net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include <net/inet_connection_sock.h>
  23 #include "core.h"
  24 #include "nl80211.h"
  25 #include "reg.h"
  26 #include "rdev-ops.h"
  27
  28 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  29                                    struct genl_info *info,
  30                                    struct cfg80211_crypto_settings *settings,
  31                                    int cipher_limit);
  32
  33 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
  34                             struct genl_info *info);
  35 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
  36                               struct genl_info *info);
  37
  38 /* the netlink family */
  39 static struct genl_family nl80211_fam = {
  40         .id = GENL_ID_GENERATE,         /* don't bother with a hardcoded ID */
  41         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
  42         .hdrsize = 0,                   /* no private header */
  43         .version = 1,                   /* no particular meaning now */
  44         .maxattr = NL80211_ATTR_MAX,
  45         .netnsok = true,
  46         .pre_doit = nl80211_pre_doit,
  47         .post_doit = nl80211_post_doit,
  48 };
  49
  50 /* returns ERR_PTR values */
  51 static struct wireless_dev *
  52 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  53 {
  54         struct cfg80211_registered_device *rdev;
  55         struct wireless_dev *result = NULL;
  56         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  57         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  58         u64 wdev_id;
  59         int wiphy_idx = -1;
  60         int ifidx = -1;
  61
  62         ASSERT_RTNL();
  63
  64         if (!have_ifidx && !have_wdev_id)
  65                 return ERR_PTR(-EINVAL);
  66
  67         if (have_ifidx)
  68                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  69         if (have_wdev_id) {
  70                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  71                 wiphy_idx = wdev_id >> 32;
  72         }
  73
  74         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  75                 struct wireless_dev *wdev;
  76
  77                 if (wiphy_net(&rdev->wiphy) != netns)
  78                         continue;
  79
  80                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  81                         continue;
  82
  83                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
  84                         if (have_ifidx && wdev->netdev &&
  85                             wdev->netdev->ifindex == ifidx) {
  86                                 result = wdev;
  87                                 break;
  88                         }
  89                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
  90                                 result = wdev;
  91                                 break;
  92                         }
  93                 }
  94
  95                 if (result)
  96                         break;
  97         }
  98
  99         if (result)
 100                 return result;
 101         return ERR_PTR(-ENODEV);
 102 }
 103
 104 static struct cfg80211_registered_device *
 105 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 106 {
 107         struct cfg80211_registered_device *rdev = NULL, *tmp;
 108         struct net_device *netdev;
 109
 110         ASSERT_RTNL();
 111
 112         if (!attrs[NL80211_ATTR_WIPHY] &&
 113             !attrs[NL80211_ATTR_IFINDEX] &&
 114             !attrs[NL80211_ATTR_WDEV])
 115                 return ERR_PTR(-EINVAL);
 116
 117         if (attrs[NL80211_ATTR_WIPHY])
 118                 rdev = cfg80211_rdev_by_wiphy_idx(
 119                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 120
 121         if (attrs[NL80211_ATTR_WDEV]) {
 122                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 123                 struct wireless_dev *wdev;
 124                 bool found = false;
 125
 126                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 127                 if (tmp) {
 128                         /* make sure wdev exists */
 129                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 130                                 if (wdev->identifier != (u32)wdev_id)
 131                                         continue;
 132                                 found = true;
 133                                 break;
 134                         }
 135
 136                         if (!found)
 137                                 tmp = NULL;
 138
 139                         if (rdev && tmp != rdev)
 140                                 return ERR_PTR(-EINVAL);
 141                         rdev = tmp;
 142                 }
 143         }
 144
 145         if (attrs[NL80211_ATTR_IFINDEX]) {
 146                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 147                 netdev = dev_get_by_index(netns, ifindex);
 148                 if (netdev) {
 149                         if (netdev->ieee80211_ptr)
 150                                 tmp = wiphy_to_dev(
 151                                                 netdev->ieee80211_ptr->wiphy);
 152                         else
 153                                 tmp = NULL;
 154
 155                         dev_put(netdev);
 156
 157                         /* not wireless device -- return error */
 158                         if (!tmp)
 159                                 return ERR_PTR(-EINVAL);
 160
 161                         /* mismatch -- return error */
 162                         if (rdev && tmp != rdev)
 163                                 return ERR_PTR(-EINVAL);
 164
 165                         rdev = tmp;
 166                 }
 167         }
 168
 169         if (!rdev)
 170                 return ERR_PTR(-ENODEV);
 171
 172         if (netns != wiphy_net(&rdev->wiphy))
 173                 return ERR_PTR(-ENODEV);
 174
 175         return rdev;
 176 }
 177
 178 /*
 179  * This function returns a pointer to the driver
 180  * that the genl_info item that is passed refers to.
 181  *
 182  * The result of this can be a PTR_ERR and hence must
 183  * be checked with IS_ERR() for errors.
