(params.chandef.width);
2876                 params.radar_required = true;
2877         }
2878
2879         mutex_lock(&rdev->devlist_mtx);
2880         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
2881                                            params.chandef.chan,
2882                                            CHAN_MODE_SHARED,
2883                                            radar_detect_width);
2884         mutex_unlock(&rdev->devlist_mtx);
2885
2886         if (err)
2887                 return err;
2888
2889         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
2890                 params.acl = parse_acl_data(&rdev->wiphy, info);
2891                 if (IS_ERR(params.acl))
2892                         return PTR_ERR(params.acl);
2893         }
2894
2895         err = rdev_start_ap(rdev, dev, &params);
2896         if (!err) {
2897                 wdev->preset_chandef = params.chandef;
2898                 wdev->beacon_interval = params.beacon_interval;
2899                 wdev->channel = params.chandef.chan;
2900                 wdev->ssid_len = params.ssid_len;
2901                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
2902         }
2903
2904         kfree(params.acl);
2905
2906         return err;
2907 }
2908
2909 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
2910 {
2911         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2912         struct net_device *dev = info->user_ptr[1];
2913         struct wireless_dev *wdev = dev->ieee80211_ptr;
2914         struct cfg80211_beacon_data params;
2915         int err;
2916
2917         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2918             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2919                 return -EOPNOTSUPP;
2920
2921         if (!rdev->ops->change_beacon)
2922                 return -EOPNOTSUPP;
2923
2924         if (!wdev->beacon_interval)
2925                 return -EINVAL;
2926
2927         err = nl80211_parse_beacon(info, &params);
2928         if (err)
2929                 return err;
2930
2931         return rdev_change_beacon(rdev, dev, &params);
2932 }
2933
2934 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
2935 {
2936         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2937         struct net_device *dev = info->user_ptr[1];
2938
2939         return cfg80211_stop_ap(rdev, dev);
2940 }
2941
2942 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
2943         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
2944         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
2945         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
2946         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
2947         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
2948         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
2949 };
2950
2951 static int parse_station_flags(struct genl_info *info,
2952                                enum nl80211_iftype iftype,
2953                                struct station_parameters *params)
2954 {
2955         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
2956         struct nlattr *nla;
2957         int flag;
2958
2959         /*
2960          * Try parsing the new attribute first so userspace
2961          * can specify both for older kernels.
2962          */
2963         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
2964         if (nla) {
2965                 struct nl80211_sta_flag_update *sta_flags;
2966
2967                 sta_flags = nla_data(nla);
2968                 params->sta_flags_mask = sta_flags->mask;
2969                 params->sta_flags_set = sta_flags->set;
2970                 if ((params->sta_flags_mask |
2971                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
2972                         return -EINVAL;
2973                 return 0;
2974         }
2975
2976         /* if present, parse the old attribute */
2977
2978         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
2979         if (!nla)
2980                 return 0;
2981
2982         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
2983                              nla, sta_flags_policy))
2984                 return -EINVAL;
2985
2986         /*
2987          * Only allow certain flags for interface types so that
2988          * other attributes are silently ignored. Remember that
2989          * this is backward compatibility code with old userspace
2990          * and shouldn't be hit in other cases anyway.
2991          */
2992         switch (iftype) {
2993         case NL80211_IFTYPE_AP:
2994         case NL80211_IFTYPE_AP_VLAN:
2995         case NL80211_IFTYPE_P2P_GO:
2996                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
2997                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
2998                                          BIT(NL80211_STA_FLAG_WME) |
2999                                          BIT(NL80211_STA_FLAG_MFP);
3000                 break;
3001         case NL80211_IFTYPE_P2P_CLIENT:
3002         case NL80211_IFTYPE_STATION:
3003                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3004                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3005                 break;
3006         case NL80211_IFTYPE_MESH_POINT:
3007                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3008                                          BIT(NL80211_STA_FLAG_MFP) |
3009                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3010         default:
3011                 return -EINVAL;
3012         }
3013
3014         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3015                 if (flags[flag]) {
3016                         params->sta_flags_set |= (1<<flag);
3017
3018                         /* no longer support new API additions in old API */
3019                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3020                                 return -EINVAL;
3021                 }
3022         }
3023
3024         return 0;
3025 }
3026
3027 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3028                                  int attr)
3029 {
3030         struct nlattr *rate;
3031         u32 bitrate;
3032         u16 bitrate_compat;
3033
3034         rate = nla_nest_start(msg, attr);
3035         if (!rate)
3036                 return false;
3037
3038         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3039         bitrate = cfg80211_calculate_bitrate(info);
3040         /* report 16-bit bitrate only if we can */
3041         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3042         if (bitrate > 0 &&
3043             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3044                 return false;
3045         if (bitrate_compat > 0 &&
3046             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3047                 return false;
3048
3049         if (info->flags & RATE_INFO_FLAGS_MCS) {
3050                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3051                         return false;
3052                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3053                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3054                         return false;
3055                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3056                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3057                         return false;
3058         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3059                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3060                         return false;
3061                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3062                         return false;
3063                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3064                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3065                         return false;
3066                 if (info->flags & RATE_INFO_FLAGS_80_MHZ_WIDTH &&
3067                     nla_put_flag(msg, NL80211_RATE_INFO_80_MHZ_WIDTH))
3068                         return false;
3069                 if (info->flags & RATE_INFO_FLAGS_80P80_MHZ_WIDTH &&
3070                     nla_put_flag(msg, NL80211_RATE_INFO_80P80_MHZ_WIDTH))
3071                         return false;
3072                 if (info->flags & RATE_INFO_FLAGS_160_MHZ_WIDTH &&
3073                     nla_put_flag(msg, NL80211_RATE_INFO_160_MHZ_WIDTH))
3074                         return false;
3075                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3076                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3077                         return false;
3078         }
3079
3080         nla_nest_end(msg, rate);
3081         return true;
3082 }
3083
3084 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
3085                                 int flags,
3086                                 struct cfg80211_registered_device *rdev,
3087                                 struct net_device *dev,
3088                                 const u8 *mac_addr, struct station_info *sinfo)
3089 {
3090         void *hdr;
3091         struct nlattr *sinfoattr, *bss_param;
3092
3093         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3094         if (!hdr)
3095                 return -1;
3096
3097         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3098             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3099             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3100                 goto nla_put_failure;
3101
3102         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3103         if (!sinfoattr)
3104                 goto nla_put_failure;
3105         if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
3106             nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
3107                         sinfo->connected_time))
3108                 goto nla_put_failure;
3109         if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
3110             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
3111                         sinfo->inactive_time))
3112                 goto nla_put_failure;
3113         if ((sinfo->filled & (STATION_INFO_RX_BYTES |
3114                               STATION_INFO_RX_BYTES64)) &&
3115             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3116                         (u32)sinfo->rx_bytes))
3117                 goto nla_put_failure;
3118         if ((sinfo->filled & (STATION_INFO_TX_BYTES |
3119                               NL80211_STA_INFO_TX_BYTES64)) &&
3120             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3121                         (u32)sinfo->tx_bytes))
3122                 goto nla_put_failure;
3123         if ((sinfo->filled & STATION_INFO_RX_BYTES64) &&
3124             nla_put_u64(msg, NL80211_STA_INFO_RX_BYTES64,
3125                         sinfo->rx_bytes))
3126                 goto nla_put_failure;
3127         if ((sinfo->filled & STATION_INFO_TX_BYTES64) &&
3128             nla_put_u64(msg, NL80211_STA_INFO_TX_BYTES64,
3129                         sinfo->tx_bytes))
3130                 goto nla_put_failure;
3131         if ((sinfo->filled & STATION_INFO_LLID) &&
3132             nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
3133                 goto nla_put_failure;
3134         if ((sinfo->filled & STATION_INFO_PLID) &&
3135             nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
3136                 goto nla_put_failure;
3137         if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
3138             nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
3139                        sinfo->plink_state))
3140                 goto nla_put_failure;
3141         switch (rdev->wiphy.signal_type) {
3142         case CFG80211_SIGNAL_TYPE_MBM:
3143                 if ((sinfo->filled & STATION_INFO_SIGNAL) &&
3144                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
3145                                sinfo->signal))
3146                         goto nla_put_failure;
3147                 if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
3148                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
3149                                sinfo->signal_avg))
3150                         goto nla_put_failure;
3151                 break;
3152         default:
3153                 break;
3154         }
3155         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
3156                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3157                                           NL80211_STA_INFO_TX_BITRATE))
3158                         goto nla_put_failure;
3159         }
3160         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
3161                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3162                                           NL80211_STA_INFO_RX_BITRATE))
3163                         goto nla_put_failure;
3164         }
3165         if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
3166             nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
3167                         sinfo->rx_packets))
3168                 goto nla_put_failure;
3169         if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
3170             nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
3171                         sinfo->tx_packets))
3172                 goto nla_put_failure;
3173         if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
3174             nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
3175                         sinfo->tx_retries))
3176                 goto nla_put_failure;
3177         if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
3178             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
3179                         sinfo->tx_failed))
3180                 goto nla_put_failure;
3181         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
3182             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
3183                         sinfo->beacon_loss_count))
3184                 goto nla_put_failure;
3185         if ((sinfo->filled & STATION_INFO_LOCAL_PM) &&
3186             nla_put_u32(msg, NL80211_STA_INFO_LOCAL_PM,
3187                         sinfo->local_pm))
3188                 goto nla_put_failure;
3189         if ((sinfo->filled & STATION_INFO_PEER_PM) &&
3190             nla_put_u32(msg, NL80211_STA_INFO_PEER_PM,
3191                         sinfo->peer_pm))
3192                 goto nla_put_failure;
3193         if ((sinfo->filled & STATION_INFO_NONPEER_PM) &&
3194             nla_put_u32(msg, NL80211_STA_INFO_NONPEER_PM,
3195                         sinfo->nonpeer_pm))
3196                 goto nla_put_failure;
3197         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
3198                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3199                 if (!bss_param)
3200                         goto nla_put_failure;
3201
3202                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3203                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3204                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3205                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3206                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3207                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3208                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3209                                sinfo->bss_param.dtim_period) ||
3210                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3211                                 sinfo->bss_param.beacon_interval))
3212                         goto nla_put_failure;
3213
3214                 nla_nest_end(msg, bss_param);
3215         }
3216         if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
3217             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3218                     sizeof(struct nl80211_sta_flag_update),
3219                     &sinfo->sta_flags))
3220                 goto nla_put_failure;
3221         if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
3222                 nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
3223                             sinfo->t_offset))
3224                 goto nla_put_failure;
3225         nla_nest_end(msg, sinfoattr);
3226
3227         if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
3228             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3229                     sinfo->assoc_req_ies))
3230                 goto nla_put_failure;
3231
3232         return genlmsg_end(msg, hdr);
3233
3234  nla_put_failure:
3235         genlmsg_cancel(msg, hdr);
3236         return -EMSGSIZE;
3237 }
3238
3239 static int nl80211_dump_station(struct sk_buff *skb,
3240                                 struct netlink_callback *cb)
3241 {
3242         struct station_info sinfo;
3243         struct cfg80211_registered_device *dev;
3244         struct net_device *netdev;
3245         u8 mac_addr[ETH_ALEN];
3246         int sta_idx = cb->args[1];
3247         int err;
3248
3249         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
3250         if (err)
3251                 return err;
3252
3253         if (!dev->ops->dump_station) {
3254                 err = -EOPNOTSUPP;
3255                 goto out_err;
3256         }
3257
3258         while (1) {
3259                 memset(&sinfo, 0, sizeof(sinfo));
3260                 err = rdev_dump_station(dev, netdev, sta_idx,
3261                                         mac_addr, &sinfo);
3262                 if (err == -ENOENT)
3263                         break;
3264                 if (err)
3265                         goto out_err;
3266
3267                 if (nl80211_send_station(skb,
3268                                 NETLINK_CB(cb->skb).portid,
3269                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3270                                 dev, netdev, mac_addr,
3271                                 &sinfo) < 0)
3272                         goto out;
3273
3274                 sta_idx++;
3275         }
3276
3277
3278  out:
3279         cb->args[1] = sta_idx;
3280         err = skb->len;
3281  out_err:
3282         nl80211_finish_netdev_dump(dev);
3283
3284         return err;
3285 }
3286
3287 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3288 {
3289         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3290         struct net_device *dev = info->user_ptr[1];
3291         struct station_info sinfo;
3292         struct sk_buff *msg;
3293         u8 *mac_addr = NULL;
3294         int err;
3295
3296         memset(&sinfo, 0, sizeof(sinfo));
3297
3298         if (!info->attrs[NL80211_ATTR_MAC])
3299                 return -EINVAL;
3300
3301         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3302
3303         if (!rdev->ops->get_station)
3304                 return -EOPNOTSUPP;
3305
3306         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3307         if (err)
3308                 return err;
3309
3310         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3311         if (!msg)
3312                 return -ENOMEM;
3313
3314         if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3315                                  rdev, dev, mac_addr, &sinfo) < 0) {
3316                 nlmsg_free(msg);
3317                 return -ENOBUFS;
3318         }
3319
3320         return genlmsg_reply(msg, info);
3321 }
3322
3323 /*
3324  * Get vlan interface making sure it is running and on the right wiphy.
3325  */
3326 static struct net_device *get_vlan(struct genl_info *info,
3327                                    struct cfg80211_registered_device *rdev)
3328 {
3329         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
3330         struct net_device *v;
3331         int ret;
3332
3333         if (!vlanattr)
3334                 return NULL;
3335
3336         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
3337         if (!v)
3338                 return ERR_PTR(-ENODEV);
3339
3340         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
3341                 ret = -EINVAL;
3342                 goto error;
3343         }
3344
3345         if (!netif_running(v)) {
3346                 ret = -ENETDOWN;
3347                 goto error;
3348         }
3349
3350         return v;
3351  error:
3352         dev_put(v);
3353         return ERR_PTR(ret);
3354 }
3355
3356 static struct nla_policy
3357 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
3358         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
3359         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
3360 };
3361
3362 static int nl80211_set_station_tdls(struct genl_info *info,
3363                                     struct station_parameters *params)
3364 {
3365         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
3366         struct nlattr *nla;
3367         int err;
3368
3369         /* Dummy STA entry gets updated once the peer capabilities are known */
3370         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3371                 params->ht_capa =
3372                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3373         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
3374                 params->vht_capa =
3375                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
3376
3377         /* parse WME attributes if present */
3378         if (!info->attrs[NL80211_ATTR_STA_WME])
3379                 return 0;
3380
3381         nla = info->attrs[NL80211_ATTR_STA_WME];
3382         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
3383                                nl80211_sta_wme_policy);
3384         if (err)
3385                 return err;
3386
3387         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
3388                 params->uapsd_queues = nla_get_u8(
3389                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
3390         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
3391                 return -EINVAL;
3392
3393         if (tb[NL80211_STA_WME_MAX_SP])
3394                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
3395
3396         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
3397                 return -EINVAL;
3398
3399         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
3400
3401         return 0;
3402 }
3403
3404 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
3405 {
3406         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3407         int err;
3408         struct net_device *dev = info->user_ptr[1];
3409         struct station_parameters params;
3410         u8 *mac_addr = NULL;
3411
3412         memset(&params, 0, sizeof(params));
3413
3414         params.listen_interval = -1;
3415
3416         if (info->attrs[NL80211_ATTR_STA_AID])
3417                 return -EINVAL;
3418
3419         if (!info->attrs[NL80211_ATTR_MAC])
3420                 return -EINVAL;
3421
3422         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3423
3424         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
3425                 params.supported_rates =
3426                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3427                 params.supported_rates_len =
3428                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3429         }
3430
3431         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
3432                 params.capability =
3433                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
3434                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
3435         }
3436
3437         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
3438                 params.ext_capab =
3439                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3440                 params.ext_capab_len =
3441                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3442         }
3443
3444         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3445                 return -EINVAL;
3446
3447         if (!rdev->ops->change_station)
3448                 return -EOPNOTSUPP;
3449
3450         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3451                 return -EINVAL;
3452
3453         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
3454                 params.plink_action =
3455                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3456                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
3457                         return -EINVAL;
3458         }
3459
3460         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
3461                 params.plink_state =
3462                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
3463                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
3464                         return -EINVAL;
3465                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
3466         }
3467
3468         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
3469                 enum nl80211_mesh_power_mode pm = nla_get_u32(
3470                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
3471
3472                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
3473                     pm > NL80211_MESH_POWER_MAX)
3474                         return -EINVAL;
3475
3476                 params.local_pm = pm;
3477         }
3478
3479         switch (dev->ieee80211_ptr->iftype) {
3480         case NL80211_IFTYPE_AP:
3481         case NL80211_IFTYPE_AP_VLAN:
3482         case NL80211_IFTYPE_P2P_GO:
3483                 /* disallow mesh-specific things */
3484                 if (params.plink_action)
3485                         return -EINVAL;
3486                 if (params.local_pm)
3487                         return -EINVAL;
3488                 if (params.sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3489                         return -EINVAL;
3490
3491                 /* TDLS can't be set, ... */
3492                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3493                         return -EINVAL;
3494                 /*
3495                  * ... but don't bother the driver with it. This works around
3496                  * a hostapd/wpa_supplicant issue -- it always includes the
3497                  * TLDS_PEER flag in the mask even for AP mode.
3498                  */
3499                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3500
3501                 /* accept only the listed bits */
3502                 if (params.sta_flags_mask &
3503                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3504                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3505                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
3506                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3507                                   BIT(NL80211_STA_FLAG_WME) |
3508                                   BIT(NL80211_STA_FLAG_MFP)))
3509                         return -EINVAL;
3510
3511                 /* but authenticated/associated only if driver handles it */
3512                 if (!(rdev->wiphy.features &
3513                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
3514                     params.sta_flags_mask &
3515                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3516                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
3517                         return -EINVAL;
3518
3519                 /* reject other things that can't change */
3520                 if (params.supported_rates)
3521                         return -EINVAL;
3522                 if (info->attrs[NL80211_ATTR_STA_CAPABILITY])
3523                         return -EINVAL;
3524                 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY])
3525                         return -EINVAL;
3526                 if (info->attrs[NL80211_ATTR_HT_CAPABILITY] ||
3527                     info->attrs[NL80211_ATTR_VHT_CAPABILITY])
3528                         return -EINVAL;
3529
3530                 /* must be last in here for error handling */
3531                 params.vlan = get_vlan(info, rdev);
3532                 if (IS_ERR(params.vlan))
3533                         return PTR_ERR(params.vlan);
3534                 break;
3535         case NL80211_IFTYPE_P2P_CLIENT:
3536         case NL80211_IFTYPE_STATION:
3537                 /*
3538                  * Don't allow userspace to change the TDLS_PEER flag,
3539                  * but silently ignore attempts to change it since we
3540                  * don't have state here to verify that it doesn't try
3541                  * to change the flag.
3542                  */
3543                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3544                 /* Include parameters for TDLS peer (driver will check) */
3545                 err = nl80211_set_station_tdls(info, &params);
3546                 if (err)
3547                         return err;
3548                 /* disallow things sta doesn't support */
3549                 if (params.plink_action)
3550                         return -EINVAL;
3551                 if (params.local_pm)
3552                         return -EINVAL;
3553                 if (params.sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3554                         return -EINVAL;
3555                 /* reject any changes other than AUTHORIZED or WME (for TDLS) */
3556                 if (params.sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3557                                               BIT(NL80211_STA_FLAG_WME)))
3558                         return -EINVAL;
3559                 break;
3560         case NL80211_IFTYPE_ADHOC:
3561                 /* disallow things sta doesn't support */
3562                 if (params.plink_action)
3563                         return -EINVAL;
3564                 if (params.local_pm)
3565                         return -EINVAL;
3566                 if (params.sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3567                         return -EINVAL;
3568                 if (info->attrs[NL80211_ATTR_HT_CAPABILITY] ||
3569                     info->attrs[NL80211_ATTR_VHT_CAPABILITY])
3570                         return -EINVAL;
3571                 /* reject any changes other than AUTHORIZED */
3572                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
3573                         return -EINVAL;
3574                 break;
3575         case NL80211_IFTYPE_MESH_POINT:
3576                 /* disallow things mesh doesn't support */
3577                 if (params.vlan)
3578                         return -EINVAL;
3579                 if (params.supported_rates)
3580                         return -EINVAL;
3581                 if (info->attrs[NL80211_ATTR_STA_CAPABILITY])
3582                         return -EINVAL;
3583                 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY])
3584                         return -EINVAL;
3585                 if (info->attrs[NL80211_ATTR_HT_CAPABILITY] ||
3586                     info->attrs[NL80211_ATTR_VHT_CAPABILITY])
3587                         return -EINVAL;
3588                 /*
3589                  * No special handling for TDLS here -- the userspace
3590                  * mesh code doesn't have this bug.