 184  */
 185 static struct cfg80211_registered_device *
 186 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 187 {
 188         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 189 }
 190
 191 /* policy for the attributes */
 192 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
 193         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 194         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 195                                       .len = 20-1 },
 196         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 197
 198         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 199         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 200         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 201         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 202         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 203
 204         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 205         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 206         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 207         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 208         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 209
 210         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 211         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 212         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 213
 214         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 215         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 216
 217         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 218         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 219                                     .len = WLAN_MAX_KEY_LEN },
 220         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 221         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 222         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 223         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 224         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 225
 226         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 227         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 228         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 229                                        .len = IEEE80211_MAX_DATA_LEN },
 230         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 231                                        .len = IEEE80211_MAX_DATA_LEN },
 232         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 233         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 234         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 235         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 236                                                .len = NL80211_MAX_SUPP_RATES },
 237         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 238         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 239         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 240         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 241                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 242         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 243
 244         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 245         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 246
 247         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 248         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 249         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 250         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 251                                            .len = NL80211_MAX_SUPP_RATES },
 252         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 253
 254         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 255         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 256
 257         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 258
 259         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 260         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 261                               .len = IEEE80211_MAX_DATA_LEN },
 262         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 263         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 264
 265         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 266                                 .len = IEEE80211_MAX_SSID_LEN },
 267         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 268         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 269         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 270         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 271         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 272         [NL80211_ATTR_STA_FLAGS2] = {
 273                 .len = sizeof(struct nl80211_sta_flag_update),
 274         },
 275         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 276         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 277         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 278         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 279         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 280         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 281         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 282         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 283         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 284                                  .len = WLAN_PMKID_LEN },
 285         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 286         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 287         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 288         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 289                                  .len = IEEE80211_MAX_DATA_LEN },
 290         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 291         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 292         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 293         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 294         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 295         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 296         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 297         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 298         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 299         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 300         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 301         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 302         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 303         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 304         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 305         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 306         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 307         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 308         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 309         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 310                                          .len = IEEE80211_MAX_DATA_LEN },
 311         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 312                                          .len = IEEE80211_MAX_DATA_LEN },
 313         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 314         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 315         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 316         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 317         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 318         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 319         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 320         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 321         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 322         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 323                                       .len = IEEE80211_MAX_DATA_LEN },
 324         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 325         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 326         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 327                 .len = NL80211_HT_CAPABILITY_LEN
 328         },
 329         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 330         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 331         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 332         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 333         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 334         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 335         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 336         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 337         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 338         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 339         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 340         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 341         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 342         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 343         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 344         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 345         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 346                 .len = NL80211_VHT_CAPABILITY_LEN,
 347         },
 348         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 349         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 350                                   .len = IEEE80211_MAX_DATA_LEN },
 351         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 352 };
 353
 354 /* policy for the key attributes */
 355 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 356         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 357         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 358         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 359         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 360         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 361         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 362         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 363         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 364 };
 365
 366 /* policy for the key default flags */
 367 static const struct nla_policy
 368 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 369         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 370         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 371 };
 372
 373 /* policy for WoWLAN attributes */
 374 static const struct nla_policy
 375 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 376         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 377         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 378         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 379         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 380         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 381         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 382         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 383         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 384         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 385 };
 386
 387 static const struct nla_policy
 388 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 389         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 390         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 391         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 392         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 393         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 394         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 395         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 396                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 397         },
 398         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 399                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 400         },
 401         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 402         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 403         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 404 };
 405
 406 /* policy for GTK rekey offload attributes */
 407 static const struct nla_policy
 408 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 409         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 410         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 411         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 412 };
 413
 414 static const struct nla_policy
 415 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 416         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 417                                                  .len = IEEE80211_MAX_SSID_LEN },
 418         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 419 };
 420
 421 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 422                                      struct netlink_callback *cb,
 423                                      struct cfg80211_registered_device **rdev,
 424                                      struct wireless_dev **wdev)
 425 {
 426         int err;
 427
 428         rtnl_lock();
 429
 430         if (!cb->args[0]) {
 431                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 432                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
 433                                   nl80211_policy);
 434                 if (err)
 435                         goto out_unlock;
 436
 437                 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
 438                                                    nl80211_fam.attrbuf);
 439                 if (IS_ERR(*wdev)) {
 440                         err = PTR_ERR(*wdev);
 441                         goto out_unlock;
 442                 }
 443                 *rdev = wiphy_to_dev((*wdev)->wiphy);
 444                 cb->args[0] = (*rdev)->wiphy_idx;
 445                 cb->args[1] = (*wdev)->identifier;
 446         } else {
 447                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0]);
 448                 struct wireless_dev *tmp;
 449
 450                 if (!wiphy) {
 451                         err = -ENODEV;
 452                         goto out_unlock;
 453                 }
 454                 *rdev = wiphy_to_dev(wiphy);
 455                 *wdev = NULL;
 456
 457                 list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
 458                         if (tmp->identifier == cb->args[1]) {
 459                                 *wdev = tmp;
 460                                 break;
 461                         }
 462                 }
 463
 464                 if (!*wdev) {
 465                         err = -ENODEV;
 466                         goto out_unlock;
 467                 }
 468         }
 469
 470         return 0;
 471  out_unlock:
 472         rtnl_unlock();
 473         return err;
 474 }
 475
 476 static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
 477 {
 478         rtnl_unlock();
 479 }
 480
 481 /* IE validation */
 482 static bool is_valid_ie_attr(const struct nlattr *attr)
 483 {
 484         const u8 *pos;
 485         int len;
 486
 487         if (!attr)
 488                 return true;
 489
 490         pos = nla_data(attr);
 491         len = nla_len(attr);
 492
 493         while (len) {
 494                 u8 elemlen;
 495
 496                 if (len < 2)
 497                         return false;
 498                 len -= 2;
 499
 500                 elemlen = pos[1];
 501                 if (elemlen > len)
 502                         return false;
 503
 504                 len -= elemlen;
 505                 pos += 2 + elemlen;
 506         }
 507
 508         return true;
 509 }
 510
 511 /* message building helper */
 512 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 513                                    int flags, u8 cmd)
 514 {
 515         /* since there is no private header just add the generic one */
 516         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 517 }
 518
 519 static int nl80211_msg_put_channel(struct sk_buff *msg,
 520                                    struct ieee80211_channel *chan,
 521                                    bool large)
 522 {
 523         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 524                         chan->center_freq))
 525                 goto nla_put_failure;
 526
 527         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 528             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 529                 goto nla_put_failure;
 530         if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
 531             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN))