3591                  */
3592                 if (params.sta_flags_mask &
3593                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3594                                   BIT(NL80211_STA_FLAG_MFP) |
3595                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3596                         return -EINVAL;
3597                 break;
3598         default:
3599                 return -EOPNOTSUPP;
3600         }
3601
3602         /* be aware of params.vlan when changing code here */
3603
3604         err = rdev_change_station(rdev, dev, mac_addr, &params);
3605
3606         if (params.vlan)
3607                 dev_put(params.vlan);
3608
3609         return err;
3610 }
3611
3612 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
3613 {
3614         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3615         int err;
3616         struct net_device *dev = info->user_ptr[1];
3617         struct station_parameters params;
3618         u8 *mac_addr = NULL;
3619
3620         memset(&params, 0, sizeof(params));
3621
3622         if (!info->attrs[NL80211_ATTR_MAC])
3623                 return -EINVAL;
3624
3625         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3626                 return -EINVAL;
3627
3628         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
3629                 return -EINVAL;
3630
3631         if (!info->attrs[NL80211_ATTR_STA_AID])
3632                 return -EINVAL;
3633
3634         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3635         params.supported_rates =
3636                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3637         params.supported_rates_len =
3638                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3639         params.listen_interval =
3640                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
3641
3642         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
3643         if (!params.aid || params.aid > IEEE80211_MAX_AID)
3644                 return -EINVAL;
3645
3646         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
3647                 params.capability =
3648                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
3649                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
3650         }
3651
3652         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
3653                 params.ext_capab =
3654                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3655                 params.ext_capab_len =
3656                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3657         }
3658
3659         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3660                 params.ht_capa =
3661                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3662
3663         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
3664                 params.vht_capa =
3665                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
3666
3667         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
3668                 params.plink_action =
3669                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3670                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
3671                         return -EINVAL;
3672         }
3673
3674         if (!rdev->ops->add_station)
3675                 return -EOPNOTSUPP;
3676
3677         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3678                 return -EINVAL;
3679
3680         switch (dev->ieee80211_ptr->iftype) {
3681         case NL80211_IFTYPE_AP:
3682         case NL80211_IFTYPE_AP_VLAN:
3683         case NL80211_IFTYPE_P2P_GO:
3684                 /* parse WME attributes if sta is WME capable */
3685                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
3686                     (params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)) &&
3687                     info->attrs[NL80211_ATTR_STA_WME]) {
3688                         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
3689                         struct nlattr *nla;
3690
3691                         nla = info->attrs[NL80211_ATTR_STA_WME];
3692                         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
3693                                                nl80211_sta_wme_policy);
3694                         if (err)
3695                                 return err;
3696
3697                         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
3698                                 params.uapsd_queues =
3699                                      nla_get_u8(tb[NL80211_STA_WME_UAPSD_QUEUES]);
3700                         if (params.uapsd_queues &
3701                                         ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
3702                                 return -EINVAL;
3703
3704                         if (tb[NL80211_STA_WME_MAX_SP])
3705                                 params.max_sp =
3706                                      nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
3707
3708                         if (params.max_sp &
3709                                         ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
3710                                 return -EINVAL;
3711
3712                         params.sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
3713                 }
3714                 /* TDLS peers cannot be added */
3715                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3716                         return -EINVAL;
3717                 /* but don't bother the driver with it */
3718                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3719
3720                 /* allow authenticated/associated only if driver handles it */
3721                 if (!(rdev->wiphy.features &
3722                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
3723                     params.sta_flags_mask &
3724                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3725                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
3726                         return -EINVAL;
3727
3728                 /* must be last in here for error handling */
3729                 params.vlan = get_vlan(info, rdev);
3730                 if (IS_ERR(params.vlan))
3731                         return PTR_ERR(params.vlan);
3732                 break;
3733         case NL80211_IFTYPE_MESH_POINT:
3734                 /* associated is disallowed */
3735                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
3736                         return -EINVAL;
3737                 /* TDLS peers cannot be added */
3738                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3739                         return -EINVAL;
3740                 break;
3741         case NL80211_IFTYPE_STATION:
3742                 /* associated is disallowed */
3743                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
3744                         return -EINVAL;
3745                 /* Only TDLS peers can be added */
3746                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3747                         return -EINVAL;
3748                 /* Can only add if TDLS ... */
3749                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
3750                         return -EOPNOTSUPP;
3751                 /* ... with external setup is supported */
3752                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
3753                         return -EOPNOTSUPP;
3754                 break;
3755         default:
3756                 return -EOPNOTSUPP;
3757         }
3758
3759         /* be aware of params.vlan when changing code here */
3760
3761         err = rdev_add_station(rdev, dev, mac_addr, &params);
3762
3763         if (params.vlan)
3764                 dev_put(params.vlan);
3765         return err;
3766 }
3767
3768 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
3769 {
3770         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3771         struct net_device *dev = info->user_ptr[1];
3772         u8 *mac_addr = NULL;
3773
3774         if (info->attrs[NL80211_ATTR_MAC])
3775                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3776
3777         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3778             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
3779             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
3780             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3781                 return -EINVAL;
3782
3783         if (!rdev->ops->del_station)
3784                 return -EOPNOTSUPP;
3785
3786         return rdev_del_station(rdev, dev, mac_addr);
3787 }
3788
3789 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
3790                                 int flags, struct net_device *dev,
3791                                 u8 *dst, u8 *next_hop,
3792                                 struct mpath_info *pinfo)
3793 {
3794         void *hdr;
3795         struct nlattr *pinfoattr;
3796
3797         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3798         if (!hdr)
3799                 return -1;
3800
3801         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3802             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
3803             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
3804             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
3805                 goto nla_put_failure;
3806
3807         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
3808         if (!pinfoattr)
3809                 goto nla_put_failure;
3810         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
3811             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
3812                         pinfo->frame_qlen))
3813                 goto nla_put_failure;
3814         if (((pinfo->filled & MPATH_INFO_SN) &&
3815              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
3816             ((pinfo->filled & MPATH_INFO_METRIC) &&
3817              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
3818                          pinfo->metric)) ||
3819             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
3820              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
3821                          pinfo->exptime)) ||
3822             ((pinfo->filled & MPATH_INFO_FLAGS) &&
3823              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
3824                         pinfo->flags)) ||
3825             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
3826              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
3827                          pinfo->discovery_timeout)) ||
3828             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
3829              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
3830                         pinfo->discovery_retries)))
3831                 goto nla_put_failure;
3832
3833         nla_nest_end(msg, pinfoattr);
3834
3835         return genlmsg_end(msg, hdr);
3836
3837  nla_put_failure:
3838         genlmsg_cancel(msg, hdr);
3839         return -EMSGSIZE;
3840 }
3841
3842 static int nl80211_dump_mpath(struct sk_buff *skb,
3843                               struct netlink_callback *cb)
3844 {
3845         struct mpath_info pinfo;
3846         struct cfg80211_registered_device *dev;
3847         struct net_device *netdev;
3848         u8 dst[ETH_ALEN];
3849         u8 next_hop[ETH_ALEN];
3850         int path_idx = cb->args[1];
3851         int err;
3852
3853         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
3854         if (err)
3855                 return err;
3856
3857         if (!dev->ops->dump_mpath) {
3858                 err = -EOPNOTSUPP;
3859                 goto out_err;
3860         }
3861
3862         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
3863                 err = -EOPNOTSUPP;
3864                 goto out_err;
3865         }
3866
3867         while (1) {
3868                 err = rdev_dump_mpath(dev, netdev, path_idx, dst, next_hop,
3869                                       &pinfo);
3870                 if (err == -ENOENT)
3871                         break;
3872                 if (err)
3873                         goto out_err;
3874
3875                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
3876                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
3877                                        netdev, dst, next_hop,
3878                                        &pinfo) < 0)
3879                         goto out;
3880
3881                 path_idx++;
3882         }
3883
3884
3885  out:
3886         cb->args[1] = path_idx;
3887         err = skb->len;
3888  out_err:
3889         nl80211_finish_netdev_dump(dev);
3890         return err;
3891 }
3892
3893 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
3894 {
3895         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3896         int err;
3897         struct net_device *dev = info->user_ptr[1];
3898         struct mpath_info pinfo;
3899         struct sk_buff *msg;
3900         u8 *dst = NULL;
3901         u8 next_hop[ETH_ALEN];
3902
3903         memset(&pinfo, 0, sizeof(pinfo));
3904
3905         if (!info->attrs[NL80211_ATTR_MAC])
3906                 return -EINVAL;
3907
3908         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3909
3910         if (!rdev->ops->get_mpath)
3911                 return -EOPNOTSUPP;
3912
3913         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3914                 return -EOPNOTSUPP;
3915
3916         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
3917         if (err)
3918                 return err;
3919
3920         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3921         if (!msg)
3922                 return -ENOMEM;
3923
3924         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
3925                                  dev, dst, next_hop, &pinfo) < 0) {
3926                 nlmsg_free(msg);
3927                 return -ENOBUFS;
3928         }
3929
3930         return genlmsg_reply(msg, info);
3931 }
3932
3933 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
3934 {
3935         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3936         struct net_device *dev = info->user_ptr[1];
3937         u8 *dst = NULL;
3938         u8 *next_hop = NULL;
3939
3940         if (!info->attrs[NL80211_ATTR_MAC])
3941                 return -EINVAL;
3942
3943         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
3944                 return -EINVAL;
3945
3946         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3947         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
3948
3949         if (!rdev->ops->change_mpath)
3950                 return -EOPNOTSUPP;
3951
3952         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3953                 return -EOPNOTSUPP;
3954
3955         return rdev_change_mpath(rdev, dev, dst, next_hop);
3956 }
3957
3958 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
3959 {
3960         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3961         struct net_device *dev = info->user_ptr[1];
3962         u8 *dst = NULL;
3963         u8 *next_hop = NULL;
3964
3965         if (!info->attrs[NL80211_ATTR_MAC])
3966                 return -EINVAL;
3967
3968         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
3969                 return -EINVAL;
3970
3971         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3972         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
3973
3974         if (!rdev->ops->add_mpath)
3975                 return -EOPNOTSUPP;
3976
3977         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3978                 return -EOPNOTSUPP;
3979
3980         return rdev_add_mpath(rdev, dev, dst, next_hop);
3981 }
3982
3983 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
3984 {
3985         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3986         struct net_device *dev = info->user_ptr[1];
3987         u8 *dst = NULL;
3988
3989         if (info->attrs[NL80211_ATTR_MAC])
3990                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3991
3992         if (!rdev->ops->del_mpath)
3993                 return -EOPNOTSUPP;
3994
3995         return rdev_del_mpath(rdev, dev, dst);
3996 }
3997
3998 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
3999 {
4000         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4001         struct net_device *dev = info->user_ptr[1];
4002         struct bss_parameters params;
4003
4004         memset(&params, 0, sizeof(params));
4005         /* default to not changing parameters */
4006         params.use_cts_prot = -1;
4007         params.use_short_preamble = -1;
4008         params.use_short_slot_time = -1;
4009         params.ap_isolate = -1;
4010         params.ht_opmode = -1;
4011         params.p2p_ctwindow = -1;
4012         params.p2p_opp_ps = -1;
4013
4014         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
4015                 params.use_cts_prot =
4016                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
4017         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
4018                 params.use_short_preamble =
4019                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
4020         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
4021                 params.use_short_slot_time =
4022                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4023         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4024                 params.basic_rates =
4025                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4026                 params.basic_rates_len =
4027                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4028         }
4029         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
4030                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4031         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
4032                 params.ht_opmode =
4033                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4034
4035         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4036                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4037                         return -EINVAL;
4038                 params.p2p_ctwindow =
4039                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4040                 if (params.p2p_ctwindow < 0)
4041                         return -EINVAL;
4042                 if (params.p2p_ctwindow != 0 &&
4043                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4044                         return -EINVAL;
4045         }
4046
4047         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4048                 u8 tmp;
4049
4050                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4051                         return -EINVAL;
4052                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4053                 if (tmp > 1)
4054                         return -EINVAL;
4055                 params.p2p_opp_ps = tmp;
4056                 if (params.p2p_opp_ps &&
4057                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4058                         return -EINVAL;
4059         }
4060
4061         if (!rdev->ops->change_bss)
4062                 return -EOPNOTSUPP;
4063
4064         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4065             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4066                 return -EOPNOTSUPP;
4067
4068         return rdev_change_bss(rdev, dev, &params);
4069 }
4070
4071 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
4072         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
4073         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
4074         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
4075         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
4076         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
4077         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
4078 };
4079
4080 static int parse_reg_rule(struct nlattr *tb[],
4081         struct ieee80211_reg_rule *reg_rule)
4082 {
4083         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
4084         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
4085
4086         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
4087                 return -EINVAL;
4088         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
4089                 return -EINVAL;
4090         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
4091                 return -EINVAL;
4092         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
4093                 return -EINVAL;
4094         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
4095                 return -EINVAL;
4096
4097         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
4098
4099         freq_range->start_freq_khz =
4100                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
4101         freq_range->end_freq_khz =
4102                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
4103         freq_range->max_bandwidth_khz =
4104                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
4105
4106         power_rule->max_eirp =
4107                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
4108
4109         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
4110                 power_rule->max_antenna_gain =
4111                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
4112
4113         return 0;
4114 }
4115
4116 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
4117 {
4118         int r;
4119         char *data = NULL;
4120         enum nl80211_user_reg_hint_type user_reg_hint_type;
4121
4122         /*
4123          * You should only get this when cfg80211 hasn't yet initialized
4124          * completely when built-in to the kernel right between the time
4125          * window between nl80211_init() and regulatory_init(), if that is
4126          * even possible.
4127          */
4128         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4129                 return -EINPROGRESS;
4130
4131         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4132                 return -EINVAL;
4133
4134         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4135
4136         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
4137                 user_reg_hint_type =
4138                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
4139         else
4140                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
4141
4142         switch (user_reg_hint_type) {
4143         case NL80211_USER_REG_HINT_USER:
4144         case NL80211_USER_REG_HINT_CELL_BASE:
4145                 break;
4146         default:
4147                 return -EINVAL;
4148         }
4149
4150         r = regulatory_hint_user(data, user_reg_hint_type);
4151
4152         return r;
4153 }
4154
4155 static int nl80211_get_mesh_config(struct sk_buff *skb,
4156                                    struct genl_info *info)
4157 {
4158         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4159         struct net_device *dev = info->user_ptr[1];
4160         struct wireless_dev *wdev = dev->ieee80211_ptr;
4161         struct mesh_config cur_params;
4162         int err = 0;
4163         void *hdr;
4164         struct nlattr *pinfoattr;
4165         struct sk_buff *msg;
4166
4167         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4168                 return -EOPNOTSUPP;
4169
4170         if (!rdev->ops->get_mesh_config)
4171                 return -EOPNOTSUPP;
4172
4173         wdev_lock(wdev);
4174         /* If not connected, get default parameters */
4175         if (!wdev->mesh_id_len)
4176                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
4177         else
4178                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
4179         wdev_unlock(wdev);
4180
4181         if (err)
4182                 return err;
4183
4184         /* Draw up a netlink message to send back */
4185         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4186         if (!msg)
4187                 return -ENOMEM;
4188         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4189                              NL80211_CMD_GET_MESH_CONFIG);
4190         if (!hdr)
4191                 goto out;
4192         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
4193         if (!pinfoattr)
4194                 goto nla_put_failure;
4195         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4196             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
4197                         cur_params.dot11MeshRetryTimeout) ||
4198             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4199                         cur_params.dot11MeshConfirmTimeout) ||
4200             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
4201                         cur_params.dot11MeshHoldingTimeout) ||
4202             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
4203                         cur_params.dot11MeshMaxPeerLinks) ||
4204             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
4205                        cur_params.dot11MeshMaxRetries) ||
4206             nla_put_u8(msg, NL80211_MESHCONF_TTL,
4207                        cur_params.dot11MeshTTL) ||
4208             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
4209                        cur_params.element_ttl) ||
4210             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4211                        cur_params.auto_open_plinks) ||
4212             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4213                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
4214             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4215                        cur_params.dot11MeshHWMPmaxPREQretries) ||
4216             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
4217                         cur_params.path_refresh_time) ||
4218             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4219                         cur_params.min_discovery_timeout) ||
4220             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4221                         cur_params.dot11MeshHWMPactivePathTimeout) ||
4222             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4223                         cur_params.dot11MeshHWMPpreqMinInterval) ||
4224             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4225                         cur_params.dot11MeshHWMPperrMinInterval) ||
4226             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4227                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
4228             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
4229                        cur_params.dot11MeshHWMPRootMode) ||
4230             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4231                         cur_params.dot11MeshHWMPRannInterval) ||
4232             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4233                        cur_params.dot11MeshGateAnnouncementProtocol) ||
4234             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
4235                        cur_params.dot11MeshForwarding) ||
4236             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
4237                         cur_params.rssi_threshold) ||
4238             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
4239                         cur_params.ht_opmode) ||
4240             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4241                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
4242             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4243                         cur_params.dot11MeshHWMProotInterval) ||
4244             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4245                         cur_params.dot11MeshHWMPconfirmationInterval) ||
4246             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
4247                         cur_params.power_mode) ||
4248             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
4249                         cur_params.dot11MeshAwakeWindowDuration))
4250                 goto nla_put_failure;
4251         nla_nest_end(msg, pinfoattr);
4252         genlmsg_end(msg, hdr);
4253         return genlmsg_reply(msg, info);
4254
4255  nla_put_failure:
4256         genlmsg_cancel(msg, hdr);
4257  out:
4258         nlmsg_free(msg);
4259         return -ENOBUFS;
4260 }
4261
4262 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
4263         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
4264         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
4265         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
4266         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
4267         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
4268         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
4269         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
4270         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
4271         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
4272         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
4273         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
4274         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
4275         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
4276         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
4277         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
4278         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
4279         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
4280         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
4281         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
4282         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
4283         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
4284         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
4285         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
4286         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
4287         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
4288         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
4289         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
4290 };
4291
4292 static const struct nla_policy
4293         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
4294         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
4295         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
4296         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
4297         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
4298         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
4299                                     .len = IEEE80211_MAX_DATA_LEN },
4300         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
4301 };
4302
4303 static int nl80211_parse_mesh_config(struct genl_info *info,
4304                                      struct mesh_config *cfg,
4305                                      u32 *mask_out)
4306 {
4307         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
4308         u32 mask = 0;
4309
4310 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
4311 do {                                                                        \
4312         if (tb[attr]) {                                                     \
4313                 if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
4314                         return -EINVAL;                                     \
4315                 cfg->param = fn(tb[attr]);                                  \
4316                 mask |= (1 << (attr - 1));                                  \
4317         }                                                                   \
4318 } while (0)
4319
4320
4321         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
4322                 return -EINVAL;
4323         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
4324                              info->attrs[NL80211_ATTR_MESH_CONFIG],
4325                              nl80211_meshconf_params_policy))
4326                 return -EINVAL;
4327
4328         /* This makes sure that there aren't more than 32 mesh config
4329          * parameters (otherwise our bitfield scheme would not work.) */
4330         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
4331
4332         /* Fill in the params struct */
4333         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
4334                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
4335                                   nla_get_u16);
4336         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
4337                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4338                                   nla_get_u16);
4339         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
4340                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
4341                                   nla_get_u16);
4342         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
4343                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
4344                                   nla_get_u16);
4345         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
4346                                   mask, NL80211_MESHCONF_MAX_RETRIES,
4347                                   nla_get_u8);
4348         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
4349                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
4350         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
4351                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
4352                                   nla_get_u8);
4353         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
4354                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4355                                   nla_get_u8);
4356         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
4357                                   1, 255, mask,
4358                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4359                                   nla_get_u32);
4360         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
4361                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4362                                   nla_get_u8);
4363         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
4364                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
4365                                   nla_get_u32);
4366         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
4367                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4368                                   nla_get_u16);
4369         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
4370                                   1, 65535, mask,
4371                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4372                                   nla_get_u32);
4373         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
4374                                   1, 65535, mask,
4375                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4376                                   nla_get_u16);
4377         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
4378                                   1, 65535, mask,
4379                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4380                                   nla_get_u16);
4381         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4382                                   dot11MeshHWMPnetDiameterTraversalTime,
4383                                   1, 65535, mask,
4384                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4385                                   nla_get_u16);
4386         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
4387                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
4388                                   nla_get_u8);
4389         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
4390                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4391                                   nla_get_u16);
4392         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4393                                   dot11MeshGateAnnouncementProtocol, 0, 1,
4394                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4395                                   nla_get_u8);
4396         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
4397                                   mask, NL80211_MESHCONF_FORWARDING,
4398                                   nla_get_u8);
4399         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, 1, 255,
4400                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
4401                                   nla_get_u32);
4402         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
4403                                   mask, NL80211_MESHCONF_HT_OPMODE,
4404                                   nla_get_u16);
4405         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
4406                                   1, 65535, mask,
4407                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4408                                   nla_get_u32);
4409         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
4410                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4411                                   nla_get_u16);
4412         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4413                                   dot11MeshHWMPconfirmationInterval,
4414                                   1, 65535, mask,
4415                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4416                                   nla_get_u16);
4417         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
4418                                   NL80211_MESH_POWER_ACTIVE,
4419                                   NL80211_MESH_POWER_MAX,
4420                                   mask, NL80211_MESHCONF_POWER_MODE,
4421                                   nla_get_u32);
4422         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
4423                                   0, 65535, mask,
4424                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
4425         if (mask_out)
4426                 *mask_out = mask;
4427
4428         return 0;
4429
4430 #undef FILL_IN_MESH_PARAM_IF_SET
4431 }
4432
4433 static int nl80211_parse_mesh_setup(struct genl_info *info,
4434                                      struct mesh_setup *setup)
4435 {
4436         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
4437
4438         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
4439                 return -EINVAL;
4440         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
4441                              info->attrs[NL80211_ATTR_MESH_SETUP],
4442                              nl80211_mesh_setup_params_policy))
4443                 return -EINVAL;
4444
4445         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
4446                 setup->sync_method =
4447                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
4448                  IEEE80211_SYNC_METHOD_VENDOR :
4449                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
4450
4451         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
4452                 setup->path_sel_proto =
4453                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
4454                  IEEE80211_PATH_PROTOCOL_VENDOR :
4455                  IEEE80211_PATH_PROTOCOL_HWMP;
4456
4457         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
4458                 setup->path_metric =
4459                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
4460                  IEEE80211_PATH_METRIC_VENDOR :
4461                  IEEE80211_PATH_METRIC_AIRTIME;
4462
4463
4464         if (tb[NL80211_MESH_SETUP_IE]) {
4465                 struct nlattr *ieattr =
4466                         tb[NL80211_MESH_SETUP_IE];
4467                 if (!is_valid_ie_attr(ieattr))
4468                         return -EINVAL;
4469                 setup->ie = nla_data(ieattr);
4470                 setup->ie_len = nla_len(ieattr);
4471         }
4472         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
4473         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
4474
4475         return 0;
4476 }
4477
4478 static int nl80211_update_mesh_config(struct sk_buff *skb,
4479                                       struct genl_info *info)
4480 {
4481         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4482         struct net_device *dev = info->user_ptr[1];
4483         struct wireless_dev *wdev = dev->ieee80211_ptr;
4484         struct mesh_config cfg;
4485         u32 mask;
4486         int err;
4487
4488         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4489                 return -EOPNOTSUPP;
4490
4491         if (!rdev->ops->update_mesh_config)
4492                 return -EOPNOTSUPP;
4493
4494         err = nl80211_parse_mesh_config(info, &cfg, &mask);
4495         if (err)
4496                 return err;
4497
4498         wdev_lock(wdev);
4499         if (!wdev->mesh_id_len)
4500                 err = -ENOLINK;
4501
4502         if (!err)
4503                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
4504
4505         wdev_unlock(wdev);
4506
4507         return err;
4508 }
4509
4510 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
4511 {
4512         const struct ieee80211_regdomain *regdom;
4513         struct sk_buff *msg;
4514         void *hdr = NULL;
4515         struct nlattr *nl_reg_rules;
4516         unsigned int i;
4517         int err = -EINVAL;
4518
4519         mutex_lock(&cfg80211_mutex);
4520
4521         if (!cfg80211_regdomain)
4522                 goto out;
4523
4524         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4525         if (!msg) {
4526                 err = -ENOBUFS;
4527                 goto out;
4528         }
4529
4530         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4531                              NL80211_CMD_GET_REG);
4532         if (!hdr)
4533                 goto put_failure;
4534
4535         if (reg_last_request_cell_base() &&
4536             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
4537                         NL80211_USER_REG_HINT_CELL_BASE))
4538                 goto nla_put_failure;
4539
4540         rcu_read_lock();
4541         regdom = rcu_dereference(cfg80211_regdomain);
4542
4543         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
4544             (regdom->dfs_region &&
4545              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
4546                 goto nla_put_failure_rcu;
4547
4548         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
4549         if (!nl_reg_rules)
4550                 goto nla_put_failure_rcu;
4551
4552         for (i = 0; i < regdom->n_reg_rules; i++) {
4553                 struct nlattr *nl_reg_rule;
4554                 const struct ieee80211_reg_rule *reg_rule;
4555                 const struct ieee80211_freq_range *freq_range;
4556                 const struct ieee80211_power_rule *power_rule;
4557
4558                 reg_rule = &regdom->reg_rules[i];
4559                 freq_range = &reg_rule->freq_range;
4560                 power_rule = &reg_rule->power_rule;
4561
4562                 nl_reg_rule = nla_nest_start(msg, i);
4563                 if (!nl_reg_rule)
4564                         goto nla_put_failure_rcu;
4565
4566                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
4567                                 reg_rule->flags) ||
4568                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
4569                                 freq_range->start_freq_khz) ||
4570                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
4571                                 freq_range->end_freq_khz) ||
4572                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
4573                                 freq_range->max_bandwidth_khz) ||
4574                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
4575                                 power_rule->max_antenna_gain) ||
4576                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
4577                                 power_rule->max_eirp))
4578                         goto nla_put_failure_rcu;
4579
4580                 nla_nest_end(msg, nl_reg_rule);
4581         }
4582         rcu_read_unlock();
4583
4584         nla_nest_end(msg, nl_reg_rules);
4585
4586         genlmsg_end(msg, hdr);
4587         err = genlmsg_reply(msg, info);
4588         goto out;
4589
4590 nla_put_failure_rcu:
4591         rcu_read_unlock();
4592 nla_put_failure:
4593         genlmsg_cancel(msg, hdr);
4594 put_failure:
4595         nlmsg_free(msg);
4596         err = -EMSGSIZE;
4597 out:
4598         mutex_unlock(&cfg80211_mutex);
4599         return err;
4600 }
4601
4602 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
4603 {
4604         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
4605         struct nlattr *nl_reg_rule;
4606         char *alpha2 = NULL;
4607         int rem_reg_rules = 0, r = 0;
4608         u32 num_rules = 0, rule_idx = 0, size_of_regd;
4609         u8 dfs_region = 0;
4610         struct ieee80211_regdomain *rd = NULL;
4611
4612         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4613                 return -EINVAL;
4614
4615         if (!info->attrs[NL80211_ATTR_REG_RULES])
4616                 return -EINVAL;
4617
4618         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4619
4620         if (info->attrs[NL80211_ATTR_DFS_REGION])
4621                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
4622
4623         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
4624                             rem_reg_rules) {
4625                 num_rules++;
4626                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
4627                         return -EINVAL;
4628         }
4629
4630         size_of_regd = sizeof(struct ieee80211_regdomain) +
4631                        num_rules * sizeof(struct ieee80211_reg_rule);
4632
4633         rd = kzalloc(size_of_regd, GFP_KERNEL);
4634         if (!rd)
4635                 return -ENOMEM;
4636
4637         rd->n_reg_rules = num_rules;
4638         rd->alpha2[0] = alpha2[0];
4639         rd->alpha2[1] = alpha2[1];
4640
4641         /*
4642          * Disable DFS master mode if the DFS region was
4643          * not supported or known on this kernel.
4644          */
4645         if (reg_supported_dfs_region(dfs_region))
4646                 rd->dfs_region = dfs_region;
4647
4648         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
4649                             rem_reg_rules) {
4650                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
4651                           nla_data(nl_reg_rule), nla_len(nl_reg_rule),
4652                           reg_rule_policy);
4653                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
4654                 if (r)
4655                         goto bad_reg;
4656
4657                 rule_idx++;
4658
4659                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
4660                         r = -EINVAL;
4661                         goto bad_reg;
4662                 }
4663         }
4664
4665         mutex_lock(&cfg80211_mutex);
4666
4667         r = set_regdom(rd);
4668         /* set_regdom took ownership */
4669         rd = NULL;
4670         mutex_unlock(&cfg80211_mutex);
4671
4672  bad_reg:
4673         kfree(rd);
4674         return r;
4675 }
4676
4677 static int validate_scan_freqs(struct nlattr *freqs)
4678 {
4679         struct nlattr *attr1, *attr2;
4680         int n_channels = 0, tmp1, tmp2;
4681
4682         nla_for_each_nested(attr1, freqs, tmp1) {
4683                 n_channels++;
4684                 /*
4685                  * Some hardware has a limited channel list for
4686                  * scanning, and it is pretty much nonsensical
4687                  * to scan for a channel twice, so disallow that
4688                  * and don't require drivers to check that the
4689                  * channel list they get isn't longer than what
4690                  * they can scan, as long as they can scan all
4691                  * the channels they registered at once.