 532                 goto nla_put_failure;
 533         if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
 534             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IBSS))
 535                 goto nla_put_failure;
 536         if (chan->flags & IEEE80211_CHAN_RADAR) {
 537                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 538                         goto nla_put_failure;
 539                 if (large) {
 540                         u32 time;
 541
 542                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 543
 544                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 545                                         chan->dfs_state))
 546                                 goto nla_put_failure;
 547                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 548                                         time))
 549                                 goto nla_put_failure;
 550                 }
 551         }
 552
 553         if (large) {
 554                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 555                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 556                         goto nla_put_failure;
 557                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 558                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 559                         goto nla_put_failure;
 560                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 561                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 562                         goto nla_put_failure;
 563                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 564                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 565                         goto nla_put_failure;
 566         }
 567
 568         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 569                         DBM_TO_MBM(chan->max_power)))
 570                 goto nla_put_failure;
 571
 572         return 0;
 573
 574  nla_put_failure:
 575         return -ENOBUFS;
 576 }
 577
 578 /* netlink command implementations */
 579
 580 struct key_parse {
 581         struct key_params p;
 582         int idx;
 583         int type;
 584         bool def, defmgmt;
 585         bool def_uni, def_multi;
 586 };
 587
 588 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 589 {
 590         struct nlattr *tb[NL80211_KEY_MAX + 1];
 591         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 592                                    nl80211_key_policy);
 593         if (err)
 594                 return err;
 595
 596         k->def = !!tb[NL80211_KEY_DEFAULT];
 597         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 598
 599         if (k->def) {
 600                 k->def_uni = true;
 601                 k->def_multi = true;
 602         }
 603         if (k->defmgmt)
 604                 k->def_multi = true;
 605
 606         if (tb[NL80211_KEY_IDX])
 607                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 608
 609         if (tb[NL80211_KEY_DATA]) {
 610                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 611                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 612         }
 613
 614         if (tb[NL80211_KEY_SEQ]) {
 615                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 616                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 617         }
 618
 619         if (tb[NL80211_KEY_CIPHER])
 620                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 621
 622         if (tb[NL80211_KEY_TYPE]) {
 623                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 624                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 625                         return -EINVAL;
 626         }
 627
 628         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 629                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 630                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 631                                        tb[NL80211_KEY_DEFAULT_TYPES],
 632                                        nl80211_key_default_policy);
 633                 if (err)
 634                         return err;
 635
 636                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 637                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 638         }
 639
 640         return 0;
 641 }
 642
 643 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 644 {
 645         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 646                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 647                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 648         }
 649
 650         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 651                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 652                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 653         }
 654
 655         if (info->attrs[NL80211_ATTR_KEY_IDX])
 656                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 657
 658         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 659                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 660
 661         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 662         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 663
 664         if (k->def) {
 665                 k->def_uni = true;
 666                 k->def_multi = true;
 667         }
 668         if (k->defmgmt)
 669                 k->def_multi = true;
 670
 671         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 672                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 673                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 674                         return -EINVAL;
 675         }
 676
 677         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 678                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 679                 int err = nla_parse_nested(
 680                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 681                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 682                                 nl80211_key_default_policy);
 683                 if (err)
 684                         return err;
 685
 686                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 687                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 688         }
 689
 690         return 0;
 691 }
 692
 693 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 694 {
 695         int err;
 696
 697         memset(k, 0, sizeof(*k));
 698         k->idx = -1;
 699         k->type = -1;
 700
 701         if (info->attrs[NL80211_ATTR_KEY])
 702                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 703         else
 704                 err = nl80211_parse_key_old(info, k);
 705
 706         if (err)
 707                 return err;
 708
 709         if (k->def && k->defmgmt)
 710                 return -EINVAL;
 711
 712         if (k->defmgmt) {
 713                 if (k->def_uni || !k->def_multi)
 714                         return -EINVAL;
 715         }
 716
 717         if (k->idx != -1) {
 718                 if (k->defmgmt) {
 719                         if (k->idx < 4 || k->idx > 5)
 720                                 return -EINVAL;
 721                 } else if (k->def) {
 722                         if (k->idx < 0 || k->idx > 3)
 723                                 return -EINVAL;
 724                 } else {
 725                         if (k->idx < 0 || k->idx > 5)
 726                                 return -EINVAL;
 727                 }
 728         }
 729
 730         return 0;
 731 }
 732
 733 static struct cfg80211_cached_keys *
 734 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 735                        struct nlattr *keys, bool *no_ht)
 736 {
 737         struct key_parse parse;
 738         struct nlattr *key;
 739         struct cfg80211_cached_keys *result;
 740         int rem, err, def = 0;
 741
 742         result = kzalloc(sizeof(*result), GFP_KERNEL);
 743         if (!result)
 744                 return ERR_PTR(-ENOMEM);
 745
 746         result->def = -1;
 747         result->defmgmt = -1;
 748
 749         nla_for_each_nested(key, keys, rem) {
 750                 memset(&parse, 0, sizeof(parse));
 751                 parse.idx = -1;
 752
 753                 err = nl80211_parse_key_new(key, &parse);
 754                 if (err)
 755                         goto error;