4692                  */
4693                 nla_for_each_nested(attr2, freqs, tmp2)
4694                         if (attr1 != attr2 &&
4695                             nla_get_u32(attr1) == nla_get_u32(attr2))
4696                                 return 0;
4697         }
4698
4699         return n_channels;
4700 }
4701
4702 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
4703 {
4704         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4705         struct wireless_dev *wdev = info->user_ptr[1];
4706         struct cfg80211_scan_request *request;
4707         struct nlattr *attr;
4708         struct wiphy *wiphy;
4709         int err, tmp, n_ssids = 0, n_channels, i;
4710         size_t ie_len;
4711
4712         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4713                 return -EINVAL;
4714
4715         wiphy = &rdev->wiphy;
4716
4717         if (!rdev->ops->scan)
4718                 return -EOPNOTSUPP;
4719
4720         if (rdev->scan_req)
4721                 return -EBUSY;
4722
4723         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4724                 n_channels = validate_scan_freqs(
4725                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
4726                 if (!n_channels)
4727                         return -EINVAL;
4728         } else {
4729                 enum ieee80211_band band;
4730                 n_channels = 0;
4731
4732                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
4733                         if (wiphy->bands[band])
4734                                 n_channels += wiphy->bands[band]->n_channels;
4735         }
4736
4737         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
4738                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
4739                         n_ssids++;
4740
4741         if (n_ssids > wiphy->max_scan_ssids)
4742                 return -EINVAL;
4743
4744         if (info->attrs[NL80211_ATTR_IE])
4745                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4746         else
4747                 ie_len = 0;
4748
4749         if (ie_len > wiphy->max_scan_ie_len)
4750                 return -EINVAL;
4751
4752         request = kzalloc(sizeof(*request)
4753                         + sizeof(*request->ssids) * n_ssids
4754                         + sizeof(*request->channels) * n_channels
4755                         + ie_len, GFP_KERNEL);
4756         if (!request)
4757                 return -ENOMEM;
4758
4759         if (n_ssids)
4760                 request->ssids = (void *)&request->channels[n_channels];
4761         request->n_ssids = n_ssids;
4762         if (ie_len) {
4763                 if (request->ssids)
4764                         request->ie = (void *)(request->ssids + n_ssids);
4765                 else
4766                         request->ie = (void *)(request->channels + n_channels);
4767         }
4768
4769         i = 0;
4770         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4771                 /* user specified, bail out if channel not found */
4772                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
4773                         struct ieee80211_channel *chan;
4774
4775                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
4776
4777                         if (!chan) {
4778                                 err = -EINVAL;
4779                                 goto out_free;
4780                         }
4781
4782                         /* ignore disabled channels */
4783                         if (chan->flags & IEEE80211_CHAN_DISABLED)
4784                                 continue;
4785
4786                         request->channels[i] = chan;
4787                         i++;
4788                 }
4789         } else {
4790                 enum ieee80211_band band;
4791
4792                 /* all channels */
4793                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
4794                         int j;
4795                         if (!wiphy->bands[band])
4796                                 continue;
4797                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
4798                                 struct ieee80211_channel *chan;
4799
4800                                 chan = &wiphy->bands[band]->channels[j];
4801
4802                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
4803                                         continue;
4804
4805                                 request->channels[i] = chan;
4806                                 i++;
4807                         }
4808                 }
4809         }
4810
4811         if (!i) {
4812                 err = -EINVAL;
4813                 goto out_free;
4814         }
4815
4816         request->n_channels = i;
4817
4818         i = 0;
4819         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
4820                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
4821                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
4822                                 err = -EINVAL;
4823                                 goto out_free;
4824                         }
4825                         request->ssids[i].ssid_len = nla_len(attr);
4826                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
4827                         i++;
4828                 }
4829         }
4830
4831         if (info->attrs[NL80211_ATTR_IE]) {
4832                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4833                 memcpy((void *)request->ie,
4834                        nla_data(info->attrs[NL80211_ATTR_IE]),
4835                        request->ie_len);
4836         }
4837
4838         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
4839                 if (wiphy->bands[i])
4840                         request->rates[i] =
4841                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
4842
4843         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
4844                 nla_for_each_nested(attr,
4845                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
4846                                     tmp) {
4847                         enum ieee80211_band band = nla_type(attr);
4848
4849                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
4850                                 err = -EINVAL;
4851                                 goto out_free;
4852                         }
4853                         err = ieee80211_get_ratemask(wiphy->bands[band],
4854                                                      nla_data(attr),
4855                                                      nla_len(attr),
4856                                                      &request->rates[band]);
4857                         if (err)
4858                                 goto out_free;
4859                 }
4860         }
4861
4862         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
4863                 request->flags = nla_get_u32(
4864                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
4865                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
4866                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
4867                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
4868                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
4869                         err = -EOPNOTSUPP;
4870                         goto out_free;
4871                 }
4872         }
4873
4874         request->no_cck =
4875                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
4876
4877         request->wdev = wdev;
4878         request->wiphy = &rdev->wiphy;
4879         request->scan_start = jiffies;
4880
4881         rdev->scan_req = request;
4882         err = rdev_scan(rdev, request);
4883
4884         if (!err) {
4885                 nl80211_send_scan_start(rdev, wdev);
4886                 if (wdev->netdev)
4887                         dev_hold(wdev->netdev);
4888         } else {
4889  out_free:
4890                 rdev->scan_req = NULL;
4891                 kfree(request);
4892         }
4893
4894         return err;
4895 }
4896
4897 static int nl80211_start_sched_scan(struct sk_buff *skb,
4898                                     struct genl_info *info)
4899 {
4900         struct cfg80211_sched_scan_request *request;
4901         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4902         struct net_device *dev = info->user_ptr[1];
4903         struct nlattr *attr;
4904         struct wiphy *wiphy;
4905         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
4906         u32 interval;
4907         enum ieee80211_band band;
4908         size_t ie_len;
4909         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
4910
4911         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
4912             !rdev->ops->sched_scan_start)
4913                 return -EOPNOTSUPP;
4914
4915         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4916                 return -EINVAL;
4917
4918         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
4919                 return -EINVAL;
4920
4921         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
4922         if (interval == 0)
4923                 return -EINVAL;
4924
4925         wiphy = &rdev->wiphy;
4926
4927         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4928                 n_channels = validate_scan_freqs(
4929                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
4930                 if (!n_channels)
4931                         return -EINVAL;
4932         } else {
4933                 n_channels = 0;
4934
4935                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
4936                         if (wiphy->bands[band])
4937                                 n_channels += wiphy->bands[band]->n_channels;
4938         }
4939
4940         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
4941                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
4942                                     tmp)
4943                         n_ssids++;
4944
4945         if (n_ssids > wiphy->max_sched_scan_ssids)
4946                 return -EINVAL;
4947
4948         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
4949                 nla_for_each_nested(attr,
4950                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
4951                                     tmp)
4952                         n_match_sets++;
4953
4954         if (n_match_sets > wiphy->max_match_sets)
4955                 return -EINVAL;
4956
4957         if (info->attrs[NL80211_ATTR_IE])
4958                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4959         else
4960                 ie_len = 0;
4961
4962         if (ie_len > wiphy->max_sched_scan_ie_len)
4963                 return -EINVAL;
4964
4965         mutex_lock(&rdev->sched_scan_mtx);
4966
4967         if (rdev->sched_scan_req) {
4968                 err = -EINPROGRESS;
4969                 goto out;
4970         }
4971
4972         request = kzalloc(sizeof(*request)
4973                         + sizeof(*request->ssids) * n_ssids
4974                         + sizeof(*request->match_sets) * n_match_sets
4975                         + sizeof(*request->channels) * n_channels
4976                         + ie_len, GFP_KERNEL);
4977         if (!request) {
4978                 err = -ENOMEM;
4979                 goto out;
4980         }
4981
4982         if (n_ssids)
4983                 request->ssids = (void *)&request->channels[n_channels];
4984         request->n_ssids = n_ssids;
4985         if (ie_len) {
4986                 if (request->ssids)
4987                         request->ie = (void *)(request->ssids + n_ssids);
4988                 else
4989                         request->ie = (void *)(request->channels + n_channels);
4990         }
4991
4992         if (n_match_sets) {
4993                 if (request->ie)
4994                         request->match_sets = (void *)(request->ie + ie_len);
4995                 else if (request->ssids)
4996                         request->match_sets =
4997                                 (void *)(request->ssids + n_ssids);
4998                 else
4999                         request->match_sets =
5000                                 (void *)(request->channels + n_channels);
5001         }
5002         request->n_match_sets = n_match_sets;
5003
5004         i = 0;
5005         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5006                 /* user specified, bail out if channel not found */
5007                 nla_for_each_nested(attr,
5008                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
5009                                     tmp) {
5010                         struct ieee80211_channel *chan;
5011
5012                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5013
5014                         if (!chan) {
5015                                 err = -EINVAL;
5016                                 goto out_free;
5017                         }
5018
5019                         /* ignore disabled channels */
5020                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5021                                 continue;
5022
5023                         request->channels[i] = chan;
5024                         i++;
5025                 }
5026         } else {
5027                 /* all channels */
5028                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5029                         int j;
5030                         if (!wiphy->bands[band])
5031                                 continue;
5032                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5033                                 struct ieee80211_channel *chan;
5034
5035                                 chan = &wiphy->bands[band]->channels[j];
5036
5037                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5038                                         continue;
5039
5040                                 request->channels[i] = chan;
5041                                 i++;
5042                         }
5043                 }
5044         }
5045
5046         if (!i) {
5047                 err = -EINVAL;
5048                 goto out_free;
5049         }
5050
5051         request->n_channels = i;
5052
5053         i = 0;
5054         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5055                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5056                                     tmp) {
5057                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5058                                 err = -EINVAL;
5059                                 goto out_free;
5060                         }
5061                         request->ssids[i].ssid_len = nla_len(attr);
5062                         memcpy(request->ssids[i].ssid, nla_data(attr),
5063                                nla_len(attr));
5064                         i++;
5065                 }
5066         }
5067
5068         i = 0;
5069         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5070                 nla_for_each_nested(attr,
5071                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5072                                     tmp) {
5073                         struct nlattr *ssid, *rssi;
5074
5075                         nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5076                                   nla_data(attr), nla_len(attr),
5077                                   nl80211_match_policy);
5078                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
5079                         if (ssid) {
5080                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
5081                                         err = -EINVAL;
5082                                         goto out_free;
5083                                 }
5084                                 memcpy(request->match_sets[i].ssid.ssid,
5085                                        nla_data(ssid), nla_len(ssid));
5086                                 request->match_sets[i].ssid.ssid_len =
5087                                         nla_len(ssid);
5088                         }
5089                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5090                         if (rssi)
5091                                 request->rssi_thold = nla_get_u32(rssi);
5092                         else
5093                                 request->rssi_thold =
5094                                                    NL80211_SCAN_RSSI_THOLD_OFF;
5095                         i++;
5096                 }
5097         }
5098
5099         if (info->attrs[NL80211_ATTR_IE]) {
5100                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5101                 memcpy((void *)request->ie,
5102                        nla_data(info->attrs[NL80211_ATTR_IE]),
5103                        request->ie_len);
5104         }
5105
5106         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5107                 request->flags = nla_get_u32(
5108                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5109                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5110                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
5111                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
5112                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
5113                         err = -EOPNOTSUPP;
5114                         goto out_free;
5115                 }
5116         }
5117
5118         request->dev = dev;
5119         request->wiphy = &rdev->wiphy;
5120         request->interval = interval;
5121         request->scan_start = jiffies;
5122
5123         err = rdev_sched_scan_start(rdev, dev, request);
5124         if (!err) {
5125                 rdev->sched_scan_req = request;
5126                 nl80211_send_sched_scan(rdev, dev,
5127                                         NL80211_CMD_START_SCHED_SCAN);
5128                 goto out;
5129         }
5130
5131 out_free:
5132         kfree(request);
5133 out:
5134         mutex_unlock(&rdev->sched_scan_mtx);
5135         return err;
5136 }
5137
5138 static int nl80211_stop_sched_scan(struct sk_buff *skb,
5139                                    struct genl_info *info)
5140 {
5141         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5142         int err;
5143
5144         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5145             !rdev->ops->sched_scan_stop)
5146                 return -EOPNOTSUPP;
5147
5148         mutex_lock(&rdev->sched_scan_mtx);
5149         err = __cfg80211_stop_sched_scan(rdev, false);
5150         mutex_unlock(&rdev->sched_scan_mtx);
5151
5152         return err;
5153 }
5154
5155 static int nl80211_start_radar_detection(struct sk_buff *skb,
5156                                          struct genl_info *info)
5157 {
5158         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5159         struct net_device *dev = info->user_ptr[1];
5160         struct wireless_dev *wdev = dev->ieee80211_ptr;
5161         struct cfg80211_chan_def chandef;
5162         int err;
5163
5164         err = nl80211_parse_chandef(rdev, info, &chandef);
5165         if (err)
5166                 return err;
5167
5168         if (wdev->cac_started)
5169                 return -EBUSY;
5170
5171         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef);
5172         if (err < 0)
5173                 return err;
5174
5175         if (err == 0)
5176                 return -EINVAL;
5177
5178         if (chandef.chan->dfs_state != NL80211_DFS_USABLE)
5179                 return -EINVAL;
5180
5181         if (!rdev->ops->start_radar_detection)
5182                 return -EOPNOTSUPP;
5183
5184         mutex_lock(&rdev->devlist_mtx);
5185         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
5186                                            chandef.chan, CHAN_MODE_SHARED,
5187                                            BIT(chandef.width));
5188         if (err)
5189                 goto err_locked;
5190
5191         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef);
5192         if (!err) {
5193                 wdev->channel = chandef.chan;
5194                 wdev->cac_started = true;
5195                 wdev->cac_start_time = jiffies;
5196         }
5197 err_locked:
5198         mutex_unlock(&rdev->devlist_mtx);
5199
5200         return err;
5201 }
5202
5203 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
5204                             u32 seq, int flags,
5205                             struct cfg80211_registered_device *rdev,
5206                             struct wireless_dev *wdev,
5207                             struct cfg80211_internal_bss *intbss)
5208 {
5209         struct cfg80211_bss *res = &intbss->pub;
5210         const struct cfg80211_bss_ies *ies;
5211         void *hdr;
5212         struct nlattr *bss;
5213         bool tsf = false;
5214
5215         ASSERT_WDEV_LOCK(wdev);
5216
5217         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
5218                              NL80211_CMD_NEW_SCAN_RESULTS);
5219         if (!hdr)
5220                 return -1;
5221
5222         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
5223
5224         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation) ||
5225             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
5226                 goto nla_put_failure;
5227
5228         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
5229         if (!bss)
5230                 goto nla_put_failure;
5231         if ((!is_zero_ether_addr(res->bssid) &&
5232              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
5233                 goto nla_put_failure;
5234
5235         rcu_read_lock();
5236         ies = rcu_dereference(res->ies);
5237         if (ies) {
5238                 if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5239                         goto fail_unlock_rcu;
5240                 tsf = true;
5241                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
5242                                         ies->len, ies->data))
5243                         goto fail_unlock_rcu;
5244         }
5245         ies = rcu_dereference(res->beacon_ies);
5246         if (ies) {
5247                 if (!tsf && nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5248                         goto fail_unlock_rcu;
5249                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
5250                                         ies->len, ies->data))
5251                         goto fail_unlock_rcu;
5252         }
5253         rcu_read_unlock();
5254
5255         if (res->beacon_interval &&
5256             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
5257                 goto nla_put_failure;
5258         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
5259             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
5260             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
5261                         jiffies_to_msecs(jiffies - intbss->ts)))
5262                 goto nla_put_failure;
5263
5264         switch (rdev->wiphy.signal_type) {
5265         case CFG80211_SIGNAL_TYPE_MBM:
5266                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
5267                         goto nla_put_failure;
5268                 break;
5269         case CFG80211_SIGNAL_TYPE_UNSPEC:
5270                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
5271                         goto nla_put_failure;
5272                 break;
5273         default:
5274                 break;
5275         }
5276
5277         switch (wdev->iftype) {
5278         case NL80211_IFTYPE_P2P_CLIENT:
5279         case NL80211_IFTYPE_STATION:
5280                 if (intbss == wdev->current_bss &&
5281                     nla_put_u32(msg, NL80211_BSS_STATUS,
5282                                 NL80211_BSS_STATUS_ASSOCIATED))
5283                         goto nla_put_failure;
5284                 break;
5285         case NL80211_IFTYPE_ADHOC:
5286                 if (intbss == wdev->current_bss &&
5287                     nla_put_u32(msg, NL80211_BSS_STATUS,
5288                                 NL80211_BSS_STATUS_IBSS_JOINED))
5289                         goto nla_put_failure;
5290                 break;
5291         default:
5292                 break;
5293         }
5294
5295         nla_nest_end(msg, bss);
5296
5297         return genlmsg_end(msg, hdr);
5298
5299  fail_unlock_rcu:
5300         rcu_read_unlock();
5301  nla_put_failure:
5302         genlmsg_cancel(msg, hdr);
5303         return -EMSGSIZE;
5304 }
5305
5306 static int nl80211_dump_scan(struct sk_buff *skb,
5307                              struct netlink_callback *cb)
5308 {
5309         struct cfg80211_registered_device *rdev;
5310         struct net_device *dev;
5311         struct cfg80211_internal_bss *scan;
5312         struct wireless_dev *wdev;
5313         int start = cb->args[1], idx = 0;
5314         int err;
5315
5316         err = nl80211_prepare_netdev_dump(skb, cb, &rdev, &dev);
5317         if (err)
5318                 return err;
5319
5320         wdev = dev->ieee80211_ptr;
5321
5322         wdev_lock(wdev);
5323         spin_lock_bh(&rdev->bss_lock);
5324         cfg80211_bss_expire(rdev);
5325
5326         cb->seq = rdev->bss_generation;
5327
5328         list_for_each_entry(scan, &rdev->bss_list, list) {
5329                 if (++idx <= start)
5330                         continue;
5331                 if (nl80211_send_bss(skb, cb,
5332                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5333                                 rdev, wdev, scan) < 0) {
5334                         idx--;
5335                         break;
5336                 }
5337         }
5338
5339         spin_unlock_bh(&rdev->bss_lock);
5340         wdev_unlock(wdev);
5341
5342         cb->args[1] = idx;
5343         nl80211_finish_netdev_dump(rdev);
5344
5345         return skb->len;
5346 }
5347
5348 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
5349                                 int flags, struct net_device *dev,
5350                                 struct survey_info *survey)
5351 {
5352         void *hdr;
5353         struct nlattr *infoattr;
5354
5355         hdr = nl80211hdr_put(msg, portid, seq, flags,
5356                              NL80211_CMD_NEW_SURVEY_RESULTS);
5357         if (!hdr)
5358                 return -ENOMEM;
5359
5360         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
5361                 goto nla_put_failure;
5362
5363         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
5364         if (!infoattr)
5365                 goto nla_put_failure;
5366
5367         if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
5368                         survey->channel->center_freq))
5369                 goto nla_put_failure;
5370
5371         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
5372             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
5373                 goto nla_put_failure;
5374         if ((survey->filled & SURVEY_INFO_IN_USE) &&
5375             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
5376                 goto nla_put_failure;
5377         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
5378             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
5379                         survey->channel_time))
5380                 goto nla_put_failure;
5381         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
5382             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
5383                         survey->channel_time_busy))
5384                 goto nla_put_failure;
5385         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
5386             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
5387                         survey->channel_time_ext_busy))
5388                 goto nla_put_failure;
5389         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
5390             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
5391                         survey->channel_time_rx))
5392                 goto nla_put_failure;
5393         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
5394             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
5395                         survey->channel_time_tx))
5396                 goto nla_put_failure;
5397
5398         nla_nest_end(msg, infoattr);
5399
5400         return genlmsg_end(msg, hdr);
5401
5402  nla_put_failure:
5403         genlmsg_cancel(msg, hdr);
5404         return -EMSGSIZE;
5405 }
5406
5407 static int nl80211_dump_survey(struct sk_buff *skb,
5408                         struct netlink_callback *cb)
5409 {
5410         struct survey_info survey;
5411         struct cfg80211_registered_device *dev;
5412         struct net_device *netdev;
5413         int survey_idx = cb->args[1];
5414         int res;
5415
5416         res = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
5417         if (res)
5418                 return res;
5419
5420         if (!dev->ops->dump_survey) {
5421                 res = -EOPNOTSUPP;
5422                 goto out_err;
5423         }
5424
5425         while (1) {
5426                 struct ieee80211_channel *chan;
5427
5428                 res = rdev_dump_survey(dev, netdev, survey_idx, &survey);
5429                 if (res == -ENOENT)
5430                         break;
5431                 if (res)
5432                         goto out_err;
5433
5434                 /* Survey without a channel doesn't make sense */
5435                 if (!survey.channel) {
5436                         res = -EINVAL;
5437                         goto out;
5438                 }
5439
5440                 chan = ieee80211_get_channel(&dev->wiphy,
5441                                              survey.channel->center_freq);
5442                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
5443                         survey_idx++;
5444                         continue;
5445                 }
5446
5447                 if (nl80211_send_survey(skb,
5448                                 NETLINK_CB(cb->skb).portid,
5449                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5450                                 netdev,
5451                                 &survey) < 0)
5452                         goto out;
5453                 survey_idx++;
5454         }
5455
5456  out:
5457         cb->args[1] = survey_idx;
5458         res = skb->len;
5459  out_err:
5460         nl80211_finish_netdev_dump(dev);
5461         return res;
5462 }
5463
5464 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
5465 {
5466         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
5467                                   NL80211_WPA_VERSION_2));
5468 }
5469
5470 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
5471 {
5472         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5473         struct net_device *dev = info->user_ptr[1];
5474         struct ieee80211_channel *chan;
5475         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
5476         int err, ssid_len, ie_len = 0, sae_data_len = 0;
5477         enum nl80211_auth_type auth_type;
5478         struct key_parse key;
5479         bool local_state_change;
5480
5481         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5482                 return -EINVAL;
5483
5484         if (!info->attrs[NL80211_ATTR_MAC])
5485                 return -EINVAL;
5486
5487         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
5488                 return -EINVAL;
5489
5490         if (!info->attrs[NL80211_ATTR_SSID])
5491                 return -EINVAL;
5492
5493         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
5494                 return -EINVAL;
5495
5496         err = nl80211_parse_key(info, &key);
5497         if (err)
5498                 return err;
5499
5500         if (key.idx >= 0) {
5501                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
5502                         return -EINVAL;
5503                 if (!key.p.key || !key.p.key_len)
5504                         return -EINVAL;
5505                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
5506                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
5507                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
5508                      key.p.key_len != WLAN_KEY_LEN_WEP104))
5509                         return -EINVAL;
5510                 if (key.idx > 4)
5511                         return -EINVAL;
5512         } else {
5513                 key.p.key_len = 0;
5514                 key.p.key = NULL;
5515         }
5516
5517         if (key.idx >= 0) {
5518                 int i;
5519                 bool ok = false;
5520                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
5521                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
5522                                 ok = true;
5523                                 break;
5524                         }
5525                 }
5526                 if (!ok)
5527                         return -EINVAL;
5528         }
5529
5530         if (!rdev->ops->auth)
5531                 return -EOPNOTSUPP;
5532
5533         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5534             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5535                 return -EOPNOTSUPP;
5536
5537         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5538         chan = ieee80211_get_channel(&rdev->wiphy,
5539                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5540         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
5541                 return -EINVAL;
5542
5543         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5544         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5545
5546         if (info->attrs[NL80211_ATTR_IE]) {
5547                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5548                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5549         }
5550
5551         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
5552         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
5553                 return -EINVAL;
5554
5555         if (auth_type == NL80211_AUTHTYPE_SAE &&
5556             !info->attrs[NL80211_ATTR_SAE_DATA])
5557                 return -EINVAL;
5558
5559         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
5560                 if (auth_type != NL80211_AUTHTYPE_SAE)
5561                         return -EINVAL;
5562                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
5563                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
5564                 /* need to include at least Auth Transaction and Status Code */
5565                 if (sae_data_len < 4)
5566                         return -EINVAL;
5567         }
5568
5569         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5570
5571         /*
5572          * Since we no longer track auth state, ignore
5573          * requests to only change local state.
5574          */
5575         if (local_state_change)
5576                 return 0;
5577
5578         return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
5579                                   ssid, ssid_len, ie, ie_len,
5580                                   key.p.key, key.p.key_len, key.idx,
5581                                   sae_data, sae_data_len);
5582 }
5583
5584 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
5585                                    struct genl_info *info,
5586                                    struct cfg80211_crypto_settings *settings,
5587                                    int cipher_limit)
5588 {
5589         memset(settings, 0, sizeof(*settings));
5590
5591         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
5592
5593         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
5594                 u16 proto;
5595                 proto = nla_get_u16(
5596                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
5597                 settings->control_port_ethertype = cpu_to_be16(proto);
5598                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
5599                     proto != ETH_P_PAE)
5600                         return -EINVAL;
5601                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
5602                         settings->control_port_no_encrypt = true;
5603         } else
5604                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
5605
5606         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
5607                 void *data;
5608                 int len, i;
5609
5610                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5611                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5612                 settings->n_ciphers_pairwise = len / sizeof(u32);
5613
5614                 if (len % sizeof(u32))
5615                         return -EINVAL;
5616
5617                 if (settings->n_ciphers_pairwise > cipher_limit)
5618                         return -EINVAL;
5619
5620                 memcpy(settings->ciphers_pairwise, data, len);
5621
5622                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
5623                         if (!cfg80211_supported_cipher_suite(
5624                                         &rdev->wiphy,
5625                                         settings->ciphers_pairwise[i]))
5626                                 return -EINVAL;
5627         }
5628
5629         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
5630                 settings->cipher_group =
5631                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
5632                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
5633                                                      settings->cipher_group))
5634                         return -EINVAL;
5635         }
5636
5637         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
5638                 settings->wpa_versions =
5639                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
5640                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
5641                         return -EINVAL;
5642         }
5643
5644         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
5645                 void *data;
5646                 int len;
5647
5648                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
5649                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
5650                 settings->n_akm_suites = len / sizeof(u32);
5651
5652                 if (len % sizeof(u32))
5653                         return -EINVAL;
5654
5655                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
5656                         return -EINVAL;
5657
5658                 memcpy(settings->akm_suites, data, len);
5659         }
5660
5661         return 0;
5662 }
5663
5664 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
5665 {
5666         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5667         struct net_device *dev = info->user_ptr[1];
5668         struct cfg80211_crypto_settings crypto;
5669         struct ieee80211_channel *chan;
5670         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
5671         int err, ssid_len, ie_len = 0;
5672         bool use_mfp = false;
5673         u32 flags = 0;
5674         struct ieee80211_ht_cap *ht_capa = NULL;
5675         struct ieee80211_ht_cap *ht_capa_mask = NULL;
5676
5677         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5678                 return -EINVAL;
5679
5680         if (!info->attrs[NL80211_ATTR_MAC] ||
5681             !info->attrs[NL80211_ATTR_SSID] ||
5682             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
5683                 return -EINVAL;
5684
5685         if (!rdev->ops->assoc)
5686                 return -EOPNOTSUPP;
5687
5688         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5689             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5690                 return -EOPNOTSUPP;
5691
5692         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5693
5694         chan = ieee80211_get_channel(&rdev->wiphy,
5695                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5696         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
5697                 return -EINVAL;
5698
5699         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5700         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5701
5702         if (info->attrs[NL80211_ATTR_IE]) {
5703                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5704                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5705         }
5706
5707         if (info->attrs[NL80211_ATTR_USE_MFP]) {
5708                 enum nl80211_mfp mfp =
5709                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
5710                 if (mfp == NL80211_MFP_REQUIRED)
5711                         use_mfp = true;
5712                 else if (mfp != NL80211_MFP_NO)
5713                         return -EINVAL;
5714         }
5715
5716         if (info->attrs[NL80211_ATTR_PREV_BSSID])
5717                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
5718
5719         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
5720                 flags |= ASSOC_REQ_DISABLE_HT;
5721
5722         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
5723                 ht_capa_mask =
5724                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]);
5725
5726         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
5727                 if (!ht_capa_mask)
5728                         return -EINVAL;
5729                 ht_capa = nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5730         }
5731
5732         err = nl80211_crypto_settings(rdev, info, &crypto, 1);
5733         if (!err)
5734                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
5735                                           ssid, ssid_len, ie, ie_len, use_mfp,
5736                                           &crypto, flags, ht_capa,
5737                                           ht_capa_mask);
5738
5739         return err;
5740 }
5741
5742 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
5743 {
5744         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5745         struct net_device *dev = info->user_ptr[1];
5746         const u8 *ie = NULL, *bssid;
5747         int ie_len = 0;
5748         u16 reason_code;
5749         bool local_state_change;
5750
5751         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5752                 return -EINVAL;
5753
5754         if (!info->attrs[NL80211_ATTR_MAC])
5755                 return -EINVAL;
5756
5757         if (!info->attrs[NL80211_ATTR_REASON_CODE])
5758                 return -EINVAL;
5759
5760         if (!rdev->ops->deauth)
5761                 return -EOPNOTSUPP;
5762
5763         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5764             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5765                 return -EOPNOTSUPP;
5766
5767         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5768
5769         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5770         if (reason_code == 0) {
5771                 /* Reason Code 0 is reserved */
5772                 return -EINVAL;
5773         }
5774
5775         if (info->attrs[NL80211_ATTR_IE]) {
5776                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5777                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5778         }
5779
5780         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5781
5782         return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
5783                                     local_state_change);
5784 }
5785
5786 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
5787 {
5788         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5789         struct net_device *dev = info->user_ptr[1];
5790         const u8 *ie = NULL, *bssid;
5791         int ie_len = 0;
5792         u16 reason_code;
5793         bool local_state_change;
5794
5795         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5796                 return -EINVAL;
5797
5798         if (!info->attrs[NL80211_ATTR_MAC])
5799                 return -EINVAL;
5800
5801         if (!info->attrs[NL80211_ATTR_REASON_CODE])
5802                 return -EINVAL;
5803
5804         if (!rdev->ops->disassoc)
5805                 return -EOPNOTSUPP;
5806
5807         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5808             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5809                 return -EOPNOTSUPP;
5810
5811         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5812
5813         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5814         if (reason_code == 0) {
5815                 /* Reason Code 0 is reserved */
5816                 return -EINVAL;
5817         }
5818
5819         if (info->attrs[NL80211_ATTR_IE]) {
5820                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5821                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5822         }
5823
5824         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5825
5826         return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
5827                                       local_state_change);
5828 }
5829
5830 static bool
5831 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
5832                          int mcast_rate[IEEE80211_NUM_BANDS],
5833                          int rateval)
5834 {
5835         struct wiphy *wiphy = &rdev->wiphy;
5836         bool found = false;
5837         int band, i;
5838
5839         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5840                 struct ieee80211_supported_band *sband;
5841
5842                 sband = wiphy->bands[band];
5843                 if (!sband)
5844                         continue;
5845
5846                 for (i = 0; i < sband->n_bitrates; i++) {
5847                         if (sband->bitrates[i].bitrate == rateval) {
5848                                 mcast_rate[band] = i + 1;
5849                                 found = true;
5850                                 break;
5851                         }
5852                 }
5853         }
5854
5855         return found;
5856 }
5857
5858 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
5859 {
5860         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5861         struct net_device *dev = info->user_ptr[1];
5862         struct cfg80211_ibss_params ibss;
5863         struct wiphy *wiphy;
5864         struct cfg80211_cached_keys *connkeys = NULL;
5865         int err;
5866
5867         memset(&ibss, 0, sizeof(ibss));
5868
5869         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5870                 return -EINVAL;
5871
5872         if (!info->attrs[NL80211_ATTR_SSID] ||
5873             !nla_len(info->attrs[NL80211_ATTR_SSID]))
5874                 return -EINVAL;
5875
5876         ibss.beacon_interval = 100;
5877
5878         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
5879                 ibss.beacon_interval =
5880                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
5881                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
5882                         return -EINVAL;
5883         }
5884
5885         if (!rdev->ops->join_ibss)
5886                 return -EOPNOTSUPP;
5887
5888         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
5889                 return -EOPNOTSUPP;
5890
5891         wiphy = &rdev->wiphy;
5892
5893         if (info->attrs[NL80211_ATTR_MAC]) {
5894                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5895
5896                 if (!is_valid_ether_addr(ibss.bssid))
5897                         return -EINVAL;
5898         }
5899         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5900         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5901
5902         if (info->attrs[NL80211_ATTR_IE]) {
5903                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5904                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5905         }
5906
5907         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
5908         if (err)
5909                 return err;
5910
5911         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef))
5912                 return -EINVAL;
5913
5914         if (ibss.chandef.width > NL80211_CHAN_WIDTH_40)
5915                 return -EINVAL;
5916         if (ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
5917             !(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
5918                 return -EINVAL;
5919
5920         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
5921         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
5922
5923         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
5924                 u8 *rates =
5925                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5926                 int n_rates =
5927                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5928                 struct ieee80211_supported_band *sband =
5929                         wiphy->bands[ibss.chandef.chan->band];
5930
5931                 err = ieee80211_get_ratemask(sband, rates, n_rates,
5932                                              &ibss.basic_rates);
5933                 if (err)
5934                         return err;
5935         }
5936
5937         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
5938             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
5939                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
5940                 return -EINVAL;
5941
5942         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
5943                 bool no_ht = false;
5944
5945                 connkeys = nl80211_parse_connkeys(rdev,
5946                                           info->attrs[NL80211_ATTR_KEYS],
5947                                           &no_ht);
5948                 if (IS_ERR(connkeys))
5949                         return PTR_ERR(connkeys);
5950
5951                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
5952                     no_ht) {
5953                         kfree(connkeys);
5954                         return -EINVAL;
5955                 }
5956         }
5957
5958         ibss.control_port =
5959                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
5960
5961         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
5962         if (err)
5963                 kfree(connkeys);
5964         return err;
5965 }
5966
5967 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
5968 {
5969         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5970         struct net_device *dev = info->user_ptr[1];
5971
5972         if (!rdev->ops->leave_ibss)
5973                 return -EOPNOTSUPP;
5974
5975         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
5976                 return -EOPNOTSUPP;
5977
5978         return cfg80211_leave_ibss(rdev, dev, false);
5979 }
5980
5981 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
5982 {
5983         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5984         struct net_device *dev = info->user_ptr[1];
5985         int mcast_rate[IEEE80211_NUM_BANDS];
5986         u32 nla_rate;
5987         int err;
5988
5989         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
5990             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5991                 return -EOPNOTSUPP;
5992
5993         if (!rdev->ops->set_mcast_rate)
5994                 return -EOPNOTSUPP;
5995
5996         memset(mcast_rate, 0, sizeof(mcast_rate));
5997
5998         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
5999                 return -EINVAL;
6000
6001         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
6002         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
6003                 return -EINVAL;
6004
6005         err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
6006
6007         return err;
6008 }
6009
6010
6011 #ifdef CONFIG_NL80211_TESTMODE
6012 static struct genl_multicast_group nl80211_testmode_mcgrp = {
6013         .name = "testmode",
6014 };
6015
6016 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
6017 {
6018         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6019         int err;
6020
6021         if (!info->attrs[NL80211_ATTR_TESTDATA])
6022                 return -EINVAL;
6023
6024         err = -EOPNOTSUPP;
6025         if (rdev->ops->testmode_cmd) {
6026                 rdev->testmode_info = info;
6027                 err = rdev_testmode_cmd(rdev,
6028                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
6029                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
6030                 rdev->testmode_info = NULL;
6031         }
6032
6033         return err;
6034 }
6035
6036 static int nl80211_testmode_dump(struct sk_buff *skb,
6037                                  struct netlink_callback *cb)
6038 {
6039         struct cfg80211_registered_device *rdev;
6040         int err;
6041         long phy_idx;
6042         void *data = NULL;
6043         int data_len = 0;
6044
6045         if (cb->args[0]) {
6046                 /*
6047                  * 0 is a valid index, but not valid for args[0],
6048                  * so we need to offset by 1.
6049                  */
6050                 phy_idx = cb->args[0] - 1;
6051         } else {
6052                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
6053                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
6054                                   nl80211_policy);
6055                 if (err)
6056                         return err;
6057
6058                 mutex_lock(&cfg80211_mutex);
6059                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
6060                                                   nl80211_fam.attrbuf);
6061                 if (IS_ERR(rdev)) {
6062                         mutex_unlock(&cfg80211_mutex);
6063                         return PTR_ERR(rdev);
6064                 }
6065                 phy_idx = rdev->wiphy_idx;
6066                 rdev = NULL;
6067                 mutex_unlock(&cfg80211_mutex);
6068
6069                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
6070                         cb->args[1] =
6071                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
6072         }
6073
6074         if (cb->args[1]) {
6075                 data = nla_data((void *)cb->args[1]);
6076                 data_len = nla_len((void *)cb->args[1]);
6077         }
6078
6079         mutex_lock(&cfg80211_mutex);
6080         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
6081         if (!rdev) {
6082                 mutex_unlock(&cfg80211_mutex);
6083                 return -ENOENT;
6084         }
6085         cfg80211_lock_rdev(rdev);
6086         mutex_unlock(&cfg80211_mutex);
6087
6088         if (!rdev->ops->testmode_dump) {
6089                 err = -EOPNOTSUPP;
6090                 goto out_err;
6091         }
6092
6093         while (1) {
6094                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
6095                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
6096                                            NL80211_CMD_TESTMODE);
6097                 struct nlattr *tmdata;
6098
6099                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
6100                         genlmsg_cancel(skb, hdr);
6101                         break;
6102                 }
6103
6104                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6105                 if (!tmdata) {
6106                         genlmsg_cancel(skb, hdr);
6107                         break;
6108                 }
6109                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
6110                 nla_nest_end(skb, tmdata);
6111
6112                 if (err == -ENOBUFS || err == -ENOENT) {
6113                         genlmsg_cancel(skb, hdr);
6114                         break;
6115                 } else if (err) {
6116                         genlmsg_cancel(skb, hdr);
6117                         goto out_err;
6118                 }
6119
6120                 genlmsg_end(skb, hdr);
6121         }
6122
6123         err = skb->len;
6124         /* see above */
6125         cb->args[0] = phy_idx + 1;
6126  out_err:
6127         cfg80211_unlock_rdev(rdev);
6128         return err;
6129 }
6130
6131 static struct sk_buff *
6132 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
6133                               int approxlen, u32 portid, u32 seq, gfp_t gfp)
6134 {
6135         struct sk_buff *skb;
6136         void *hdr;
6137         struct nlattr *data;
6138
6139         skb = nlmsg_new(approxlen + 100, gfp);
6140         if (!skb)
6141                 return NULL;
6142
6143         hdr = nl80211hdr_put(skb, portid, seq, 0, NL80211_CMD_TESTMODE);
6144         if (!hdr) {
6145                 kfree_skb(skb);
6146                 return NULL;
6147         }
6148
6149         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
6150                 goto nla_put_failure;
6151         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6152
6153         ((void **)skb->cb)[0] = rdev;
6154         ((void **)skb->cb)[1] = hdr;
6155         ((void **)skb->cb)[2] = data;
6156
6157         return skb;
6158
6159  nla_put_failure:
6160         kfree_skb(skb);
6161         return NULL;
6162 }
6163
6164 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
6165                                                   int approxlen)
6166 {
6167         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6168
6169         if (WARN_ON(!rdev->testmode_info))
6170                 return NULL;
6171
6172         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
6173                                 rdev->testmode_info->snd_portid,
6174                                 rdev->testmode_info->snd_seq,
6175                                 GFP_KERNEL);
6176 }
6177 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
6178
6179 int cfg80211_testmode_reply(struct sk_buff *skb)
6180 {
6181         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
6182         void *hdr = ((void **)skb->cb)[1];
6183         struct nlattr *data = ((void **)skb->cb)[2];
6184
6185         if (WARN_ON(!rdev->testmode_info)) {
6186                 kfree_skb(skb);
6187                 return -EINVAL;
6188         }
6189
6190         nla_nest_end(skb, data);
6191         genlmsg_end(skb, hdr);
6192         return genlmsg_reply(skb, rdev->testmode_info);
6193 }
6194 EXPORT_SYMBOL(cfg80211_testmode_reply);
6195
6196 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
6197                                                   int approxlen, gfp_t gfp)
6198 {
6199         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6200
6201         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
6202 }
6203 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
6204
6205 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
6206 {
6207         void *hdr = ((void **)skb->cb)[1];
6208         struct nlattr *data = ((void **)skb->cb)[2];
6209
6210         nla_nest_end(skb, data);
6211         genlmsg_end(skb, hdr);
6212         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
6213 }
6214 EXPORT_SYMBOL(cfg80211_testmode_event);
6215 #endif
6216
6217 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
6218 {
6219         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6220         struct net_device *dev = info->user_ptr[1];
6221         struct cfg80211_connect_params connect;
6222         struct wiphy *wiphy;
6223         struct cfg80211_cached_keys *connkeys = NULL;
6224         int err;
6225
6226         memset(&connect, 0, sizeof(connect));
6227
6228         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6229                 return -EINVAL;
6230
6231         if (!info->attrs[NL80211_ATTR_SSID] ||
6232             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6233                 return -EINVAL;
6234
6235         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
6236                 connect.auth_type =
6237                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6238                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
6239                                              NL80211_CMD_CONNECT))
6240                         return -EINVAL;
6241         } else
6242                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
6243
6244         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
6245
6246         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
6247                                       NL80211_MAX_NR_CIPHER_SUITES);
6248         if (err)
6249                 return err;
6250
6251         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6252             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6253                 return -EOPNOTSUPP;
6254
6255         wiphy = &rdev->wiphy;
6256
6257         connect.bg_scan_period = -1;
6258         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
6259                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
6260                 connect.bg_scan_period =
6261                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
6262         }
6263
6264         if (info->attrs[NL80211_ATTR_MAC])
6265                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6266         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6267         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6268
6269         if (info->attrs[NL80211_ATTR_IE]) {
6270                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6271                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6272         }
6273
6274         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6275                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6276                 if (connect.mfp != NL80211_MFP_REQUIRED &&
6277                     connect.mfp != NL80211_MFP_NO)
6278                         return -EINVAL;
6279         } else {
6280                 connect.mfp = NL80211_MFP_NO;
6281         }
6282
6283         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6284                 connect.channel =
6285                         ieee80211_get_channel(wiphy,
6286                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6287                 if (!connect.channel ||
6288                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
6289                         return -EINVAL;
6290         }
6291
6292         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6293                 connkeys = nl80211_parse_connkeys(rdev,
6294                                           info->attrs[NL80211_ATTR_KEYS], NULL);
6295                 if (IS_ERR(connkeys))
6296                         return PTR_ERR(connkeys);
6297         }
6298
6299         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6300                 connect.flags |= ASSOC_REQ_DISABLE_HT;
6301
6302         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6303                 memcpy(&connect.ht_capa_mask,
6304                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6305                        sizeof(connect.ht_capa_mask));
6306
6307         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6308                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
6309                         kfree(connkeys);
6310                         return -EINVAL;
6311                 }
6312                 memcpy(&connect.ht_capa,
6313                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6314                        sizeof(connect.ht_capa));
6315         }
6316
6317         err = cfg80211_connect(rdev, dev, &connect, connkeys);
6318         if (err)
6319                 kfree(connkeys);
6320         return err;
6321 }
6322
6323 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
6324 {
6325         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6326         struct net_device *dev = info->user_ptr[1];
6327         u16 reason;
6328
6329         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6330                 reason = WLAN_REASON_DEAUTH_LEAVING;
6331         else
6332                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6333
6334         if (reason == 0)
6335                 return -EINVAL;
6336
6337         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6338             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6339                 return -EOPNOTSUPP;
6340
6341         return cfg80211_disconnect(rdev, dev, reason, true);
6342 }
6343
6344 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
6345 {
6346         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6347         struct net *net;
6348         int err;
6349         u32 pid;
6350
6351         if (!info->attrs[NL80211_ATTR_PID])
6352                 return -EINVAL;
6353
6354         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
6355
6356         net = get_net_ns_by_pid(pid);
6357         if (IS_ERR(net))
6358                 return PTR_ERR(net);
6359
6360         err = 0;
6361
6362         /* check if anything to do */
6363         if (!net_eq(wiphy_net(&rdev->wiphy), net))
6364                 err = cfg80211_switch_netns(rdev, net);
6365
6366         put_net(net);
6367         return err;
6368 }
6369
6370 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
6371 {
6372         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6373         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
6374                         struct cfg80211_pmksa *pmksa) = NULL;
6375         struct net_device *dev = info->user_ptr[1];
6376         struct cfg80211_pmksa pmksa;
6377
6378         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
6379
6380         if (!info->attrs[NL80211_ATTR_MAC])
6381                 return -EINVAL;
6382
6383         if (!info->attrs[NL80211_ATTR_PMKID])
6384                 return -EINVAL;
6385
6386         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
6387         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6388
6389         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6390             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6391                 return -EOPNOTSUPP;
6392
6393         switch (info->genlhdr->cmd) {
6394         case NL80211_CMD_SET_PMKSA:
6395                 rdev_ops = rdev->ops->set_pmksa;
6396                 break;
6397         case NL80211_CMD_DEL_PMKSA:
6398                 rdev_ops = rdev->ops->del_pmksa;
6399                 break;
6400         default:
6401                 WARN_ON(1);
6402                 break;
6403         }
6404
6405         if (!rdev_ops)
6406                 return -EOPNOTSUPP;
6407
6408         return rdev_ops(&rdev->wiphy, dev, &pmksa);
6409 }
6410
6411 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
6412 {
6413         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6414         struct net_device *dev = info->user_ptr[1];
6415
6416         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6417             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6418                 return -EOPNOTSUPP;
6419
6420         if (!rdev->ops->flush_pmksa)
6421                 return -EOPNOTSUPP;
6422
6423         return rdev_flush_pmksa(rdev, dev);
6424 }
6425
6426 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
6427 {
6428         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6429         struct net_device *dev = info->user_ptr[1];
6430         u8 action_code, dialog_token;
6431         u16 status_code;
6432         u8 *peer;
6433
6434         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
6435             !rdev->ops->tdls_mgmt)
6436                 return -EOPNOTSUPP;
6437
6438         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
6439             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
6440             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
6441             !info->attrs[NL80211_ATTR_IE] ||
6442             !info->attrs[NL80211_ATTR_MAC])
6443                 return -EINVAL;
6444
6445         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
6446         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
6447         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
6448         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
6449
6450         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
6451                               dialog_token, status_code,
6452                               nla_data(info->attrs[NL80211_ATTR_IE]),
6453                               nla_len(info->attrs[NL80211_ATTR_IE]));
6454 }
6455
6456 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
6457 {
6458         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6459         struct net_device *dev = info->user_ptr[1];
6460         enum nl80211_tdls_operation operation;
6461         u8 *peer;
6462
6463         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
6464             !rdev->ops->tdls_oper)
6465                 return -EOPNOTSUPP;
6466
6467         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
6468             !info->attrs[NL80211_ATTR_MAC])
6469                 return -EINVAL;
6470
6471         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
6472         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
6473
6474         return rdev_tdls_oper(rdev, dev, peer, operation);
6475 }
6476
6477 static int nl80211_remain_on_channel(struct sk_buff *skb,
6478                                      struct genl_info *info)
6479 {
6480         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6481         struct wireless_dev *wdev = info->user_ptr[1];
6482         struct cfg80211_chan_def chandef;
6483         struct sk_buff *msg;
6484         void *hdr;
6485         u64 cookie;
6486         u32 duration;
6487         int err;
6488
6489         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
6490             !info->attrs[NL80211_ATTR_DURATION])
6491                 return -EINVAL;
6492
6493         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
6494
6495         if (!rdev->ops->remain_on_channel ||
6496             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
6497                 return -EOPNOTSUPP;
6498
6499         /*
6500          * We should be on that channel for at least a minimum amount of
6501          * time (10ms) but no longer than the driver supports.