 756                 err = -EINVAL;
 757                 if (!parse.p.key)
 758                         goto error;
 759                 if (parse.idx < 0 || parse.idx > 4)
 760                         goto error;
 761                 if (parse.def) {
 762                         if (def)
 763                                 goto error;
 764                         def = 1;
 765                         result->def = parse.idx;
 766                         if (!parse.def_uni || !parse.def_multi)
 767                                 goto error;
 768                 } else if (parse.defmgmt)
 769                         goto error;
 770                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 771                                                      parse.idx, false, NULL);
 772                 if (err)
 773                         goto error;
 774                 result->params[parse.idx].cipher = parse.p.cipher;
 775                 result->params[parse.idx].key_len = parse.p.key_len;
 776                 result->params[parse.idx].key = result->data[parse.idx];
 777                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 778
 779                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 780                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 781                         if (no_ht)
 782                                 *no_ht = true;
 783                 }
 784         }
 785
 786         return result;
 787  error:
 788         kfree(result);
 789         return ERR_PTR(err);
 790 }
 791
 792 static int nl80211_key_allowed(struct wireless_dev *wdev)
 793 {
 794         ASSERT_WDEV_LOCK(wdev);
 795
 796         switch (wdev->iftype) {
 797         case NL80211_IFTYPE_AP:
 798         case NL80211_IFTYPE_AP_VLAN:
 799         case NL80211_IFTYPE_P2P_GO:
 800         case NL80211_IFTYPE_MESH_POINT:
 801                 break;
 802         case NL80211_IFTYPE_ADHOC:
 803         case NL80211_IFTYPE_STATION:
 804         case NL80211_IFTYPE_P2P_CLIENT:
 805                 if (!wdev->current_bss)
 806                         return -ENOLINK;
 807                 break;
 808         default:
 809                 return -EINVAL;
 810         }
 811
 812         return 0;
 813 }
 814
 815 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 816 {
 817         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 818         int i;
 819
 820         if (!nl_modes)
 821                 goto nla_put_failure;
 822
 823         i = 0;
 824         while (ifmodes) {
 825                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 826                         goto nla_put_failure;
 827                 ifmodes >>= 1;
 828                 i++;
 829         }
 830
 831         nla_nest_end(msg, nl_modes);
 832         return 0;
 833
 834 nla_put_failure:
 835         return -ENOBUFS;
 836 }
 837
 838 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 839                                           struct sk_buff *msg,
 840                                           bool large)
 841 {
 842         struct nlattr *nl_combis;
 843         int i, j;
 844
 845         nl_combis = nla_nest_start(msg,
 846                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 847         if (!nl_combis)
 848                 goto nla_put_failure;
 849
 850         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 851                 const struct ieee80211_iface_combination *c;
 852                 struct nlattr *nl_combi, *nl_limits;
 853
 854                 c = &wiphy->iface_combinations[i];
 855
 856                 nl_combi = nla_nest_start(msg, i + 1);
 857                 if (!nl_combi)
 858                         goto nla_put_failure;
 859
 860                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 861                 if (!nl_limits)
 862                         goto nla_put_failure;
 863
 864                 for (j = 0; j < c->n_limits; j++) {
 865                         struct nlattr *nl_limit;
 866
 867                         nl_limit = nla_nest_start(msg, j + 1);
 868                         if (!nl_limit)
 869                                 goto nla_put_failure;
 870                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 871                                         c->limits[j].max))
 872                                 goto nla_put_failure;
 873                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 874                                                 c->limits[j].types))
 875                                 goto nla_put_failure;
 876                         nla_nest_end(msg, nl_limit);
 877                 }
 878
 879                 nla_nest_end(msg, nl_limits);
 880
 881                 if (c->beacon_int_infra_match &&
 882                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 883                         goto nla_put_failure;
 884                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 885                                 c->num_different_channels) ||
 886                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 887                                 c->max_interfaces))
 888                         goto nla_put_failure;
 889                 if (large &&
 890                     nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
 891                                 c->radar_detect_widths))
 892                         goto nla_put_failure;
 893
 894                 nla_nest_end(msg, nl_combi);
 895         }
 896
 897         nla_nest_end(msg, nl_combis);
 898
 899         return 0;
 900 nla_put_failure:
 901         return -ENOBUFS;
 902 }
 903
 904 #ifdef CONFIG_PM
 905 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
 906                                         struct sk_buff *msg)
 907 {
 908         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
 909         struct nlattr *nl_tcp;
 910
 911         if (!tcp)
 912                 return 0;
 913
 914         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
 915         if (!nl_tcp)
 916                 return -ENOBUFS;
 917
 918         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 919                         tcp->data_payload_max))
 920                 return -ENOBUFS;
 921
 922         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 923                         tcp->data_payload_max))
 924                 return -ENOBUFS;
 925
 926         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
 927                 return -ENOBUFS;
 928
 929         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
 930                                 sizeof(*tcp->tok), tcp->tok))
 931                 return -ENOBUFS;
 932
 933         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
 934                         tcp->data_interval_max))
 935                 return -ENOBUFS;
 936
 937         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
 938                         tcp->wake_payload_max))
 939                 return -ENOBUFS;
 940
 941         nla_nest_end(msg, nl_tcp);
 942         return 0;
 943 }
 944
 945 static int nl80211_send_wowlan(struct sk_buff *msg,
 946                                struct cfg80211_registered_device *dev,
 947                                bool large)
 948 {
 949         struct nlattr *nl_wowlan;
 950
 951         if (!dev->wiphy.wowlan)
 952                 return 0;
 953
 954         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
 955         if (!nl_wowlan)
 956                 return -ENOBUFS;
 957
 958         if (((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
 959              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
 960             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
 961              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
 962             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
 963              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
 964             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
 965              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
 966             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
 967              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
 968             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
 969              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
 970             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
 971              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