6502          */
6503         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
6504             duration > rdev->wiphy.max_remain_on_channel_duration)
6505                 return -EINVAL;
6506
6507         err = nl80211_parse_chandef(rdev, info, &chandef);
6508         if (err)
6509                 return err;
6510
6511         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6512         if (!msg)
6513                 return -ENOMEM;
6514
6515         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6516                              NL80211_CMD_REMAIN_ON_CHANNEL);
6517
6518         if (IS_ERR(hdr)) {
6519                 err = PTR_ERR(hdr);
6520                 goto free_msg;
6521         }
6522
6523         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
6524                                      duration, &cookie);
6525
6526         if (err)
6527                 goto free_msg;
6528
6529         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6530                 goto nla_put_failure;
6531
6532         genlmsg_end(msg, hdr);
6533
6534         return genlmsg_reply(msg, info);
6535
6536  nla_put_failure:
6537         err = -ENOBUFS;
6538  free_msg:
6539         nlmsg_free(msg);
6540         return err;
6541 }
6542
6543 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
6544                                             struct genl_info *info)
6545 {
6546         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6547         struct wireless_dev *wdev = info->user_ptr[1];
6548         u64 cookie;
6549
6550         if (!info->attrs[NL80211_ATTR_COOKIE])
6551                 return -EINVAL;
6552
6553         if (!rdev->ops->cancel_remain_on_channel)
6554                 return -EOPNOTSUPP;
6555
6556         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
6557
6558         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
6559 }
6560
6561 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
6562                            u8 *rates, u8 rates_len)
6563 {
6564         u8 i;
6565         u32 mask = 0;
6566
6567         for (i = 0; i < rates_len; i++) {
6568                 int rate = (rates[i] & 0x7f) * 5;
6569                 int ridx;
6570                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
6571                         struct ieee80211_rate *srate =
6572                                 &sband->bitrates[ridx];
6573                         if (rate == srate->bitrate) {
6574                                 mask |= 1 << ridx;
6575                                 break;
6576                         }
6577                 }
6578                 if (ridx == sband->n_bitrates)
6579                         return 0; /* rate not found */
6580         }
6581
6582         return mask;
6583 }
6584
6585 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
6586                                u8 *rates, u8 rates_len,
6587                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
6588 {
6589         u8 i;
6590
6591         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
6592
6593         for (i = 0; i < rates_len; i++) {
6594                 int ridx, rbit;
6595
6596                 ridx = rates[i] / 8;
6597                 rbit = BIT(rates[i] % 8);
6598
6599                 /* check validity */
6600                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
6601                         return false;
6602
6603                 /* check availability */
6604                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
6605                         mcs[ridx] |= rbit;
6606                 else
6607                         return false;
6608         }
6609
6610         return true;
6611 }
6612
6613 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
6614         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
6615                                     .len = NL80211_MAX_SUPP_RATES },
6616         [NL80211_TXRATE_MCS] = { .type = NLA_BINARY,
6617                                  .len = NL80211_MAX_SUPP_HT_RATES },
6618 };
6619
6620 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
6621                                        struct genl_info *info)
6622 {
6623         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
6624         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6625         struct cfg80211_bitrate_mask mask;
6626         int rem, i;
6627         struct net_device *dev = info->user_ptr[1];
6628         struct nlattr *tx_rates;
6629         struct ieee80211_supported_band *sband;
6630
6631         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
6632                 return -EINVAL;
6633
6634         if (!rdev->ops->set_bitrate_mask)
6635                 return -EOPNOTSUPP;
6636
6637         memset(&mask, 0, sizeof(mask));
6638         /* Default to all rates enabled */
6639         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
6640                 sband = rdev->wiphy.bands[i];
6641                 mask.control[i].legacy =
6642                         sband ? (1 << sband->n_bitrates) - 1 : 0;
6643                 if (sband)
6644                         memcpy(mask.control[i].mcs,
6645                                sband->ht_cap.mcs.rx_mask,
6646                                sizeof(mask.control[i].mcs));
6647                 else
6648                         memset(mask.control[i].mcs, 0,
6649                                sizeof(mask.control[i].mcs));
6650         }
6651
6652         /*
6653          * The nested attribute uses enum nl80211_band as the index. This maps
6654          * directly to the enum ieee80211_band values used in cfg80211.
6655          */
6656         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
6657         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
6658         {
6659                 enum ieee80211_band band = nla_type(tx_rates);
6660                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
6661                         return -EINVAL;
6662                 sband = rdev->wiphy.bands[band];
6663                 if (sband == NULL)
6664                         return -EINVAL;
6665                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
6666                           nla_len(tx_rates), nl80211_txattr_policy);
6667                 if (tb[NL80211_TXRATE_LEGACY]) {
6668                         mask.control[band].legacy = rateset_to_mask(
6669                                 sband,
6670                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
6671                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
6672                         if ((mask.control[band].legacy == 0) &&
6673                             nla_len(tb[NL80211_TXRATE_LEGACY]))
6674                                 return -EINVAL;
6675                 }
6676                 if (tb[NL80211_TXRATE_MCS]) {
6677                         if (!ht_rateset_to_mask(
6678                                         sband,
6679                                         nla_data(tb[NL80211_TXRATE_MCS]),
6680                                         nla_len(tb[NL80211_TXRATE_MCS]),
6681                                         mask.control[band].mcs))
6682                                 return -EINVAL;
6683                 }
6684
6685                 if (mask.control[band].legacy == 0) {
6686                         /* don't allow empty legacy rates if HT
6687                          * is not even supported. */
6688                         if (!rdev->wiphy.bands[band]->ht_cap.ht_supported)
6689                                 return -EINVAL;
6690
6691                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
6692                                 if (mask.control[band].mcs[i])
6693                                         break;
6694
6695                         /* legacy and mcs rates may not be both empty */
6696                         if (i == IEEE80211_HT_MCS_MASK_LEN)
6697                                 return -EINVAL;
6698                 }
6699         }
6700
6701         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
6702 }
6703
6704 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
6705 {
6706         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6707         struct wireless_dev *wdev = info->user_ptr[1];
6708         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
6709
6710         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
6711                 return -EINVAL;
6712
6713         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
6714                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
6715
6716         switch (wdev->iftype) {
6717         case NL80211_IFTYPE_STATION:
6718         case NL80211_IFTYPE_ADHOC:
6719         case NL80211_IFTYPE_P2P_CLIENT:
6720         case NL80211_IFTYPE_AP:
6721         case NL80211_IFTYPE_AP_VLAN:
6722         case NL80211_IFTYPE_MESH_POINT:
6723         case NL80211_IFTYPE_P2P_GO:
6724         case NL80211_IFTYPE_P2P_DEVICE:
6725                 break;
6726         default:
6727                 return -EOPNOTSUPP;
6728         }
6729
6730         /* not much point in registering if we can't reply */
6731         if (!rdev->ops->mgmt_tx)
6732                 return -EOPNOTSUPP;
6733
6734         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
6735                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
6736                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
6737 }
6738
6739 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
6740 {
6741         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6742         struct wireless_dev *wdev = info->user_ptr[1];
6743         struct cfg80211_chan_def chandef;
6744         int err;
6745         void *hdr = NULL;
6746         u64 cookie;
6747         struct sk_buff *msg = NULL;
6748         unsigned int wait = 0;
6749         bool offchan, no_cck, dont_wait_for_ack;
6750
6751         dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
6752
6753         if (!info->attrs[NL80211_ATTR_FRAME])
6754                 return -EINVAL;
6755
6756         if (!rdev->ops->mgmt_tx)
6757                 return -EOPNOTSUPP;
6758
6759         switch (wdev->iftype) {
6760         case NL80211_IFTYPE_STATION:
6761         case NL80211_IFTYPE_ADHOC:
6762         case NL80211_IFTYPE_P2P_CLIENT:
6763         case NL80211_IFTYPE_AP:
6764         case NL80211_IFTYPE_AP_VLAN:
6765         case NL80211_IFTYPE_MESH_POINT:
6766         case NL80211_IFTYPE_P2P_GO:
6767         case NL80211_IFTYPE_P2P_DEVICE:
6768                 break;
6769         default:
6770                 return -EOPNOTSUPP;
6771         }
6772
6773         if (info->attrs[NL80211_ATTR_DURATION]) {
6774                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
6775                         return -EINVAL;
6776                 wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
6777
6778                 /*
6779                  * We should wait on the channel for at least a minimum amount
6780                  * of time (10ms) but no longer than the driver supports.
6781                  */
6782                 if (wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
6783                     wait > rdev->wiphy.max_remain_on_channel_duration)
6784                         return -EINVAL;
6785
6786         }
6787
6788         offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
6789
6790         if (offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
6791                 return -EINVAL;
6792
6793         no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
6794
6795         err = nl80211_parse_chandef(rdev, info, &chandef);
6796         if (err)
6797                 return err;
6798
6799         if (!dont_wait_for_ack) {
6800                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6801                 if (!msg)
6802                         return -ENOMEM;
6803
6804                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6805                                      NL80211_CMD_FRAME);
6806
6807                 if (IS_ERR(hdr)) {
6808                         err = PTR_ERR(hdr);
6809                         goto free_msg;
6810                 }
6811         }
6812
6813         err = cfg80211_mlme_mgmt_tx(rdev, wdev, chandef.chan, offchan, wait,
6814                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
6815                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
6816                                     no_cck, dont_wait_for_ack, &cookie);
6817         if (err)
6818                 goto free_msg;
6819
6820         if (msg) {
6821                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6822                         goto nla_put_failure;
6823
6824                 genlmsg_end(msg, hdr);
6825                 return genlmsg_reply(msg, info);
6826         }
6827
6828         return 0;
6829
6830  nla_put_failure:
6831         err = -ENOBUFS;
6832  free_msg:
6833         nlmsg_free(msg);
6834         return err;
6835 }
6836
6837 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
6838 {
6839         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6840         struct wireless_dev *wdev = info->user_ptr[1];
6841         u64 cookie;
6842
6843         if (!info->attrs[NL80211_ATTR_COOKIE])
6844                 return -EINVAL;
6845
6846         if (!rdev->ops->mgmt_tx_cancel_wait)
6847                 return -EOPNOTSUPP;
6848
6849         switch (wdev->iftype) {
6850         case NL80211_IFTYPE_STATION:
6851         case NL80211_IFTYPE_ADHOC:
6852         case NL80211_IFTYPE_P2P_CLIENT:
6853         case NL80211_IFTYPE_AP:
6854         case NL80211_IFTYPE_AP_VLAN:
6855         case NL80211_IFTYPE_P2P_GO:
6856         case NL80211_IFTYPE_P2P_DEVICE:
6857                 break;
6858         default:
6859                 return -EOPNOTSUPP;
6860         }
6861
6862         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
6863
6864         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
6865 }
6866
6867 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
6868 {
6869         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6870         struct wireless_dev *wdev;
6871         struct net_device *dev = info->user_ptr[1];
6872         u8 ps_state;
6873         bool state;
6874         int err;
6875
6876         if (!info->attrs[NL80211_ATTR_PS_STATE])
6877                 return -EINVAL;
6878
6879         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
6880
6881         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
6882                 return -EINVAL;
6883
6884         wdev = dev->ieee80211_ptr;
6885
6886         if (!rdev->ops->set_power_mgmt)
6887                 return -EOPNOTSUPP;
6888
6889         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
6890
6891         if (state == wdev->ps)
6892                 return 0;
6893
6894         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
6895         if (!err)
6896                 wdev->ps = state;
6897         return err;
6898 }
6899
6900 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
6901 {
6902         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6903         enum nl80211_ps_state ps_state;
6904         struct wireless_dev *wdev;
6905         struct net_device *dev = info->user_ptr[1];
6906         struct sk_buff *msg;
6907         void *hdr;
6908         int err;
6909
6910         wdev = dev->ieee80211_ptr;
6911
6912         if (!rdev->ops->set_power_mgmt)
6913                 return -EOPNOTSUPP;
6914
6915         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6916         if (!msg)
6917                 return -ENOMEM;
6918
6919         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6920                              NL80211_CMD_GET_POWER_SAVE);
6921         if (!hdr) {
6922                 err = -ENOBUFS;
6923                 goto free_msg;
6924         }
6925
6926         if (wdev->ps)
6927                 ps_state = NL80211_PS_ENABLED;
6928         else
6929                 ps_state = NL80211_PS_DISABLED;
6930
6931         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
6932                 goto nla_put_failure;
6933
6934         genlmsg_end(msg, hdr);
6935         return genlmsg_reply(msg, info);
6936
6937  nla_put_failure:
6938         err = -ENOBUFS;
6939  free_msg:
6940         nlmsg_free(msg);
6941         return err;
6942 }
6943
6944 static struct nla_policy
6945 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
6946         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
6947         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
6948         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
6949         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
6950         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
6951         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
6952 };
6953
6954 static int nl80211_set_cqm_txe(struct genl_info *info,
6955                                u32 rate, u32 pkts, u32 intvl)
6956 {
6957         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6958         struct wireless_dev *wdev;
6959         struct net_device *dev = info->user_ptr[1];
6960
6961         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
6962                 return -EINVAL;
6963
6964         wdev = dev->ieee80211_ptr;
6965
6966         if (!rdev->ops->set_cqm_txe_config)
6967                 return -EOPNOTSUPP;
6968
6969         if (wdev->iftype != NL80211_IFTYPE_STATION &&
6970             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
6971                 return -EOPNOTSUPP;
6972
6973         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
6974 }
6975
6976 static int nl80211_set_cqm_rssi(struct genl_info *info,
6977                                 s32 threshold, u32 hysteresis)
6978 {
6979         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6980         struct wireless_dev *wdev;
6981         struct net_device *dev = info->user_ptr[1];
6982
6983         if (threshold > 0)
6984                 return -EINVAL;
6985
6986         wdev = dev->ieee80211_ptr;
6987
6988         if (!rdev->ops->set_cqm_rssi_config)
6989                 return -EOPNOTSUPP;
6990
6991         if (wdev->iftype != NL80211_IFTYPE_STATION &&
6992             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
6993                 return -EOPNOTSUPP;
6994
6995         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
6996 }
6997
6998 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
6999 {
7000         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
7001         struct nlattr *cqm;
7002         int err;
7003
7004         cqm = info->attrs[NL80211_ATTR_CQM];
7005         if (!cqm) {
7006                 err = -EINVAL;
7007                 goto out;
7008         }
7009
7010         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
7011                                nl80211_attr_cqm_policy);
7012         if (err)
7013                 goto out;
7014
7015         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
7016             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
7017                 s32 threshold;
7018                 u32 hysteresis;
7019                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
7020                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
7021                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
7022         } else if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
7023                    attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
7024                    attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
7025                 u32 rate, pkts, intvl;
7026                 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
7027                 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
7028                 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
7029                 err = nl80211_set_cqm_txe(info, rate, pkts, intvl);
7030         } else
7031                 err = -EINVAL;
7032
7033 out:
7034         return err;
7035 }
7036
7037 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
7038 {
7039         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7040         struct net_device *dev = info->user_ptr[1];
7041         struct mesh_config cfg;
7042         struct mesh_setup setup;
7043         int err;
7044
7045         /* start with default */
7046         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
7047         memcpy(&setup, &default_mesh_setup, sizeof(setup));
7048
7049         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
7050                 /* and parse parameters if given */
7051                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
7052                 if (err)
7053                         return err;
7054         }
7055
7056         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
7057             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
7058                 return -EINVAL;
7059
7060         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
7061         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
7062
7063         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
7064             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
7065                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
7066                         return -EINVAL;
7067
7068         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
7069                 setup.beacon_interval =
7070                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
7071                 if (setup.beacon_interval < 10 ||
7072                     setup.beacon_interval > 10000)
7073                         return -EINVAL;
7074         }
7075
7076         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
7077                 setup.dtim_period =
7078                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
7079                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
7080                         return -EINVAL;
7081         }
7082
7083         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
7084                 /* parse additional setup parameters if given */
7085                 err = nl80211_parse_mesh_setup(info, &setup);
7086                 if (err)
7087                         return err;
7088         }
7089
7090         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7091                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
7092                 if (err)
7093                         return err;
7094         } else {
7095                 /* cfg80211_join_mesh() will sort it out */
7096                 setup.chandef.chan = NULL;
7097         }
7098
7099         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
7100 }
7101
7102 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
7103 {
7104         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7105         struct net_device *dev = info->user_ptr[1];
7106
7107         return cfg80211_leave_mesh(rdev, dev);
7108 }
7109
7110 #ifdef CONFIG_PM
7111 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
7112                                         struct cfg80211_registered_device *rdev)
7113 {
7114         struct nlattr *nl_pats, *nl_pat;
7115         int i, pat_len;
7116
7117         if (!rdev->wowlan->n_patterns)
7118                 return 0;
7119
7120         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
7121         if (!nl_pats)
7122                 return -ENOBUFS;
7123
7124         for (i = 0; i < rdev->wowlan->n_patterns; i++) {
7125                 nl_pat = nla_nest_start(msg, i + 1);
7126                 if (!nl_pat)
7127                         return -ENOBUFS;
7128                 pat_len = rdev->wowlan->patterns[i].pattern_len;
7129                 if (nla_put(msg, NL80211_WOWLAN_PKTPAT_MASK,
7130                             DIV_ROUND_UP(pat_len, 8),
7131                             rdev->wowlan->patterns[i].mask) ||
7132                     nla_put(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
7133                             pat_len, rdev->wowlan->patterns[i].pattern) ||
7134                     nla_put_u32(msg, NL80211_WOWLAN_PKTPAT_OFFSET,
7135                                 rdev->wowlan->patterns[i].pkt_offset))
7136                         return -ENOBUFS;
7137                 nla_nest_end(msg, nl_pat);
7138         }
7139         nla_nest_end(msg, nl_pats);
7140
7141         return 0;
7142 }
7143
7144 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
7145                                    struct cfg80211_wowlan_tcp *tcp)
7146 {
7147         struct nlattr *nl_tcp;
7148
7149         if (!tcp)
7150                 return 0;
7151
7152         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
7153         if (!nl_tcp)
7154                 return -ENOBUFS;
7155
7156         if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
7157             nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
7158             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
7159             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
7160             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
7161             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
7162                     tcp->payload_len, tcp->payload) ||
7163             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
7164                         tcp->data_interval) ||
7165             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
7166                     tcp->wake_len, tcp->wake_data) ||
7167             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
7168                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
7169                 return -ENOBUFS;
7170
7171         if (tcp->payload_seq.len &&
7172             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
7173                     sizeof(tcp->payload_seq), &tcp->payload_seq))
7174                 return -ENOBUFS;
7175
7176         if (tcp->payload_tok.len &&
7177             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
7178                     sizeof(tcp->payload_tok) + tcp->tokens_size,
7179                     &tcp->payload_tok))
7180                 return -ENOBUFS;
7181
7182         return 0;
7183 }
7184
7185 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
7186 {
7187         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7188         struct sk_buff *msg;
7189         void *hdr;
7190         u32 size = NLMSG_DEFAULT_SIZE;
7191
7192         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns &&
7193             !rdev->wiphy.wowlan.tcp)
7194                 return -EOPNOTSUPP;
7195
7196         if (rdev->wowlan && rdev->wowlan->tcp) {
7197                 /* adjust size to have room for all the data */
7198                 size += rdev->wowlan->tcp->tokens_size +
7199                         rdev->wowlan->tcp->payload_len +
7200                         rdev->wowlan->tcp->wake_len +
7201                         rdev->wowlan->tcp->wake_len / 8;
7202         }
7203
7204         msg = nlmsg_new(size, GFP_KERNEL);
7205         if (!msg)
7206                 return -ENOMEM;
7207
7208         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7209                              NL80211_CMD_GET_WOWLAN);
7210         if (!hdr)
7211                 goto nla_put_failure;
7212
7213         if (rdev->wowlan) {
7214                 struct nlattr *nl_wowlan;
7215
7216                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
7217                 if (!nl_wowlan)
7218                         goto nla_put_failure;
7219
7220                 if ((rdev->wowlan->any &&
7221                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
7222                     (rdev->wowlan->disconnect &&
7223                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
7224                     (rdev->wowlan->magic_pkt &&
7225                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
7226                     (rdev->wowlan->gtk_rekey_failure &&
7227                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
7228                     (rdev->wowlan->eap_identity_req &&
7229                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
7230                     (rdev->wowlan->four_way_handshake &&
7231                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
7232                     (rdev->wowlan->rfkill_release &&
7233                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
7234                         goto nla_put_failure;
7235
7236                 if (nl80211_send_wowlan_patterns(msg, rdev))
7237                         goto nla_put_failure;
7238
7239                 if (nl80211_send_wowlan_tcp(msg, rdev->wowlan->tcp))
7240                         goto nla_put_failure;
7241
7242                 nla_nest_end(msg, nl_wowlan);
7243         }
7244
7245         genlmsg_end(msg, hdr);
7246         return genlmsg_reply(msg, info);
7247
7248 nla_put_failure:
7249         nlmsg_free(msg);
7250         return -ENOBUFS;
7251 }
7252
7253 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
7254                                     struct nlattr *attr,
7255                                     struct cfg80211_wowlan *trig)
7256 {
7257         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
7258         struct cfg80211_wowlan_tcp *cfg;
7259         struct nl80211_wowlan_tcp_data_token *tok = NULL;
7260         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
7261         u32 size;
7262         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
7263         int err, port;
7264
7265         if (!rdev->wiphy.wowlan.tcp)
7266                 return -EINVAL;
7267
7268         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
7269                         nla_data(attr), nla_len(attr),
7270                         nl80211_wowlan_tcp_policy);
7271         if (err)
7272                 return err;
7273
7274         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
7275             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
7276             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
7277             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
7278             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
7279             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
7280             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
7281             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
7282                 return -EINVAL;
7283
7284         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
7285         if (data_size > rdev->wiphy.wowlan.tcp->data_payload_max)
7286                 return -EINVAL;
7287
7288         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
7289                         rdev->wiphy.wowlan.tcp->data_interval_max)
7290                 return -EINVAL;
7291
7292         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
7293         if (wake_size > rdev->wiphy.wowlan.tcp->wake_payload_max)
7294                 return -EINVAL;
7295
7296         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
7297         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
7298                 return -EINVAL;
7299
7300         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
7301                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
7302
7303                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
7304                 tokens_size = tokln - sizeof(*tok);
7305
7306                 if (!tok->len || tokens_size % tok->len)
7307                         return -EINVAL;
7308                 if (!rdev->wiphy.wowlan.tcp->tok)
7309                         return -EINVAL;
7310                 if (tok->len > rdev->wiphy.wowlan.tcp->tok->max_len)
7311                         return -EINVAL;
7312                 if (tok->len < rdev->wiphy.wowlan.tcp->tok->min_len)
7313                         return -EINVAL;
7314                 if (tokens_size > rdev->wiphy.wowlan.tcp->tok->bufsize)
7315                         return -EINVAL;
7316                 if (tok->offset + tok->len > data_size)
7317                         return -EINVAL;
7318         }
7319
7320         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
7321                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
7322                 if (!rdev->wiphy.wowlan.tcp->seq)
7323                         return -EINVAL;
7324                 if (seq->len == 0 || seq->len > 4)
7325                         return -EINVAL;
7326                 if (seq->len + seq->offset > data_size)
7327                         return -EINVAL;
7328         }
7329
7330         size = sizeof(*cfg);
7331         size += data_size;
7332         size += wake_size + wake_mask_size;
7333         size += tokens_size;
7334
7335         cfg = kzalloc(size, GFP_KERNEL);
7336         if (!cfg)
7337                 return -ENOMEM;
7338         cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
7339         cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
7340         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
7341                ETH_ALEN);
7342         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
7343                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
7344         else
7345                 port = 0;
7346 #ifdef CONFIG_INET
7347         /* allocate a socket and port for it and use it */
7348         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
7349                             IPPROTO_TCP, &cfg->sock, 1);
7350         if (err) {
7351                 kfree(cfg);
7352                 return err;
7353         }
7354         if (inet_csk_get_port(cfg->sock->sk, port)) {
7355                 sock_release(cfg->sock);
7356                 kfree(cfg);
7357                 return -EADDRINUSE;
7358         }
7359         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
7360 #else
7361         if (!port) {
7362                 kfree(cfg);
7363                 return -EINVAL;
7364         }
7365         cfg->src_port = port;
7366 #endif
7367
7368         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
7369         cfg->payload_len = data_size;
7370         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
7371         memcpy((void *)cfg->payload,
7372                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
7373                data_size);
7374         if (seq)
7375                 cfg->payload_seq = *seq;
7376         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
7377         cfg->wake_len = wake_size;
7378         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
7379         memcpy((void *)cfg->wake_data,
7380                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
7381                wake_size);