 972             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
 973              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
 974                 return -ENOBUFS;
 975
 976         if (dev->wiphy.wowlan->n_patterns) {
 977                 struct nl80211_wowlan_pattern_support pat = {
 978                         .max_patterns = dev->wiphy.wowlan->n_patterns,
 979                         .min_pattern_len = dev->wiphy.wowlan->pattern_min_len,
 980                         .max_pattern_len = dev->wiphy.wowlan->pattern_max_len,
 981                         .max_pkt_offset = dev->wiphy.wowlan->max_pkt_offset,
 982                 };
 983
 984                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
 985                             sizeof(pat), &pat))
 986                         return -ENOBUFS;
 987         }
 988
 989         if (large && nl80211_send_wowlan_tcp_caps(dev, msg))
 990                 return -ENOBUFS;
 991
 992         nla_nest_end(msg, nl_wowlan);
 993
 994         return 0;
 995 }
 996 #endif
 997
 998 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
 999                                       struct ieee80211_supported_band *sband)
1000 {
1001         struct nlattr *nl_rates, *nl_rate;
1002         struct ieee80211_rate *rate;
1003         int i;
1004
1005         /* add HT info */
1006         if (sband->ht_cap.ht_supported &&
1007             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1008                      sizeof(sband->ht_cap.mcs),
1009                      &sband->ht_cap.mcs) ||
1010              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1011                          sband->ht_cap.cap) ||
1012              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1013                         sband->ht_cap.ampdu_factor) ||
1014              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1015                         sband->ht_cap.ampdu_density)))
1016                 return -ENOBUFS;
1017
1018         /* add VHT info */
1019         if (sband->vht_cap.vht_supported &&
1020             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1021                      sizeof(sband->vht_cap.vht_mcs),
1022                      &sband->vht_cap.vht_mcs) ||
1023              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1024                          sband->vht_cap.cap)))
1025                 return -ENOBUFS;
1026
1027         /* add bitrates */
1028         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1029         if (!nl_rates)
1030                 return -ENOBUFS;
1031
1032         for (i = 0; i < sband->n_bitrates; i++) {
1033                 nl_rate = nla_nest_start(msg, i);
1034                 if (!nl_rate)
1035                         return -ENOBUFS;
1036
1037                 rate = &sband->bitrates[i];
1038                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1039                                 rate->bitrate))
1040                         return -ENOBUFS;
1041                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1042                     nla_put_flag(msg,
1043                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1044                         return -ENOBUFS;
1045
1046                 nla_nest_end(msg, nl_rate);
1047         }
1048
1049         nla_nest_end(msg, nl_rates);
1050
1051         return 0;
1052 }
1053
1054 static int
1055 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1056                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1057 {
1058         u16 stypes;
1059         struct nlattr *nl_ftypes, *nl_ifs;
1060         enum nl80211_iftype ift;
1061         int i;
1062
1063         if (!mgmt_stypes)
1064                 return 0;
1065
1066         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1067         if (!nl_ifs)
1068                 return -ENOBUFS;
1069
1070         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1071                 nl_ftypes = nla_nest_start(msg, ift);
1072                 if (!nl_ftypes)
1073                         return -ENOBUFS;
1074                 i = 0;
1075                 stypes = mgmt_stypes[ift].tx;
1076                 while (stypes) {
1077                         if ((stypes & 1) &&
1078                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1079                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1080                                 return -ENOBUFS;
1081                         stypes >>= 1;
1082                         i++;
1083                 }
1084                 nla_nest_end(msg, nl_ftypes);
1085         }
1086
1087         nla_nest_end(msg, nl_ifs);
1088
1089         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1090         if (!nl_ifs)
1091                 return -ENOBUFS;
1092
1093         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1094                 nl_ftypes = nla_nest_start(msg, ift);
1095                 if (!nl_ftypes)
1096                         return -ENOBUFS;
1097                 i = 0;
1098                 stypes = mgmt_stypes[ift].rx;
1099                 while (stypes) {
1100                         if ((stypes & 1) &&
1101                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1102                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1103                                 return -ENOBUFS;
1104                         stypes >>= 1;
1105                         i++;
1106                 }
1107                 nla_nest_end(msg, nl_ftypes);
1108         }
1109         nla_nest_end(msg, nl_ifs);
1110
1111         return 0;
1112 }
1113
1114 static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
1115                               struct sk_buff *msg, u32 portid, u32 seq,
1116                               int flags, bool split, long *split_start,
1117                               long *band_start, long *chan_start)
1118 {
1119         void *hdr;
1120         struct nlattr *nl_bands, *nl_band;
1121         struct nlattr *nl_freqs, *nl_freq;
1122         struct nlattr *nl_cmds;
1123         enum ieee80211_band band;
1124         struct ieee80211_channel *chan;
1125         int i;
1126         const struct ieee80211_txrx_stypes *mgmt_stypes =
1127                                 dev->wiphy.mgmt_stypes;
1128         long start = 0, start_chan = 0, start_band = 0;
1129         u32 features;
1130
1131         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
1132         if (!hdr)
1133                 return -ENOBUFS;
1134
1135         /* allow always using the variables */
1136         if (!split) {
1137                 split_start = &start;
1138                 band_start = &start_band;
1139                 chan_start = &start_chan;
1140         }
1141
1142         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
1143             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1144                            wiphy_name(&dev->wiphy)) ||
1145             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1146                         cfg80211_rdev_list_generation))
1147                 goto nla_put_failure;
1148
1149         switch (*split_start) {
1150         case 0:
1151                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1152                                dev->wiphy.retry_short) ||
1153                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1154                                dev->wiphy.retry_long) ||
1155                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1156                                 dev->wiphy.frag_threshold) ||
1157                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1158                                 dev->wiphy.rts_threshold) ||
1159                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1160                                dev->wiphy.coverage_class) ||
1161                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1162                                dev->wiphy.max_scan_ssids) ||
1163                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1164                                dev->wiphy.max_sched_scan_ssids) ||
1165                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1166                                 dev->wiphy.max_scan_ie_len) ||
1167                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1168                                 dev->wiphy.max_sched_scan_ie_len) ||
1169                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1170                                dev->wiphy.max_match_sets))
1171                         goto nla_put_failure;
1172