7382         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
7383                          data_size + wake_size;
7384         memcpy((void *)cfg->wake_mask,
7385                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
7386                wake_mask_size);
7387         if (tok) {
7388                 cfg->tokens_size = tokens_size;
7389                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
7390         }
7391
7392         trig->tcp = cfg;
7393
7394         return 0;
7395 }
7396
7397 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
7398 {
7399         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7400         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
7401         struct cfg80211_wowlan new_triggers = {};
7402         struct cfg80211_wowlan *ntrig;
7403         struct wiphy_wowlan_support *wowlan = &rdev->wiphy.wowlan;
7404         int err, i;
7405         bool prev_enabled = rdev->wowlan;
7406
7407         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns &&
7408             !rdev->wiphy.wowlan.tcp)
7409                 return -EOPNOTSUPP;
7410
7411         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
7412                 cfg80211_rdev_free_wowlan(rdev);
7413                 rdev->wowlan = NULL;
7414                 goto set_wakeup;
7415         }
7416
7417         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
7418                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
7419                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
7420                         nl80211_wowlan_policy);
7421         if (err)
7422                 return err;
7423
7424         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
7425                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
7426                         return -EINVAL;
7427                 new_triggers.any = true;
7428         }
7429
7430         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
7431                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
7432                         return -EINVAL;
7433                 new_triggers.disconnect = true;
7434         }
7435
7436         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
7437                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
7438                         return -EINVAL;
7439                 new_triggers.magic_pkt = true;
7440         }
7441
7442         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
7443                 return -EINVAL;
7444
7445         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
7446                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
7447                         return -EINVAL;
7448                 new_triggers.gtk_rekey_failure = true;
7449         }
7450
7451         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
7452                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
7453                         return -EINVAL;
7454                 new_triggers.eap_identity_req = true;
7455         }
7456
7457         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
7458                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
7459                         return -EINVAL;
7460                 new_triggers.four_way_handshake = true;
7461         }
7462
7463         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
7464                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
7465                         return -EINVAL;
7466                 new_triggers.rfkill_release = true;
7467         }
7468
7469         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
7470                 struct nlattr *pat;
7471                 int n_patterns = 0;
7472                 int rem, pat_len, mask_len, pkt_offset;
7473                 struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
7474
7475                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
7476                                     rem)
7477                         n_patterns++;
7478                 if (n_patterns > wowlan->n_patterns)
7479                         return -EINVAL;
7480
7481                 new_triggers.patterns = kcalloc(n_patterns,
7482                                                 sizeof(new_triggers.patterns[0]),
7483                                                 GFP_KERNEL);
7484                 if (!new_triggers.patterns)
7485                         return -ENOMEM;
7486
7487                 new_triggers.n_patterns = n_patterns;
7488                 i = 0;
7489
7490                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
7491                                     rem) {
7492                         nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
7493                                   nla_data(pat), nla_len(pat), NULL);
7494                         err = -EINVAL;
7495                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
7496                             !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
7497                                 goto error;
7498                         pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
7499                         mask_len = DIV_ROUND_UP(pat_len, 8);
7500                         if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
7501                             mask_len)
7502                                 goto error;
7503                         if (pat_len > wowlan->pattern_max_len ||
7504                             pat_len < wowlan->pattern_min_len)
7505                                 goto error;
7506
7507                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET])
7508                                 pkt_offset = 0;
7509                         else
7510                                 pkt_offset = nla_get_u32(
7511                                         pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET]);
7512                         if (pkt_offset > wowlan->max_pkt_offset)
7513                                 goto error;
7514                         new_triggers.patterns[i].pkt_offset = pkt_offset;
7515
7516                         new_triggers.patterns[i].mask =
7517                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
7518                         if (!new_triggers.patterns[i].mask) {
7519                                 err = -ENOMEM;
7520                                 goto error;
7521                         }
7522                         new_triggers.patterns[i].pattern =
7523                                 new_triggers.patterns[i].mask + mask_len;
7524                         memcpy(new_triggers.patterns[i].mask,
7525                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
7526                                mask_len);
7527                         new_triggers.patterns[i].pattern_len = pat_len;
7528                         memcpy(new_triggers.patterns[i].pattern,
7529                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
7530                                pat_len);
7531                         i++;
7532                 }
7533         }
7534
7535         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
7536                 err = nl80211_parse_wowlan_tcp(
7537                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
7538                         &new_triggers);
7539                 if (err)
7540                         goto error;
7541         }
7542
7543         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
7544         if (!ntrig) {
7545                 err = -ENOMEM;
7546                 goto error;
7547         }
7548         cfg80211_rdev_free_wowlan(rdev);
7549         rdev->wowlan = ntrig;
7550
7551  set_wakeup:
7552         if (rdev->ops->set_wakeup && prev_enabled != !!rdev->wowlan)
7553                 rdev_set_wakeup(rdev, rdev->wowlan);
7554
7555         return 0;
7556  error:
7557         for (i = 0; i < new_triggers.n_patterns; i++)
7558                 kfree(new_triggers.patterns[i].mask);
7559         kfree(new_triggers.patterns);
7560         if (new_triggers.tcp && new_triggers.tcp->sock)
7561                 sock_release(new_triggers.tcp->sock);
7562         kfree(new_triggers.tcp);
7563         return err;
7564 }
7565 #endif
7566
7567 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
7568 {
7569         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7570         struct net_device *dev = info->user_ptr[1];
7571         struct wireless_dev *wdev = dev->ieee80211_ptr;
7572         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
7573         struct cfg80211_gtk_rekey_data rekey_data;
7574         int err;
7575
7576         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
7577                 return -EINVAL;
7578
7579         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
7580                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
7581                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
7582                         nl80211_rekey_policy);
7583         if (err)
7584                 return err;
7585
7586         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
7587                 return -ERANGE;
7588         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
7589                 return -ERANGE;
7590         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
7591                 return -ERANGE;
7592
7593         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
7594                NL80211_KEK_LEN);
7595         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
7596                NL80211_KCK_LEN);
7597         memcpy(rekey_data.replay_ctr,
7598                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
7599                NL80211_REPLAY_CTR_LEN);
7600
7601         wdev_lock(wdev);
7602         if (!wdev->current_bss) {
7603                 err = -ENOTCONN;
7604                 goto out;
7605         }
7606
7607         if (!rdev->ops->set_rekey_data) {
7608                 err = -EOPNOTSUPP;
7609                 goto out;
7610         }
7611
7612         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
7613  out:
7614         wdev_unlock(wdev);
7615         return err;
7616 }
7617
7618 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
7619                                              struct genl_info *info)
7620 {
7621         struct net_device *dev = info->user_ptr[1];
7622         struct wireless_dev *wdev = dev->ieee80211_ptr;
7623
7624         if (wdev->iftype != NL80211_IFTYPE_AP &&
7625             wdev->iftype != NL80211_IFTYPE_P2P_GO)
7626                 return -EINVAL;
7627
7628         if (wdev->ap_unexpected_nlportid)
7629                 return -EBUSY;
7630
7631         wdev->ap_unexpected_nlportid = info->snd_portid;
7632         return 0;
7633 }
7634
7635 static int nl80211_probe_client(struct sk_buff *skb,
7636                                 struct genl_info *info)
7637 {
7638         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7639         struct net_device *dev = info->user_ptr[1];
7640         struct wireless_dev *wdev = dev->ieee80211_ptr;
7641         struct sk_buff *msg;
7642         void *hdr;
7643         const u8 *addr;
7644         u64 cookie;
7645         int err;
7646
7647         if (wdev->iftype != NL80211_IFTYPE_AP &&
7648             wdev->iftype != NL80211_IFTYPE_P2P_GO)
7649                 return -EOPNOTSUPP;
7650
7651         if (!info->attrs[NL80211_ATTR_MAC])
7652                 return -EINVAL;
7653
7654         if (!rdev->ops->probe_client)
7655                 return -EOPNOTSUPP;
7656
7657         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7658         if (!msg)
7659                 return -ENOMEM;
7660
7661         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7662                              NL80211_CMD_PROBE_CLIENT);
7663
7664         if (IS_ERR(hdr)) {
7665                 err = PTR_ERR(hdr);
7666                 goto free_msg;
7667         }
7668
7669         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7670
7671         err = rdev_probe_client(rdev, dev, addr, &cookie);
7672         if (err)
7673                 goto free_msg;
7674
7675         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7676                 goto nla_put_failure;
7677
7678         genlmsg_end(msg, hdr);
7679
7680         return genlmsg_reply(msg, info);
7681
7682  nla_put_failure:
7683         err = -ENOBUFS;
7684  free_msg:
7685         nlmsg_free(msg);
7686         return err;
7687 }
7688
7689 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
7690 {
7691         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7692         struct cfg80211_beacon_registration *reg, *nreg;
7693         int rv;
7694
7695         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
7696                 return -EOPNOTSUPP;
7697
7698         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
7699         if (!nreg)
7700                 return -ENOMEM;
7701
7702         /* First, check if already registered. */
7703         spin_lock_bh(&rdev->beacon_registrations_lock);
7704         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
7705                 if (reg->nlportid == info->snd_portid) {
7706                         rv = -EALREADY;
7707                         goto out_err;
7708                 }
7709         }
7710         /* Add it to the list */
7711         nreg->nlportid = info->snd_portid;
7712         list_add(&nreg->list, &rdev->beacon_registrations);
7713
7714         spin_unlock_bh(&rdev->beacon_registrations_lock);
7715
7716         return 0;
7717 out_err:
7718         spin_unlock_bh(&rdev->beacon_registrations_lock);
7719         kfree(nreg);
7720         return rv;
7721 }
7722
7723 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
7724 {
7725         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7726         struct wireless_dev *wdev = info->user_ptr[1];
7727         int err;
7728
7729         if (!rdev->ops->start_p2p_device)
7730                 return -EOPNOTSUPP;
7731
7732         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
7733                 return -EOPNOTSUPP;
7734
7735         if (wdev->p2p_started)
7736                 return 0;
7737
7738         mutex_lock(&rdev->devlist_mtx);
7739         err = cfg80211_can_add_interface(rdev, wdev->iftype);
7740         mutex_unlock(&rdev->devlist_mtx);
7741         if (err)
7742                 return err;
7743
7744         err = rdev_start_p2p_device(rdev, wdev);
7745         if (err)
7746                 return err;
7747
7748         wdev->p2p_started = true;
7749         mutex_lock(&rdev->devlist_mtx);
7750         rdev->opencount++;
7751         mutex_unlock(&rdev->devlist_mtx);
7752
7753         return 0;
7754 }
7755
7756 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
7757 {
7758         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7759         struct wireless_dev *wdev = info->user_ptr[1];
7760
7761         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
7762                 return -EOPNOTSUPP;
7763
7764         if (!rdev->ops->stop_p2p_device)
7765                 return -EOPNOTSUPP;
7766
7767         if (!wdev->p2p_started)
7768                 return 0;
7769
7770         rdev_stop_p2p_device(rdev, wdev);
7771         wdev->p2p_started = false;
7772
7773         mutex_lock(&rdev->devlist_mtx);
7774         rdev->opencount--;
7775         mutex_unlock(&rdev->devlist_mtx);
7776
7777         if (WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev)) {
7778                 rdev->scan_req->aborted = true;
7779                 ___cfg80211_scan_done(rdev, true);
7780         }
7781
7782         return 0;
7783 }
7784
7785 #define NL80211_FLAG_NEED_WIPHY         0x01
7786 #define NL80211_FLAG_NEED_NETDEV        0x02
7787 #define NL80211_FLAG_NEED_RTNL          0x04
7788 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
7789 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
7790                                          NL80211_FLAG_CHECK_NETDEV_UP)
7791 #define NL80211_FLAG_NEED_WDEV          0x10
7792 /* If a netdev is associated, it must be UP, P2P must be started */
7793 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
7794                                          NL80211_FLAG_CHECK_NETDEV_UP)
7795
7796 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
7797                             struct genl_info *info)
7798 {
7799         struct cfg80211_registered_device *rdev;
7800         struct wireless_dev *wdev;
7801         struct net_device *dev;
7802         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
7803
7804         if (rtnl)
7805                 rtnl_lock();
7806
7807         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
7808                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
7809                 if (IS_ERR(rdev)) {
7810                         if (rtnl)
7811                                 rtnl_unlock();
7812                         return PTR_ERR(rdev);
7813                 }
7814                 info->user_ptr[0] = rdev;
7815         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
7816                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
7817                 mutex_lock(&cfg80211_mutex);
7818                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
7819                                                   info->attrs);
7820                 if (IS_ERR(wdev)) {
7821                         mutex_unlock(&cfg80211_mutex);
7822                         if (rtnl)
7823                                 rtnl_unlock();
7824                         return PTR_ERR(wdev);
7825                 }
7826
7827                 dev = wdev->netdev;
7828                 rdev = wiphy_to_dev(wdev->wiphy);
7829
7830                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
7831                         if (!dev) {
7832                                 mutex_unlock(&cfg80211_mutex);
7833                                 if (rtnl)
7834                                         rtnl_unlock();
7835                                 return -EINVAL;
7836                         }
7837
7838                         info->user_ptr[1] = dev;
7839                 } else {
7840                         info->user_ptr[1] = wdev;
7841                 }
7842
7843                 if (dev) {
7844                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
7845                             !netif_running(dev)) {
7846                                 mutex_unlock(&cfg80211_mutex);
7847                                 if (rtnl)
7848                                         rtnl_unlock();
7849                                 return -ENETDOWN;
7850                         }
7851
7852                         dev_hold(dev);
7853                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
7854                         if (!wdev->p2p_started) {
7855                                 mutex_unlock(&cfg80211_mutex);
7856                                 if (rtnl)
7857                                         rtnl_unlock();
7858                                 return -ENETDOWN;
7859                         }
7860                 }
7861
7862                 cfg80211_lock_rdev(rdev);
7863
7864                 mutex_unlock(&cfg80211_mutex);
7865
7866                 info->user_ptr[0] = rdev;
7867         }
7868
7869         return 0;
7870 }
7871
7872 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
7873                               struct genl_info *info)
7874 {
7875         if (info->user_ptr[0])
7876                 cfg80211_unlock_rdev(info->user_ptr[0]);
7877         if (info->user_ptr[1]) {
7878                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
7879                         struct wireless_dev *wdev = info->user_ptr[1];
7880
7881                         if (wdev->netdev)
7882                                 dev_put(wdev->netdev);
7883                 } else {
7884                         dev_put(info->user_ptr[1]);
7885                 }
7886         }
7887         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
7888                 rtnl_unlock();
7889 }
7890
7891 static struct genl_ops nl80211_ops[] = {
7892         {
7893                 .cmd = NL80211_CMD_GET_WIPHY,
7894                 .doit = nl80211_get_wiphy,
7895                 .dumpit = nl80211_dump_wiphy,
7896                 .policy = nl80211_policy,
7897                 /* can be retrieved by unprivileged users */
7898                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
7899         },
7900         {
7901                 .cmd = NL80211_CMD_SET_WIPHY,
7902                 .doit = nl80211_set_wiphy,
7903                 .policy = nl80211_policy,
7904                 .flags = GENL_ADMIN_PERM,
7905                 .internal_flags = NL80211_FLAG_NEED_RTNL,
7906         },
7907         {
7908                 .cmd = NL80211_CMD_GET_INTERFACE,
7909                 .doit = nl80211_get_interface,
7910                 .dumpit = nl80211_dump_interface,
7911                 .policy = nl80211_policy,
7912                 /* can be retrieved by unprivileged users */
7913                 .internal_flags = NL80211_FLAG_NEED_WDEV,
7914         },
7915         {
7916                 .cmd = NL80211_CMD_SET_INTERFACE,
7917                 .doit = nl80211_set_interface,
7918                 .policy = nl80211_policy,
7919                 .flags = GENL_ADMIN_PERM,
7920                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7921                                   NL80211_FLAG_NEED_RTNL,
7922         },
7923         {
7924                 .cmd = NL80211_CMD_NEW_INTERFACE,
7925                 .doit = nl80211_new_interface,
7926                 .policy = nl80211_policy,
7927                 .flags = GENL_ADMIN_PERM,
7928                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7929                                   NL80211_FLAG_NEED_RTNL,
7930         },
7931         {
7932                 .cmd = NL80211_CMD_DEL_INTERFACE,
7933                 .doit = nl80211_del_interface,
7934                 .policy = nl80211_policy,
7935                 .flags = GENL_ADMIN_PERM,
7936                 .internal_flags = NL80211_FLAG_NEED_WDEV |
7937                                   NL80211_FLAG_NEED_RTNL,
7938         },
7939         {
7940                 .cmd = NL80211_CMD_GET_KEY,
7941                 .doit = nl80211_get_key,
7942                 .policy = nl80211_policy,
7943                 .flags = GENL_ADMIN_PERM,
7944                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7945                                   NL80211_FLAG_NEED_RTNL,
7946         },
7947         {
7948                 .cmd = NL80211_CMD_SET_KEY,
7949                 .doit = nl80211_set_key,
7950                 .policy = nl80211_policy,
7951                 .flags = GENL_ADMIN_PERM,
7952                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7953                                   NL80211_FLAG_NEED_RTNL,
7954         },
7955         {
7956                 .cmd = NL80211_CMD_NEW_KEY,
7957                 .doit = nl80211_new_key,
7958                 .policy = nl80211_policy,
7959                 .flags = GENL_ADMIN_PERM,
7960                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7961                                   NL80211_FLAG_NEED_RTNL,
7962         },
7963         {
7964                 .cmd = NL80211_CMD_DEL_KEY,
7965                 .doit = nl80211_del_key,
7966                 .policy = nl80211_policy,
7967                 .flags = GENL_ADMIN_PERM,
7968                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7969                                   NL80211_FLAG_NEED_RTNL,
7970         },
7971         {
7972                 .cmd = NL80211_CMD_SET_BEACON,
7973                 .policy = nl80211_policy,
7974                 .flags = GENL_ADMIN_PERM,
7975                 .doit = nl80211_set_beacon,
7976                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7977                                   NL80211_FLAG_NEED_RTNL,
7978         },
7979         {
7980                 .cmd = NL80211_CMD_START_AP,
7981                 .policy = nl80211_policy,
7982                 .flags = GENL_ADMIN_PERM,
7983                 .doit = nl80211_start_ap,
7984                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7985                                   NL80211_FLAG_NEED_RTNL,
7986         },
7987         {
7988                 .cmd = NL80211_CMD_STOP_AP,
7989                 .policy = nl80211_policy,
7990                 .flags = GENL_ADMIN_PERM,
7991                 .doit = nl80211_stop_ap,
7992                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7993                                   NL80211_FLAG_NEED_RTNL,
7994         },
7995         {
7996                 .cmd = NL80211_CMD_GET_STATION,
7997                 .doit = nl80211_get_station,
7998                 .dumpit = nl80211_dump_station,
7999                 .policy = nl80211_policy,
8000                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8001                                   NL80211_FLAG_NEED_RTNL,
8002         },
8003         {
8004                 .cmd = NL80211_CMD_SET_STATION,
8005                 .doit = nl80211_set_station,
8006                 .policy = nl80211_policy,
8007                 .flags = GENL_ADMIN_PERM,
8008                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8009                                   NL80211_FLAG_NEED_RTNL,
8010         },
8011         {
8012                 .cmd = NL80211_CMD_NEW_STATION,
8013                 .doit = nl80211_new_station,
8014                 .policy = nl80211_policy,
8015                 .flags = GENL_ADMIN_PERM,
8016                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8017                                   NL80211_FLAG_NEED_RTNL,
8018         },
8019         {
8020                 .cmd = NL80211_CMD_DEL_STATION,
8021                 .doit = nl80211_del_station,
8022                 .policy = nl80211_policy,
8023                 .flags = GENL_ADMIN_PERM,
8024                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8025                                   NL80211_FLAG_NEED_RTNL,
8026         },
8027         {
8028                 .cmd = NL80211_CMD_GET_MPATH,
8029                 .doit = nl80211_get_mpath,
8030                 .dumpit = nl80211_dump_mpath,
8031                 .policy = nl80211_policy,
8032                 .flags = GENL_ADMIN_PERM,
8033                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8034                                   NL80211_FLAG_NEED_RTNL,
8035         },
8036         {
8037                 .cmd = NL80211_CMD_SET_MPATH,
8038                 .doit = nl80211_set_mpath,
8039                 .policy = nl80211_policy,
8040                 .flags = GENL_ADMIN_PERM,
8041                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8042                                   NL80211_FLAG_NEED_RTNL,
8043         },
8044         {
8045                 .cmd = NL80211_CMD_NEW_MPATH,
8046                 .doit = nl80211_new_mpath,
8047                 .policy = nl80211_policy,
8048                 .flags = GENL_ADMIN_PERM,
8049                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8050                                   NL80211_FLAG_NEED_RTNL,
8051         },
8052         {
8053                 .cmd = NL80211_CMD_DEL_MPATH,
8054                 .doit = nl80211_del_mpath,
8055                 .policy = nl80211_policy,
8056                 .flags = GENL_ADMIN_PERM,
8057                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8058                                   NL80211_FLAG_NEED_RTNL,
8059         },
8060         {
8061                 .cmd = NL80211_CMD_SET_BSS,
8062                 .doit = nl80211_set_bss,
8063                 .policy = nl80211_policy,
8064                 .flags = GENL_ADMIN_PERM,
8065                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8066                                   NL80211_FLAG_NEED_RTNL,
8067         },
8068         {
8069                 .cmd = NL80211_CMD_GET_REG,
8070                 .doit = nl80211_get_reg,
8071                 .policy = nl80211_policy,
8072                 /* can be retrieved by unprivileged users */
8073         },
8074         {
8075                 .cmd = NL80211_CMD_SET_REG,
8076                 .doit = nl80211_set_reg,
8077                 .policy = nl80211_policy,
8078                 .flags = GENL_ADMIN_PERM,
8079         },
8080         {
8081                 .cmd = NL80211_CMD_REQ_SET_REG,
8082                 .doit = nl80211_req_set_reg,
8083                 .policy = nl80211_policy,
8084                 .flags = GENL_ADMIN_PERM,
8085         },
8086         {
8087                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
8088                 .doit = nl80211_get_mesh_config,
8089                 .policy = nl80211_policy,
8090                 /* can be retrieved by unprivileged users */
8091                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8092                                   NL80211_FLAG_NEED_RTNL,
8093         },
8094         {
8095                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
8096                 .doit = nl80211_update_mesh_config,
8097                 .policy = nl80211_policy,
8098                 .flags = GENL_ADMIN_PERM,
8099                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8100                                   NL80211_FLAG_NEED_RTNL,
8101         },
8102         {
8103                 .cmd = NL80211_CMD_TRIGGER_SCAN,
8104                 .doit = nl80211_trigger_scan,
8105                 .policy = nl80211_policy,
8106                 .flags = GENL_ADMIN_PERM,
8107                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8108                                   NL80211_FLAG_NEED_RTNL,
8109         },
8110         {
8111                 .cmd = NL80211_CMD_GET_SCAN,
8112                 .policy = nl80211_policy,
8113                 .dumpit = nl80211_dump_scan,
8114         },
8115         {
8116                 .cmd = NL80211_CMD_START_SCHED_SCAN,
8117                 .doit = nl80211_start_sched_scan,
8118                 .policy = nl80211_policy,
8119                 .flags = GENL_ADMIN_PERM,
8120                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8121                                   NL80211_FLAG_NEED_RTNL,
8122         },
8123         {
8124                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
8125                 .doit = nl80211_stop_sched_scan,
8126                 .policy = nl80211_policy,
8127                 .flags = GENL_ADMIN_PERM,
8128                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8129                                   NL80211_FLAG_NEED_RTNL,
8130         },
8131         {
8132                 .cmd = NL80211_CMD_AUTHENTICATE,
8133                 .doit = nl80211_authenticate,
8134                 .policy = nl80211_policy,
8135                 .flags = GENL_ADMIN_PERM,
8136                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8137                                   NL80211_FLAG_NEED_RTNL,
8138         },
8139         {
8140                 .cmd = NL80211_CMD_ASSOCIATE,
8141                 .doit = nl80211_associate,
8142                 .policy = nl80211_policy,
8143                 .flags = GENL_ADMIN_PERM,
8144                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8145                                   NL80211_FLAG_NEED_RTNL,
8146         },
8147         {
8148                 .cmd = NL80211_CMD_DEAUTHENTICATE,
8149                 .doit = nl80211_deauthenticate,
8150                 .policy = nl80211_policy,
8151                 .flags = GENL_ADMIN_PERM,
8152                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8153                                   NL80211_FLAG_NEED_RTNL,
8154         },
8155         {
8156                 .cmd = NL80211_CMD_DISASSOCIATE,
8157                 .doit = nl80211_disassociate,
8158                 .policy = nl80211_policy,
8159                 .flags = GENL_ADMIN_PERM,
8160                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8161                                   NL80211_FLAG_NEED_RTNL,
8162         },
8163         {
8164                 .cmd = NL80211_CMD_JOIN_IBSS,
8165                 .doit = nl80211_join_ibss,
8166                 .policy = nl80211_policy,
8167                 .flags = GENL_ADMIN_PERM,
8168                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8169                                   NL80211_FLAG_NEED_RTNL,
8170         },
8171         {
8172                 .cmd = NL80211_CMD_LEAVE_IBSS,
8173                 .doit = nl80211_leave_ibss,
8174                 .policy = nl80211_policy,
8175                 .flags = GENL_ADMIN_PERM,
8176                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8177                                   NL80211_FLAG_NEED_RTNL,
8178         },
8179 #ifdef CONFIG_NL80211_TESTMODE
8180         {
8181                 .cmd = NL80211_CMD_TESTMODE,
8182                 .doit = nl80211_testmode_do,
8183                 .dumpit = nl80211_testmode_dump,
8184                 .policy = nl80211_policy,
8185                 .flags = GENL_ADMIN_PERM,
8186                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8187                                   NL80211_FLAG_NEED_RTNL,
8188         },
8189 #endif
8190         {
8191                 .cmd = NL80211_CMD_CONNECT,
8192                 .doit = nl80211_connect,
8193                 .policy = nl80211_policy,
8194                 .flags = GENL_ADMIN_PERM,
8195                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8196                                   NL80211_FLAG_NEED_RTNL,
8197         },
8198         {
8199                 .cmd = NL80211_CMD_DISCONNECT,
8200                 .doit = nl80211_disconnect,
8201                 .policy = nl80211_policy,
8202                 .flags = GENL_ADMIN_PERM,
8203                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8204                                   NL80211_FLAG_NEED_RTNL,
8205         },
8206         {
8207                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
8208                 .doit = nl80211_wiphy_netns,
8209                 .policy = nl80211_policy,
8210                 .flags = GENL_ADMIN_PERM,
8211                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8212                                   NL80211_FLAG_NEED_RTNL,
8213         },
8214         {
8215                 .cmd = NL80211_CMD_GET_SURVEY,
8216                 .policy = nl80211_policy,
8217                 .dumpit = nl80211_dump_survey,
8218         },
8219         {
8220                 .cmd = NL80211_CMD_SET_PMKSA,
8221                 .doit = nl80211_setdel_pmksa,
8222                 .policy = nl80211_policy,
8223                 .flags = GENL_ADMIN_PERM,
8224                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8225                                   NL80211_FLAG_NEED_RTNL,
8226         },
8227         {
8228                 .cmd = NL80211_CMD_DEL_PMKSA,
8229                 .doit = nl80211_setdel_pmksa,
8230                 .policy = nl80211_policy,
8231                 .flags = GENL_ADMIN_PERM,
8232                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8233                                   NL80211_FLAG_NEED_RTNL,
8234         },
8235         {
8236                 .cmd = NL80211_CMD_FLUSH_PMKSA,
8237                 .doit = nl80211_flush_pmksa,
8238                 .policy = nl80211_policy,
8239                 .flags = GENL_ADMIN_PERM,
8240                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8241                                   NL80211_FLAG_NEED_RTNL,
8242         },
8243         {
8244                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
8245                 .doit = nl80211_remain_on_channel,
8246                 .policy = nl80211_policy,
8247                 .flags = GENL_ADMIN_PERM,
8248                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8249                                   NL80211_FLAG_NEED_RTNL,
8250         },
8251         {
8252                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
8253                 .doit = nl80211_cancel_remain_on_channel,
8254                 .policy = nl80211_policy,
8255                 .flags = GENL_ADMIN_PERM,
8256                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8257                                   NL80211_FLAG_NEED_RTNL,
8258         },
8259         {
8260                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
8261                 .doit = nl80211_set_tx_bitrate_mask,
8262                 .policy = nl80211_policy,
8263                 .flags = GENL_ADMIN_PERM,
8264                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8265                                   NL80211_FLAG_NEED_RTNL,
8266         },
8267         {
8268                 .cmd = NL80211_CMD_REGISTER_FRAME,
8269                 .doit = nl80211_register_mgmt,
8270                 .policy = nl80211_policy,
8271                 .flags = GENL_ADMIN_PERM,
8272                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8273                                   NL80211_FLAG_NEED_RTNL,
8274         },
8275         {
8276                 .cmd = NL80211_CMD_FRAME,
8277                 .doit = nl80211_tx_mgmt,
8278                 .policy = nl80211_policy,
8279                 .flags = GENL_ADMIN_PERM,
8280                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8281                                   NL80211_FLAG_NEED_RTNL,
8282         },
8283         {
8284                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
8285                 .doit = nl80211_tx_mgmt_cancel_wait,
8286                 .policy = nl80211_policy,
8287                 .flags = GENL_ADMIN_PERM,
8288                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8289                                   NL80211_FLAG_NEED_RTNL,
8290         },
8291         {
8292                 .cmd = NL80211_CMD_SET_POWER_SAVE,
8293                 .doit = nl80211_set_power_save,
8294                 .policy = nl80211_policy,
8295                 .flags = GENL_ADMIN_PERM,
8296                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8297                                   NL80211_FLAG_NEED_RTNL,
8298         },
8299         {
8300                 .cmd = NL80211_CMD_GET_POWER_SAVE,
8301                 .doit = nl80211_get_power_save,
8302                 .policy = nl80211_policy,
8303                 /* can be retrieved by unprivileged users */
8304                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8305                                   NL80211_FLAG_NEED_RTNL,
8306         },
8307         {
8308                 .cmd = NL80211_CMD_SET_CQM,
8309                 .doit = nl80211_set_cqm,
8310                 .policy = nl80211_policy,
8311                 .flags = GENL_ADMIN_PERM,
8312                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8313                                   NL80211_FLAG_NEED_RTNL,
8314         },
8315         {
8316                 .cmd = NL80211_CMD_SET_CHANNEL,
8317                 .doit = nl80211_set_channel,
8318                 .policy = nl80211_policy,
8319                 .flags = GENL_ADMIN_PERM,
8320                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8321                                   NL80211_FLAG_NEED_RTNL,
8322         },
8323         {
8324                 .cmd = NL80211_CMD_SET_WDS_PEER,
8325                 .doit = nl80211_set_wds_peer,
8326                 .policy = nl80211_policy,
8327                 .flags = GENL_ADMIN_PERM,
8328                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8329                                   NL80211_FLAG_NEED_RTNL,
8330         },
8331         {
8332                 .cmd = NL80211_CMD_JOIN_MESH,
8333                 .doit = nl80211_join_mesh,
8334                 .policy = nl80211_policy,
8335                 .flags = GENL_ADMIN_PERM,
8336                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8337                                   NL80211_FLAG_NEED_RTNL,
8338         },
8339         {
8340                 .cmd = NL80211_CMD_LEAVE_MESH,
8341                 .doit = nl80211_leave_mesh,
8342                 .policy = nl80211_policy,
8343                 .flags = GENL_ADMIN_PERM,
8344                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8345                                   NL80211_FLAG_NEED_RTNL,
8346         },
8347 #ifdef CONFIG_PM
8348         {
8349                 .cmd = NL80211_CMD_GET_WOWLAN,
8350                 .doit = nl80211_get_wowlan,
8351                 .policy = nl80211_policy,
8352                 /* can be retrieved by unprivileged users */
8353                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8354                                   NL80211_FLAG_NEED_RTNL,
8355         },
8356         {
8357                 .cmd = NL80211_CMD_SET_WOWLAN,
8358                 .doit = nl80211_set_wowlan,
8359                 .policy = nl80211_policy,
8360                 .flags = GENL_ADMIN_PERM,
8361                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8362                                   NL80211_FLAG_NEED_RTNL,
8363         },
8364 #endif
8365         {
8366                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
8367                 .doit = nl80211_set_rekey_data,
8368                 .policy = nl80211_policy,
8369                 .flags = GENL_ADMIN_PERM,
8370                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8371                                   NL80211_FLAG_NEED_RTNL,
8372         },
8373         {
8374                 .cmd = NL80211_CMD_TDLS_MGMT,
8375                 .doit = nl80211_tdls_mgmt,
8376                 .policy = nl80211_policy,
8377                 .flags = GENL_ADMIN_PERM,
8378                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8379                                   NL80211_FLAG_NEED_RTNL,
8380         },
8381         {
8382                 .cmd = NL80211_CMD_TDLS_OPER,
8383                 .doit = nl80211_tdls_oper,
8384                 .policy = nl80211_policy,
8385                 .flags = GENL_ADMIN_PERM,
8386                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8387                                   NL80211_FLAG_NEED_RTNL,
8388         },
8389         {
8390                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
8391                 .doit = nl80211_register_unexpected_frame,
8392                 .policy = nl80211_policy,
8393                 .flags = GENL_ADMIN_PERM,
8394                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8395                                   NL80211_FLAG_NEED_RTNL,
8396         },
8397         {
8398                 .cmd = NL80211_CMD_PROBE_CLIENT,
8399                 .doit = nl80211_probe_client,
8400                 .policy = nl80211_policy,
8401                 .flags = GENL_ADMIN_PERM,
8402                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8403                                   NL80211_FLAG_NEED_RTNL,
8404         },
8405         {
8406                 .cmd = NL80211_CMD_REGISTER_BEACONS,
8407                 .doit = nl80211_register_beacons,
8408                 .policy = nl80211_policy,
8409                 .flags = GENL_ADMIN_PERM,
8410                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8411                                   NL80211_FLAG_NEED_RTNL,
8412         },
8413         {
8414                 .cmd = NL80211_CMD_SET_NOACK_MAP,
8415                 .doit = nl80211_set_noack_map,
8416                 .policy = nl80211_policy,
8417                 .flags = GENL_ADMIN_PERM,
8418                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8419                                   NL80211_FLAG_NEED_RTNL,
8420         },
8421         {
8422                 .cmd = NL80211_CMD_START_P2P_DEVICE,
8423                 .doit = nl80211_start_p2p_device,
8424                 .policy = nl80211_policy,
8425                 .flags = GENL_ADMIN_PERM,
8426                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8427                                   NL80211_FLAG_NEED_RTNL,
8428         },
8429         {
8430                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
8431                 .doit = nl80211_stop_p2p_device,
8432                 .policy = nl80211_policy,
8433                 .flags = GENL_ADMIN_PERM,
8434                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8435                                   NL80211_FLAG_NEED_RTNL,
8436         },
8437         {
8438                 .cmd = NL80211_CMD_SET_MCAST_RATE,
8439                 .doit = nl80211_set_mcast_rate,
8440                 .policy = nl80211_policy,
8441                 .flags = GENL_ADMIN_PERM,
8442                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8443                                   NL80211_FLAG_NEED_RTNL,
8444         },
8445         {
8446                 .cmd = NL80211_CMD_SET_MAC_ACL,
8447                 .doit = nl80211_set_mac_acl,
8448                 .policy = nl80211_policy,
8449                 .flags = GENL_ADMIN_PERM,
8450                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8451                                   NL80211_FLAG_NEED_RTNL,
8452         },
8453         {
8454                 .cmd = NL80211_CMD_RADAR_DETECT,
8455                 .doit = nl80211_start_radar_detection,
8456                 .policy = nl80211_policy,
8457                 .flags = GENL_ADMIN_PERM,
8458                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8459                                   NL80211_FLAG_NEED_RTNL,
8460         },
8461 };
8462
8463 static struct genl_multicast_group nl80211_mlme_mcgrp = {
8464         .name = "mlme",
8465 };
8466
8467 /* multicast groups */
8468 static struct genl_multicast_group nl80211_config_mcgrp = {
8469         .name = "config",
8470 };
8471 static struct genl_multicast_group nl80211_scan_mcgrp = {
8472         .name = "scan",
8473 };
8474 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
8475         .name = "regulatory",
8476 };
8477
8478 /* notification functions */
8479
8480 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
8481 {
8482         struct sk_buff *msg;
8483
8484         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8485         if (!msg)
8486                 return;
8487
8488         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
8489                 nlmsg_free(msg);
8490                 return;
8491         }
8492
8493         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8494                                 nl80211_config_mcgrp.id, GFP_KERNEL);
8495 }
8496
8497 static int nl80211_add_scan_req(struct sk_buff *msg,
8498                                 struct cfg80211_registered_device *rdev)
8499 {
8500         struct cfg80211_scan_request *req = rdev->scan_req;
8501         struct nlattr *nest;
8502         int i;
8503
8504         ASSERT_RDEV_LOCK(rdev);
8505
8506         if (WARN_ON(!req))
8507                 return 0;
8508
8509         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
8510         if (!nest)
8511                 goto nla_put_failure;
8512         for (i = 0; i < req->n_ssids; i++) {
8513                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
8514                         goto nla_put_failure;
8515         }
8516         nla_nest_end(msg, nest);
8517
8518         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
8519         if (!nest)
8520                 goto nla_put_failure;
8521         for (i = 0; i < req->n_channels; i++) {
8522                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
8523                         goto nla_put_failure;
8524         }
8525         nla_nest_end(msg, nest);
8526
8527         if (req->ie &&
8528             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
8529                 goto nla_put_failure;
8530
8531         if (req->flags)
8532                 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags);
8533
8534         return 0;
8535  nla_put_failure:
8536         return -ENOBUFS;
8537 }
8538
8539 static int nl80211_send_scan_msg(struct sk_buff *msg,
8540                                  struct cfg80211_registered_device *rdev,
8541                                  struct wireless_dev *wdev,
8542                                  u32 portid, u32 seq, int flags,
8543                                  u32 cmd)
8544 {
8545         void *hdr;
8546
8547         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
8548         if (!hdr)
8549                 return -1;
8550
8551         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8552             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
8553                                          wdev->netdev->ifindex)) ||
8554             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
8555                 goto nla_put_failure;
8556
8557         /* ignore errors and send incomplete event anyway */
8558         nl80211_add_scan_req(msg, rdev);
8559
8560         return genlmsg_end(msg, hdr);
8561
8562  nla_put_failure:
8563         genlmsg_cancel(msg, hdr);
8564         return -EMSGSIZE;
8565 }
8566
8567 static int
8568 nl80211_send_sched_scan_msg(struct sk_buff *msg,
8569                             struct cfg80211_registered_device *rdev,
8570                             struct net_device *netdev,
8571                             u32 portid, u32 seq, int flags, u32 cmd)
8572 {
8573         void *hdr;
8574
8575         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
8576         if (!hdr)
8577                 return -1;
8578
8579         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8580             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
8581                 goto nla_put_failure;
8582
8583         return genlmsg_end(msg, hdr);
8584
8585  nla_put_failure:
8586         genlmsg_cancel(msg, hdr);
8587         return -EMSGSIZE;
8588 }
8589
8590 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
8591                              struct wireless_dev *wdev)
8592 {
8593         struct sk_buff *msg;
8594
8595         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8596         if (!msg)
8597                 return;
8598
8599         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
8600                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
8601                 nlmsg_free(msg);
8602                 return;
8603         }
8604
8605         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8606                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
8607 }
8608
8609 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
8610                             struct wireless_dev *wdev)
8611 {
8612         struct sk_buff *msg;
8613
8614         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8615         if (!msg)
8616                 return;
8617
8618         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
8619                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
8620                 nlmsg_free(msg);
8621                 return;
8622         }
8623
8624         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8625                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
8626 }
8627
8628 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
8629                                struct wireless_dev *wdev)
8630 {
8631         struct sk_buff *msg;
8632
8633         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8634         if (!msg)
8635                 return;
8636
8637         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
8638                                   NL80211_CMD_SCAN_ABORTED) < 0) {
8639                 nlmsg_free(msg);
8640                 return;
8641         }
8642
8643         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8644                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
8645 }
8646
8647 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
8648                                      struct net_device *netdev)
8649 {
8650         struct sk_buff *msg;
8651
8652         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8653         if (!msg)
8654                 return;
8655
8656         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
8657                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
8658                 nlmsg_free(msg);
8659                 return;
8660         }
8661
8662         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8663                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
8664 }
8665
8666 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
8667                              struct net_device *netdev, u32 cmd)
8668 {
8669         struct sk_buff *msg;
8670
8671         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8672         if (!msg)
8673                 return;
8674
8675         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
8676                 nlmsg_free(msg);
8677                 return;
8678         }
8679
8680         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8681                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
8682 }
8683
8684 /*
8685  * This can happen on global regulatory changes or device specific settings
8686  * based on custom world regulatory domains.
8687  */
8688 void nl80211_send_reg_change_event(struct regulatory_request *request)
8689 {
8690         struct sk_buff *msg;
8691         void *hdr;
8692
8693         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8694         if (!msg)
8695                 return;
8696
8697         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
8698         if (!hdr) {
8699                 nlmsg_free(msg);
8700                 return;
8701         }
8702
8703         /* Userspace can always count this one always being set */
8704         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
8705                 goto nla_put_failure;
8706
8707         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
8708                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
8709                                NL80211_REGDOM_TYPE_WORLD))
8710                         goto nla_put_failure;
8711         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
8712                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
8713                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
8714                         goto nla_put_failure;
8715         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
8716                    request->intersect) {
8717                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
8718                                NL80211_REGDOM_TYPE_INTERSECTION))
8719                         goto nla_put_failure;
8720         } else {
8721                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
8722                                NL80211_REGDOM_TYPE_COUNTRY) ||
8723                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
8724                                    request->alpha2))
8725                         goto nla_put_failure;
8726         }
8727
8728         if (request->wiphy_idx != WIPHY_IDX_INVALID &&
8729             nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
8730                 goto nla_put_failure;
8731
8732         genlmsg_end(msg, hdr);
8733
8734         rcu_read_lock();
8735         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
8736                                 GFP_ATOMIC);
8737         rcu_read_unlock();
8738
8739         return;
8740
8741 nla_put_failure:
8742         genlmsg_cancel(msg, hdr);
8743         nlmsg_free(msg);
8744 }
8745
8746 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
8747                                     struct net_device *netdev,
8748                                     const u8 *buf, size_t len,
8749                                     enum nl80211_commands cmd, gfp_t gfp)
8750 {
8751         struct sk_buff *msg;
8752         void *hdr;
8753
8754         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8755         if (!msg)
8756                 return;
8757
8758         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
8759         if (!hdr) {
8760                 nlmsg_free(msg);
8761                 return;
8762         }
8763
8764         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8765             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8766             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
8767                 goto nla_put_failure;
8768
8769         genlmsg_end(msg, hdr);
8770
8771         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8772                                 nl80211_mlme_mcgrp.id, gfp);
8773         return;
8774
8775  nla_put_failure:
8776         genlmsg_cancel(msg, hdr);
8777         nlmsg_free(msg);
8778 }
8779
8780 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
8781                           struct net_device *netdev, const u8 *buf,
8782                           size_t len, gfp_t gfp)
8783 {
8784         nl80211_send_mlme_event(rdev, netdev, buf, len,
8785                                 NL80211_CMD_AUTHENTICATE, gfp);
8786 }
8787
8788 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
8789                            struct net_device *netdev, const u8 *buf,
8790                            size_t len, gfp_t gfp)
8791 {
8792         nl80211_send_mlme_event(rdev, netdev, buf, len,
8793                                 NL80211_CMD_ASSOCIATE, gfp);
8794 }
8795
8796 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
8797                          struct net_device *netdev, const u8 *buf,
8798                          size_t len, gfp_t gfp)
8799 {
8800         nl80211_send_mlme_event(rdev, netdev, buf, len,
8801                                 NL80211_CMD_DEAUTHENTICATE, gfp);
8802 }
8803
8804 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
8805                            struct net_device *netdev, const u8 *buf,
8806                            size_t len, gfp_t gfp)
8807 {
8808         nl80211_send_mlme_event(rdev, netdev, buf, len,
8809                                 NL80211_CMD_DISASSOCIATE, gfp);
8810 }
8811
8812 void nl80211_send_unprot_deauth(struct cfg80211_registered_device *rdev,
8813                                 struct net_device *netdev, const u8 *buf,
8814                                 size_t len, gfp_t gfp)
8815 {
8816         nl80211_send_mlme_event(rdev, netdev, buf, len,
8817                                 NL80211_CMD_UNPROT_DEAUTHENTICATE, gfp);
8818 }
8819
8820 void nl80211_send_unprot_disassoc(struct cfg80211_registered_device *rdev,
8821                                   struct net_device *netdev, const u8 *buf,
8822                                   size_t len, gfp_t gfp)
8823 {
8824         nl80211_send_mlme_event(rdev, netdev, buf, len,
8825                                 NL80211_CMD_UNPROT_DISASSOCIATE, gfp);
8826 }
8827
8828 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
8829                                       struct net_device *netdev, int cmd,
8830                                       const u8 *addr, gfp_t gfp)
8831 {
8832         struct sk_buff *msg;
8833         void *hdr;
8834
8835         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8836         if (!msg)
8837                 return;
8838
8839         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
8840         if (!hdr) {
8841                 nlmsg_free(msg);
8842                 return;
8843         }
8844
8845         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8846             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8847             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
8848             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
8849                 goto nla_put_failure;
8850
8851         genlmsg_end(msg, hdr);
8852
8853         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8854                                 nl80211_mlme_mcgrp.id, gfp);
8855         return;
8856
8857  nla_put_failure:
8858         genlmsg_cancel(msg, hdr);
8859         nlmsg_free(msg);
8860 }
8861
8862 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
8863                                struct net_device *netdev, const u8 *addr,
8864                                gfp_t gfp)
8865 {
8866         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
8867                                   addr, gfp);
8868 }
8869
8870 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
8871                                 struct net_device *netdev, const u8 *addr,
8872                                 gfp_t gfp)
8873 {
8874         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
8875                                   addr, gfp);
8876 }
8877
8878 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
8879                                  struct net_device *netdev, const u8 *bssid,
8880                                  const u8 *req_ie, size_t req_ie_len,
8881                                  const u8 *resp_ie, size_t resp_ie_len,
8882                                  u16 status, gfp_t gfp)
8883 {
8884         struct sk_buff *msg;
8885         void *hdr;
8886
8887         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8888         if (!msg)
8889                 return;
8890
8891         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
8892         if (!hdr) {
8893                 nlmsg_free(msg);
8894                 return;
8895         }
8896
8897         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8898             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8899             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
8900             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
8901             (req_ie &&
8902              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
8903             (resp_ie &&
8904              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
8905                 goto nla_put_failure;
8906
8907         genlmsg_end(msg, hdr);
8908
8909         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8910                                 nl80211_mlme_mcgrp.id, gfp);
8911         return;
8912
8913  nla_put_failure:
8914         genlmsg_cancel(msg, hdr);
8915         nlmsg_free(msg);
8916
8917 }
8918
8919 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
8920                          struct net_device *netdev, const u8 *bssid,
8921                          const u8 *req_ie, size_t req_ie_len,
8922                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
8923 {
8924         struct sk_buff *msg;
8925         void *hdr;
8926
8927         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8928         if (!msg)
8929                 return;
8930
8931         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
8932         if (!hdr) {
8933                 nlmsg_free(msg);
8934                 return;
8935         }
8936
8937         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8938             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8939             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
8940             (req_ie &&
8941              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
8942             (resp_ie &&
8943              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
8944                 goto nla_put_failure;
8945
8946         genlmsg_end(msg, hdr);
8947
8948         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8949                                 nl80211_mlme_mcgrp.id, gfp);
8950         return;
8951
8952  nla_put_failure:
8953         genlmsg_cancel(msg, hdr);
8954         nlmsg_free(msg);
8955
8956 }
8957
8958 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
8959                                struct net_device *netdev, u16 reason,
8960                                const u8 *ie, size_t ie_len, bool from_ap)
8961 {
8962         struct sk_buff *msg;
8963         void *hdr;
8964
8965         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8966         if (!msg)
8967                 return;
8968
8969         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
8970         if (!hdr) {
8971                 nlmsg_free(msg);
8972                 return;
8973         }
8974
8975         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8976             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8977             (from_ap && reason &&
8978              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
8979             (from_ap &&
8980              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
8981             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
8982                 goto nla_put_failure;
8983
8984         genlmsg_end(msg, hdr);
8985
8986         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8987                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
8988         return;
8989
8990  nla_put_failure:
8991         genlmsg_cancel(msg, hdr);
8992         nlmsg_free(msg);
8993
8994 }
8995
8996 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
8997                              struct net_device *netdev, const u8 *bssid,
8998                              gfp_t gfp)
8999 {
9000         struct sk_buff *msg;
9001         void *hdr;
9002
9003         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9004         if (!msg)
9005                 return;
9006
9007         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
9008         if (!hdr) {
9009                 nlmsg_free(msg);
9010                 return;
9011         }
9012
9013         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9014             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9015             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
9016                 goto nla_put_failure;
9017
9018         genlmsg_end(msg, hdr);
9019
9020         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9021                                 nl80211_mlme_mcgrp.id, gfp);
9022         return;
9023
9024  nla_put_failure:
9025         genlmsg_cancel(msg, hdr);
9026         nlmsg_free(msg);
9027 }
9028
9029 void nl80211_send_new_peer_candidate(struct cfg80211_registered_device *rdev,
9030                 struct net_device *netdev,
9031                 const u8 *macaddr, const u8* ie, u8 ie_len,
9032                 gfp_t gfp)
9033 {
9034         struct sk_buff *msg;
9035         void *hdr;
9036
9037         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9038         if (!msg)
9039                 return;
9040
9041         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
9042         if (!hdr) {
9043                 nlmsg_free(msg);
9044                 return;
9045         }
9046
9047         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9048             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9049             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, macaddr) ||
9050             (ie_len && ie &&
9051              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
9052                 goto nla_put_failure;
9053
9054         genlmsg_end(msg, hdr);
9055
9056         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9057                                 nl80211_mlme_mcgrp.id, gfp);
9058         return;
9059
9060  nla_put_failure:
9061         genlmsg_cancel(msg, hdr);
9062         nlmsg_free(msg);
9063 }
9064
9065 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
9066                                  struct net_device *netdev, const u8 *addr,
9067                                  enum nl80211_key_type key_type, int key_id,
9068                                  const u8 *tsc, gfp_t gfp)
9069 {
9070         struct sk_buff *msg;
9071         void *hdr;
9072
9073         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9074         if (!msg)
9075                 return;
9076
9077         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
9078         if (!hdr) {
9079                 nlmsg_free(msg);
9080                 return;
9081         }
9082
9083         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9084             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9085             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
9086             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
9087             (key_id != -1 &&
9088              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
9089             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
9090                 goto nla_put_failure;
9091
9092         genlmsg_end(msg, hdr);
9093
9094         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9095                                 nl80211_mlme_mcgrp.id, gfp);
9096         return;
9097
9098  nla_put_failure:
9099         genlmsg_cancel(msg, hdr);
9100         nlmsg_free(msg);
9101 }
9102
9103 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
9104                                     struct ieee80211_channel *channel_before,
9105                                     struct ieee80211_channel *channel_after)
9106 {
9107         struct sk_buff *msg;
9108         void *hdr;
9109         struct nlattr *nl_freq;
9110
9111         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
9112         if (!msg)
9113                 return;
9114
9115         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
9116         if (!hdr) {
9117                 nlmsg_free(msg);
9118                 return;
9119         }
9120