1173                 if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1174                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1175                         goto nla_put_failure;
1176                 if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1177                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1178                         goto nla_put_failure;
1179                 if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1180                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1181                         goto nla_put_failure;
1182                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1183                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1184                         goto nla_put_failure;
1185                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1186                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1187                         goto nla_put_failure;
1188                 if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1189                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1190                         goto nla_put_failure;
1191
1192                 (*split_start)++;
1193                 if (split)
1194                         break;
1195         case 1:
1196                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1197                             sizeof(u32) * dev->wiphy.n_cipher_suites,
1198                             dev->wiphy.cipher_suites))
1199                         goto nla_put_failure;
1200
1201                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1202                                dev->wiphy.max_num_pmkids))
1203                         goto nla_put_failure;
1204
1205                 if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1206                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1207                         goto nla_put_failure;
1208
1209                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1210                                 dev->wiphy.available_antennas_tx) ||
1211                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1212                                 dev->wiphy.available_antennas_rx))
1213                         goto nla_put_failure;
1214
1215                 if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1216                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1217                                 dev->wiphy.probe_resp_offload))
1218                         goto nla_put_failure;
1219
1220                 if ((dev->wiphy.available_antennas_tx ||
1221                      dev->wiphy.available_antennas_rx) &&
1222                     dev->ops->get_antenna) {
1223                         u32 tx_ant = 0, rx_ant = 0;
1224                         int res;
1225                         res = rdev_get_antenna(dev, &tx_ant, &rx_ant);
1226                         if (!res) {
1227                                 if (nla_put_u32(msg,
1228                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1229                                                 tx_ant) ||
1230                                     nla_put_u32(msg,
1231                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1232                                                 rx_ant))
1233                                         goto nla_put_failure;
1234                         }
1235                 }
1236
1237                 (*split_start)++;
1238                 if (split)
1239                         break;
1240         case 2:
1241                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1242                                         dev->wiphy.interface_modes))
1243                                 goto nla_put_failure;
1244                 (*split_start)++;
1245                 if (split)
1246                         break;
1247         case 3:
1248                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1249                 if (!nl_bands)
1250                         goto nla_put_failure;
1251
1252                 for (band = *band_start; band < IEEE80211_NUM_BANDS; band++) {
1253                         struct ieee80211_supported_band *sband;
1254
1255                         sband = dev->wiphy.bands[band];
1256
1257                         if (!sband)
1258                                 continue;
1259
1260                         nl_band = nla_nest_start(msg, band);
1261                         if (!nl_band)
1262                                 goto nla_put_failure;
1263
1264                         switch (*chan_start) {
1265                         case 0:
1266                                 if (nl80211_send_band_rateinfo(msg, sband))
1267                                         goto nla_put_failure;
1268                                 (*chan_start)++;
1269                                 if (split)
1270                                         break;
1271                         default:
1272                                 /* add frequencies */
1273                                 nl_freqs = nla_nest_start(
1274                                         msg, NL80211_BAND_ATTR_FREQS);
1275                                 if (!nl_freqs)
1276                                         goto nla_put_failure;
1277
1278                                 for (i = *chan_start - 1;
1279                                      i < sband->n_channels;
1280                                      i++) {
1281                                         nl_freq = nla_nest_start(msg, i);
1282                                         if (!nl_freq)
1283                                                 goto nla_put_failure;
1284
1285                                         chan = &sband->channels[i];
1286
1287                                         if (nl80211_msg_put_channel(msg, chan,
1288                                                                     split))
1289                                                 goto nla_put_failure;
1290
1291                                         nla_nest_end(msg, nl_freq);
1292                                         if (split)
1293                                                 break;
1294                                 }
1295                                 if (i < sband->n_channels)
1296                                         *chan_start = i + 2;
1297                                 else
1298                                         *chan_start = 0;
1299                                 nla_nest_end(msg, nl_freqs);
1300                         }
1301
1302                         nla_nest_end(msg, nl_band);
1303
1304                         if (split) {
1305                                 /* start again here */
1306                                 if (*chan_start)
1307                                         band--;
1308                                 break;
1309                         }
1310                 }
1311                 nla_nest_end(msg, nl_bands);
1312
1313                 if (band < IEEE80211_NUM_BANDS)
1314                         *band_start = band + 1;
1315                 else
1316                         *band_start = 0;
1317
1318                 /* if bands & channels are done, continue outside */
1319                 if (*band_start == 0 && *chan_start == 0)
1320                         (*split_start)++;
1321                 if (split)
1322                         break;
1323         case 4:
1324                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1325                 if (!nl_cmds)
1326                         goto nla_put_failure;
1327
1328                 i = 0;
1329 #define CMD(op, n)                                                      \
1330                  do {                                                   \
1331                         if (dev->ops->op) {                             \
1332                                 i++;                                    \
1333                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1334                                         goto nla_put_failure;           \
1335                         }                                               \
1336                 } while (0)
1337
1338                 CMD(add_virtual_intf, NEW_INTERFACE);
1339                 CMD(change_virtual_intf, SET_INTERFACE);
1340                 CMD(add_key, NEW_KEY);
1341                 CMD(start_ap, START_AP);
1342                 CMD(add_station, NEW_STATION);
1343                 CMD(add_mpath, NEW_MPATH);