9121         /*
9122          * Since we are applying the beacon hint to a wiphy we know its
9123          * wiphy_idx is valid
9124          */
9125         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
9126                 goto nla_put_failure;
9127
9128         /* Before */
9129         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
9130         if (!nl_freq)
9131                 goto nla_put_failure;
9132         if (nl80211_msg_put_channel(msg, channel_before))
9133                 goto nla_put_failure;
9134         nla_nest_end(msg, nl_freq);
9135
9136         /* After */
9137         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
9138         if (!nl_freq)
9139                 goto nla_put_failure;
9140         if (nl80211_msg_put_channel(msg, channel_after))
9141                 goto nla_put_failure;
9142         nla_nest_end(msg, nl_freq);
9143
9144         genlmsg_end(msg, hdr);
9145
9146         rcu_read_lock();
9147         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
9148                                 GFP_ATOMIC);
9149         rcu_read_unlock();
9150
9151         return;
9152
9153 nla_put_failure:
9154         genlmsg_cancel(msg, hdr);
9155         nlmsg_free(msg);
9156 }
9157
9158 static void nl80211_send_remain_on_chan_event(
9159         int cmd, struct cfg80211_registered_device *rdev,
9160         struct wireless_dev *wdev, u64 cookie,
9161         struct ieee80211_channel *chan,
9162         unsigned int duration, gfp_t gfp)
9163 {
9164         struct sk_buff *msg;
9165         void *hdr;
9166
9167         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9168         if (!msg)
9169                 return;
9170
9171         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9172         if (!hdr) {
9173                 nlmsg_free(msg);
9174                 return;
9175         }
9176
9177         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9178             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9179                                          wdev->netdev->ifindex)) ||
9180             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
9181             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
9182             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
9183                         NL80211_CHAN_NO_HT) ||
9184             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
9185                 goto nla_put_failure;
9186
9187         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
9188             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
9189                 goto nla_put_failure;
9190
9191         genlmsg_end(msg, hdr);
9192
9193         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9194                                 nl80211_mlme_mcgrp.id, gfp);
9195         return;
9196
9197  nla_put_failure:
9198         genlmsg_cancel(msg, hdr);
9199         nlmsg_free(msg);
9200 }
9201
9202 void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
9203                                     struct wireless_dev *wdev, u64 cookie,
9204                                     struct ieee80211_channel *chan,
9205                                     unsigned int duration, gfp_t gfp)
9206 {
9207         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
9208                                           rdev, wdev, cookie, chan,
9209                                           duration, gfp);
9210 }
9211
9212 void nl80211_send_remain_on_channel_cancel(
9213         struct cfg80211_registered_device *rdev,
9214         struct wireless_dev *wdev,
9215         u64 cookie, struct ieee80211_channel *chan, gfp_t gfp)
9216 {
9217         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
9218                                           rdev, wdev, cookie, chan, 0, gfp);
9219 }
9220
9221 void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
9222                             struct net_device *dev, const u8 *mac_addr,
9223                             struct station_info *sinfo, gfp_t gfp)
9224 {
9225         struct sk_buff *msg;
9226
9227         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9228         if (!msg)
9229                 return;
9230
9231         if (nl80211_send_station(msg, 0, 0, 0,
9232                                  rdev, dev, mac_addr, sinfo) < 0) {
9233                 nlmsg_free(msg);
9234                 return;
9235         }
9236
9237         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9238                                 nl80211_mlme_mcgrp.id, gfp);
9239 }
9240
9241 void nl80211_send_sta_del_event(struct cfg80211_registered_device *rdev,
9242                                 struct net_device *dev, const u8 *mac_addr,
9243                                 gfp_t gfp)
9244 {
9245         struct sk_buff *msg;
9246         void *hdr;
9247
9248         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9249         if (!msg)
9250                 return;
9251
9252         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
9253         if (!hdr) {
9254                 nlmsg_free(msg);
9255                 return;
9256         }
9257
9258         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9259             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
9260                 goto nla_put_failure;
9261
9262         genlmsg_end(msg, hdr);
9263
9264         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9265                                 nl80211_mlme_mcgrp.id, gfp);
9266         return;
9267
9268  nla_put_failure:
9269         genlmsg_cancel(msg, hdr);
9270         nlmsg_free(msg);
9271 }
9272
9273 void nl80211_send_conn_failed_event(struct cfg80211_registered_device *rdev,
9274                                     struct net_device *dev, const u8 *mac_addr,
9275                                     enum nl80211_connect_failed_reason reason,
9276                                     gfp_t gfp)
9277 {
9278         struct sk_buff *msg;
9279         void *hdr;
9280
9281         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
9282         if (!msg)
9283                 return;
9284
9285         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
9286         if (!hdr) {
9287                 nlmsg_free(msg);
9288                 return;
9289         }
9290
9291         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9292             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
9293             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
9294                 goto nla_put_failure;
9295
9296         genlmsg_end(msg, hdr);
9297
9298         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9299                                 nl80211_mlme_mcgrp.id, gfp);
9300         return;
9301
9302  nla_put_failure:
9303         genlmsg_cancel(msg, hdr);
9304         nlmsg_free(msg);
9305 }
9306
9307 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
9308                                        const u8 *addr, gfp_t gfp)
9309 {
9310         struct wireless_dev *wdev = dev->ieee80211_ptr;
9311         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9312         struct sk_buff *msg;
9313         void *hdr;
9314         int err;
9315         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
9316
9317         if (!nlportid)
9318                 return false;
9319
9320         msg = nlmsg_new(100, gfp);
9321         if (!msg)
9322                 return true;
9323
9324         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9325         if (!hdr) {
9326                 nlmsg_free(msg);
9327                 return true;
9328         }
9329
9330         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9331             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9332             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
9333                 goto nla_put_failure;
9334
9335         err = genlmsg_end(msg, hdr);
9336         if (err < 0) {
9337                 nlmsg_free(msg);
9338                 return true;
9339         }
9340
9341         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
9342         return true;
9343
9344  nla_put_failure:
9345         genlmsg_cancel(msg, hdr);
9346         nlmsg_free(msg);
9347         return true;
9348 }
9349
9350 bool nl80211_unexpected_frame(struct net_device *dev, const u8 *addr, gfp_t gfp)
9351 {
9352         return __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
9353                                           addr, gfp);
9354 }
9355
9356 bool nl80211_unexpected_4addr_frame(struct net_device *dev,
9357                                     const u8 *addr, gfp_t gfp)
9358 {
9359         return __nl80211_unexpected_frame(dev,
9360                                           NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
9361                                           addr, gfp);
9362 }
9363
9364 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
9365                       struct wireless_dev *wdev, u32 nlportid,
9366                       int freq, int sig_dbm,
9367                       const u8 *buf, size_t len, gfp_t gfp)
9368 {
9369         struct net_device *netdev = wdev->netdev;
9370         struct sk_buff *msg;
9371         void *hdr;
9372
9373         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9374         if (!msg)
9375                 return -ENOMEM;
9376
9377         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
9378         if (!hdr) {
9379                 nlmsg_free(msg);
9380                 return -ENOMEM;
9381         }
9382
9383         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9384             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9385                                         netdev->ifindex)) ||
9386             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
9387             (sig_dbm &&
9388              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
9389             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
9390                 goto nla_put_failure;
9391
9392         genlmsg_end(msg, hdr);
9393
9394         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
9395
9396  nla_put_failure:
9397         genlmsg_cancel(msg, hdr);
9398         nlmsg_free(msg);
9399         return -ENOBUFS;
9400 }
9401
9402 void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
9403                                  struct wireless_dev *wdev, u64 cookie,
9404                                  const u8 *buf, size_t len, bool ack,
9405                                  gfp_t gfp)
9406 {
9407         struct net_device *netdev = wdev->netdev;
9408         struct sk_buff *msg;
9409         void *hdr;
9410
9411         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9412         if (!msg)
9413                 return;
9414
9415         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
9416         if (!hdr) {
9417                 nlmsg_free(msg);
9418                 return;
9419         }
9420
9421         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9422             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9423                                    netdev->ifindex)) ||
9424             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
9425             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
9426             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
9427                 goto nla_put_failure;
9428
9429         genlmsg_end(msg, hdr);
9430
9431         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
9432         return;
9433
9434  nla_put_failure:
9435         genlmsg_cancel(msg, hdr);
9436         nlmsg_free(msg);
9437 }
9438
9439 void
9440 nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
9441                              struct net_device *netdev,
9442                              enum nl80211_cqm_rssi_threshold_event rssi_event,
9443                              gfp_t gfp)
9444 {
9445         struct sk_buff *msg;
9446         struct nlattr *pinfoattr;
9447         void *hdr;
9448
9449         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9450         if (!msg)
9451                 return;
9452
9453         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
9454         if (!hdr) {
9455                 nlmsg_free(msg);
9456                 return;
9457         }
9458
9459         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9460             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
9461                 goto nla_put_failure;
9462
9463         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
9464         if (!pinfoattr)
9465                 goto nla_put_failure;
9466
9467         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
9468                         rssi_event))
9469                 goto nla_put_failure;
9470
9471         nla_nest_end(msg, pinfoattr);
9472
9473         genlmsg_end(msg, hdr);
9474
9475         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9476                                 nl80211_mlme_mcgrp.id, gfp);
9477         return;
9478
9479  nla_put_failure:
9480         genlmsg_cancel(msg, hdr);
9481         nlmsg_free(msg);
9482 }
9483
9484 void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
9485                               struct net_device *netdev, const u8 *bssid,
9486                               const u8 *replay_ctr, gfp_t gfp)
9487 {
9488         struct sk_buff *msg;
9489         struct nlattr *rekey_attr;
9490         void *hdr;
9491
9492         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9493         if (!msg)
9494                 return;
9495
9496         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
9497         if (!hdr) {
9498                 nlmsg_free(msg);
9499                 return;
9500         }
9501
9502         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9503             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9504             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
9505                 goto nla_put_failure;
9506
9507         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
9508         if (!rekey_attr)
9509                 goto nla_put_failure;
9510
9511         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
9512                     NL80211_REPLAY_CTR_LEN, replay_ctr))
9513                 goto nla_put_failure;
9514
9515         nla_nest_end(msg, rekey_attr);
9516
9517         genlmsg_end(msg, hdr);
9518
9519         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9520                                 nl80211_mlme_mcgrp.id, gfp);
9521         return;
9522
9523  nla_put_failure:
9524         genlmsg_cancel(msg, hdr);
9525         nlmsg_free(msg);
9526 }
9527
9528 void nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
9529                                     struct net_device *netdev, int index,
9530                                     const u8 *bssid, bool preauth, gfp_t gfp)
9531 {
9532         struct sk_buff *msg;
9533         struct nlattr *attr;
9534         void *hdr;
9535
9536         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9537         if (!msg)
9538                 return;
9539
9540         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
9541         if (!hdr) {
9542                 nlmsg_free(msg);
9543                 return;
9544         }
9545
9546         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9547             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
9548                 goto nla_put_failure;
9549
9550         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
9551         if (!attr)
9552                 goto nla_put_failure;
9553
9554         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
9555             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
9556             (preauth &&
9557              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
9558                 goto nla_put_failure;
9559
9560         nla_nest_end(msg, attr);
9561
9562         genlmsg_end(msg, hdr);
9563
9564         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9565                                 nl80211_mlme_mcgrp.id, gfp);
9566         return;
9567
9568  nla_put_failure:
9569         genlmsg_cancel(msg, hdr);
9570         nlmsg_free(msg);
9571 }
9572
9573 void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
9574                               struct net_device *netdev,
9575                               struct cfg80211_chan_def *chandef, gfp_t gfp)
9576 {
9577         struct sk_buff *msg;
9578         void *hdr;
9579
9580         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9581         if (!msg)
9582                 return;
9583
9584         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
9585         if (!hdr) {
9586                 nlmsg_free(msg);
9587                 return;
9588         }
9589
9590         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
9591                 goto nla_put_failure;
9592
9593         if (nl80211_send_chandef(msg, chandef))
9594                 goto nla_put_failure;
9595
9596         genlmsg_end(msg, hdr);
9597
9598         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9599                                 nl80211_mlme_mcgrp.id, gfp);
9600         return;
9601
9602  nla_put_failure:
9603         genlmsg_cancel(msg, hdr);
9604         nlmsg_free(msg);
9605 }
9606
9607 void
9608 nl80211_send_cqm_txe_notify(struct cfg80211_registered_device *rdev,
9609                             struct net_device *netdev, const u8 *peer,
9610                             u32 num_packets, u32 rate, u32 intvl, gfp_t gfp)
9611 {
9612         struct sk_buff *msg;
9613         struct nlattr *pinfoattr;
9614         void *hdr;
9615
9616         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
9617         if (!msg)
9618                 return;
9619
9620         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
9621         if (!hdr) {
9622                 nlmsg_free(msg);
9623                 return;
9624         }
9625
9626         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9627             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9628             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
9629                 goto nla_put_failure;
9630
9631         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
9632         if (!pinfoattr)
9633                 goto nla_put_failure;
9634
9635         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
9636                 goto nla_put_failure;
9637
9638         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
9639                 goto nla_put_failure;
9640
9641         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
9642                 goto nla_put_failure;
9643
9644         nla_nest_end(msg, pinfoattr);
9645
9646         genlmsg_end(msg, hdr);
9647
9648         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9649                                 nl80211_mlme_mcgrp.id, gfp);
9650         return;
9651
9652  nla_put_failure:
9653         genlmsg_cancel(msg, hdr);
9654         nlmsg_free(msg);
9655 }
9656
9657 void
9658 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
9659                      struct cfg80211_chan_def *chandef,
9660                      enum nl80211_radar_event event,
9661                      struct net_device *netdev, gfp_t gfp)
9662 {
9663         struct sk_buff *msg;
9664         void *hdr;
9665
9666         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9667         if (!msg)
9668                 return;
9669
9670         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
9671         if (!hdr) {
9672                 nlmsg_free(msg);
9673                 return;
9674         }
9675
9676         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
9677                 goto nla_put_failure;
9678
9679         /* NOP and radar events don't need a netdev parameter */
9680         if (netdev) {
9681                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
9682
9683                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9684                     nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
9685                         goto nla_put_failure;
9686         }
9687
9688         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
9689                 goto nla_put_failure;
9690
9691         if (nl80211_send_chandef(msg, chandef))
9692                 goto nla_put_failure;
9693
9694         if (genlmsg_end(msg, hdr) < 0) {
9695                 nlmsg_free(msg);
9696                 return;
9697         }
9698
9699         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9700                                 nl80211_mlme_mcgrp.id, gfp);
9701         return;
9702
9703  nla_put_failure:
9704         genlmsg_cancel(msg, hdr);
9705         nlmsg_free(msg);
9706 }
9707
9708 void
9709 nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
9710                                 struct net_device *netdev, const u8 *peer,
9711                                 u32 num_packets, gfp_t gfp)
9712 {
9713         struct sk_buff *msg;
9714         struct nlattr *pinfoattr;
9715         void *hdr;
9716
9717         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9718         if (!msg)
9719                 return;
9720
9721         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
9722         if (!hdr) {
9723                 nlmsg_free(msg);
9724                 return;
9725         }
9726
9727         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9728             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9729             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
9730                 goto nla_put_failure;
9731
9732         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
9733         if (!pinfoattr)
9734                 goto nla_put_failure;
9735
9736         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
9737                 goto nla_put_failure;
9738
9739         nla_nest_end(msg, pinfoattr);
9740
9741         genlmsg_end(msg, hdr);
9742
9743         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9744                                 nl80211_mlme_mcgrp.id, gfp);
9745         return;
9746
9747  nla_put_failure:
9748         genlmsg_cancel(msg, hdr);
9749         nlmsg_free(msg);
9750 }
9751
9752 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
9753                            u64 cookie, bool acked, gfp_t gfp)
9754 {
9755         struct wireless_dev *wdev = dev->ieee80211_ptr;
9756         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9757         struct sk_buff *msg;
9758         void *hdr;
9759         int err;
9760
9761         trace_cfg80211_probe_status(dev, addr, cookie, acked);
9762
9763         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9764
9765         if (!msg)
9766                 return;
9767
9768         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
9769         if (!hdr) {
9770                 nlmsg_free(msg);
9771                 return;
9772         }
9773
9774         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9775             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9776             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
9777             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
9778             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
9779                 goto nla_put_failure;
9780
9781         err = genlmsg_end(msg, hdr);
9782         if (err < 0) {
9783                 nlmsg_free(msg);
9784                 return;
9785         }
9786
9787         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9788                                 nl80211_mlme_mcgrp.id, gfp);
9789         return;
9790
9791  nla_put_failure:
9792         genlmsg_cancel(msg, hdr);
9793         nlmsg_free(msg);
9794 }
9795 EXPORT_SYMBOL(cfg80211_probe_status);
9796
9797 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
9798                                  const u8 *frame, size_t len,
9799                                  int freq, int sig_dbm)
9800 {
9801         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9802         struct sk_buff *msg;
9803         void *hdr;
9804         struct cfg80211_beacon_registration *reg;
9805
9806         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
9807
9808         spin_lock_bh(&rdev->beacon_registrations_lock);
9809         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
9810                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
9811                 if (!msg) {
9812                         spin_unlock_bh(&rdev->beacon_registrations_lock);
9813                         return;
9814                 }
9815
9816                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
9817                 if (!hdr)
9818                         goto nla_put_failure;
9819
9820                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9821                     (freq &&
9822                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
9823                     (sig_dbm &&
9824                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
9825                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
9826                         goto nla_put_failure;
9827
9828                 genlmsg_end(msg, hdr);
9829
9830                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
9831         }
9832         spin_unlock_bh(&rdev->beacon_registrations_lock);
9833         return;
9834
9835  nla_put_failure:
9836         spin_unlock_bh(&rdev->beacon_registrations_lock);
9837         if (hdr)
9838                 genlmsg_cancel(msg, hdr);
9839         nlmsg_free(msg);
9840 }
9841 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
9842
9843 #ifdef CONFIG_PM
9844 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
9845                                    struct cfg80211_wowlan_wakeup *wakeup,
9846                                    gfp_t gfp)
9847 {
9848         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9849         struct sk_buff *msg;
9850         void *hdr;
9851         int err, size = 200;
9852
9853         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
9854
9855         if (wakeup)
9856                 size += wakeup->packet_present_len;
9857
9858         msg = nlmsg_new(size, gfp);
9859         if (!msg)
9860                 return;
9861
9862         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
9863         if (!hdr)
9864                 goto free_msg;
9865
9866         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9867             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
9868                 goto free_msg;
9869
9870         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9871                                         wdev->netdev->ifindex))
9872                 goto free_msg;
9873
9874         if (wakeup) {
9875                 struct nlattr *reasons;
9876
9877                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
9878
9879                 if (wakeup->disconnect &&
9880                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
9881                         goto free_msg;
9882                 if (wakeup->magic_pkt &&
9883                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
9884                         goto free_msg;
9885                 if (wakeup->gtk_rekey_failure &&
9886                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
9887                         goto free_msg;
9888                 if (wakeup->eap_identity_req &&
9889                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
9890                         goto free_msg;
9891                 if (wakeup->four_way_handshake &&
9892                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
9893                         goto free_msg;
9894                 if (wakeup->rfkill_release &&
9895                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
9896                         goto free_msg;
9897
9898                 if (wakeup->pattern_idx >= 0 &&
9899                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
9900                                 wakeup->pattern_idx))
9901                         goto free_msg;
9902
9903                 if (wakeup->tcp_match)
9904                         nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH);
9905
9906                 if (wakeup->tcp_connlost)
9907                         nla_put_flag(msg,
9908                                      NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST);
9909
9910                 if (wakeup->tcp_nomoretokens)
9911                         nla_put_flag(msg,
9912                                 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS);
9913
9914                 if (wakeup->packet) {
9915                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
9916                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
9917
9918                         if (!wakeup->packet_80211) {
9919                                 pkt_attr =
9920                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
9921                                 len_attr =
9922                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
9923                         }
9924
9925                         if (wakeup->packet_len &&
9926                             nla_put_u32(msg, len_attr, wakeup->packet_len))
9927                                 goto free_msg;
9928
9929                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
9930                                     wakeup->packet))
9931                                 goto free_msg;
9932                 }
9933
9934                 nla_nest_end(msg, reasons);
9935         }
9936
9937         err = genlmsg_end(msg, hdr);
9938         if (err < 0)
9939                 goto free_msg;
9940
9941         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9942                                 nl80211_mlme_mcgrp.id, gfp);
9943         return;
9944
9945  free_msg:
9946         nlmsg_free(msg);
9947 }
9948 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
9949 #endif
9950
9951 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
9952                                 enum nl80211_tdls_operation oper,
9953                                 u16 reason_code, gfp_t gfp)
9954 {
9955         struct wireless_dev *wdev = dev->ieee80211_ptr;
9956         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9957         struct sk_buff *msg;
9958         void *hdr;
9959         int err;
9960
9961         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
9962                                          reason_code);
9963
9964         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9965         if (!msg)
9966                 return;
9967
9968         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
9969         if (!hdr) {
9970                 nlmsg_free(msg);
9971                 return;
9972         }
9973
9974         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9975             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9976             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
9977             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
9978             (reason_code > 0 &&
9979              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
9980                 goto nla_put_failure;
9981
9982         err = genlmsg_end(msg, hdr);
9983         if (err < 0) {
9984                 nlmsg_free(msg);
9985                 return;
9986         }
9987
9988         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9989                                 nl80211_mlme_mcgrp.id, gfp);
9990         return;
9991
9992  nla_put_failure:
9993         genlmsg_cancel(msg, hdr);
9994         nlmsg_free(msg);
9995 }
9996 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
9997
9998 static int nl80211_netlink_notify(struct notifier_block * nb,
9999                                   unsigned long state,
10000                                   void *_notify)
10001 {
10002         struct netlink_notify *notify = _notify;
10003         struct cfg80211_registered_device *rdev;
10004         struct wireless_dev *wdev;
10005         struct cfg80211_beacon_registration *reg, *tmp;
10006
10007         if (state != NETLINK_URELEASE)
10008                 return NOTIFY_DONE;
10009
10010         rcu_read_lock();
10011
10012         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
10013                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list)
10014                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
10015
10016                 spin_lock_bh(&rdev->beacon_registrations_lock);
10017                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
10018                                          list) {
10019                         if (reg->nlportid == notify->portid) {
10020                                 list_del(&reg->list);
10021                                 kfree(reg);
10022                                 break;
10023                         }
10024                 }
10025                 spin_unlock_bh(&rdev->beacon_registrations_lock);
10026         }
10027
10028         rcu_read_unlock();
10029
10030         return NOTIFY_DONE;
10031 }
10032
10033 static struct notifier_block nl80211_netlink_notifier = {
10034         .notifier_call = nl80211_netlink_notify,
10035 };
10036
10037 /* initialisation/exit functions */
10038
10039 int nl80211_init(void)
10040 {
10041         int err;
10042
10043         err = genl_register_family_with_ops(&nl80211_fam,
10044                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
10045         if (err)
10046                 return err;
10047
10048         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
10049         if (err)
10050                 goto err_out;
10051
10052         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
10053         if (err)
10054                 goto err_out;
10055
10056         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
10057         if (err)
10058                 goto err_out;
10059
10060         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
10061         if (err)
10062                 goto err_out;
10063
10064 #ifdef CONFIG_NL80211_TESTMODE
10065         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
10066         if (err)
10067                 goto err_out;
10068 #endif
10069
10070         err = netlink_register_notifier(&nl80211_netlink_notifier);
10071         if (err)
10072                 goto err_out;
10073
10074         return 0;
10075  err_out:
10076         genl_unregister_family(&nl80211_fam);
10077         return err;
10078 }
10079
10080 void nl80211_exit(void)
10081 {
10082         netlink_unregister_notifier(&nl80211_netlink_notifier);
10083         genl_unregister_family(&nl80211_fam);
10084 }