1344                 CMD(update_mesh_config, SET_MESH_CONFIG);
1345                 CMD(change_bss, SET_BSS);
1346                 CMD(auth, AUTHENTICATE);
1347                 CMD(assoc, ASSOCIATE);
1348                 CMD(deauth, DEAUTHENTICATE);
1349                 CMD(disassoc, DISASSOCIATE);
1350                 CMD(join_ibss, JOIN_IBSS);
1351                 CMD(join_mesh, JOIN_MESH);
1352                 CMD(set_pmksa, SET_PMKSA);
1353                 CMD(del_pmksa, DEL_PMKSA);
1354                 CMD(flush_pmksa, FLUSH_PMKSA);
1355                 if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1356                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1357                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1358                 CMD(mgmt_tx, FRAME);
1359                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1360                 if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1361                         i++;
1362                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1363                                 goto nla_put_failure;
1364                 }
1365                 if (dev->ops->set_monitor_channel || dev->ops->start_ap ||
1366                     dev->ops->join_mesh) {
1367                         i++;
1368                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1369                                 goto nla_put_failure;
1370                 }
1371                 CMD(set_wds_peer, SET_WDS_PEER);
1372                 if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1373                         CMD(tdls_mgmt, TDLS_MGMT);
1374                         CMD(tdls_oper, TDLS_OPER);
1375                 }
1376                 if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1377                         CMD(sched_scan_start, START_SCHED_SCAN);
1378                 CMD(probe_client, PROBE_CLIENT);
1379                 CMD(set_noack_map, SET_NOACK_MAP);
1380                 if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1381                         i++;
1382                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1383                                 goto nla_put_failure;
1384                 }
1385                 CMD(start_p2p_device, START_P2P_DEVICE);
1386                 CMD(set_mcast_rate, SET_MCAST_RATE);
1387                 if (split) {
1388                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1389                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1390                 }
1391
1392 #ifdef CONFIG_NL80211_TESTMODE
1393                 CMD(testmode_cmd, TESTMODE);
1394 #endif
1395
1396 #undef CMD
1397
1398                 if (dev->ops->connect || dev->ops->auth) {
1399                         i++;
1400                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1401                                 goto nla_put_failure;
1402                 }
1403
1404                 if (dev->ops->disconnect || dev->ops->deauth) {
1405                         i++;
1406                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1407                                 goto nla_put_failure;
1408                 }
1409
1410                 nla_nest_end(msg, nl_cmds);
1411                 (*split_start)++;
1412                 if (split)
1413                         break;
1414         case 5:
1415                 if (dev->ops->remain_on_channel &&
1416                     (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1417                     nla_put_u32(msg,
1418                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1419                                 dev->wiphy.max_remain_on_channel_duration))
1420                         goto nla_put_failure;
1421
1422                 if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1423                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1424                         goto nla_put_failure;
1425
1426                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1427                         goto nla_put_failure;
1428                 (*split_start)++;
1429                 if (split)
1430                         break;
1431         case 6:
1432 #ifdef CONFIG_PM
1433                 if (nl80211_send_wowlan(msg, dev, split))
1434                         goto nla_put_failure;
1435                 (*split_start)++;
1436                 if (split)
1437                         break;
1438 #else
1439                 (*split_start)++;
1440 #endif
1441         case 7:
1442                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1443                                         dev->wiphy.software_iftypes))
1444                         goto nla_put_failure;
1445
1446                 if (nl80211_put_iface_combinations(&dev->wiphy, msg, split))
1447                         goto nla_put_failure;
1448
1449                 (*split_start)++;
1450                 if (split)
1451                         break;
1452         case 8:
1453                 if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1454                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1455                                 dev->wiphy.ap_sme_capa))
1456                         goto nla_put_failure;
1457
1458                 features = dev->wiphy.features;
1459                 /*
1460                  * We can only add the per-channel limit information if the
1461                  * dump is split, otherwise it makes it too big. Therefore
1462                  * only advertise it in that case.
1463                  */
1464                 if (split)
1465                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1466                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1467                         goto nla_put_failure;
1468
1469                 if (dev->wiphy.ht_capa_mod_mask &&
1470                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1471                             sizeof(*dev->wiphy.ht_capa_mod_mask),
1472                             dev->wiphy.ht_capa_mod_mask))
1473                         goto nla_put_failure;
1474
1475                 if (dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1476                     dev->wiphy.max_acl_mac_addrs &&
1477                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1478                                 dev->wiphy.max_acl_mac_addrs))
1479                         goto nla_put_failure;
1480
1481                 /*
1482                  * Any information below this point is only available to
1483                  * applications that can deal with it being split. This
1484                  * helps ensure that newly added capabilities don't break
1485                  * older tools by overrunning their buffers.
1486                  *
1487                  * We still increment split_start so that in the split
1488                  * case we'll continue with more data in the next round,
1489                  * but break unconditionally so unsplit data stops here.
1490                  */
1491                 (*split_start)++;
1492                 break;
1493         case 9:
1494                 if (dev->wiphy.extended_capabilities &&
1495                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1496                              dev->wiphy.extended_capabilities_len,
1497                              dev->wiphy.extended_capabilities) ||
1498                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1499                              dev->wiphy.extended_capabilities_len,
1500                              dev->wiphy.extended_capabilities_mask)))
1501                         goto nla_put_failure;
1502
1503                 if (dev->wiphy.vht_capa_mod_mask &&
1504                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1505                             sizeof(*dev->wiphy.vht_capa_mod_mask),
1506                             dev->wiphy.vht_capa_mod_mask))
1507                         goto nla_put_failure;
1508
1509                 /* done */
1510                 *split_start = 0;
1511                 break;
1512         }
1513         return genlmsg_end(msg, hdr);
1514
1515  nla_put_failure:
1516         genlmsg_cancel(msg, hdr);
1517         return -EMSGSIZE;
1518 }
1519
1520 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1521 {
1522         int idx = 0, ret;
1523         int start = cb->args[0];
1524         struct cfg80211_registered_device *dev;
1525         s64 filter_wiphy = -1;
1526         bool split = false;
1527         struct nlattr **tb = nl80211_fam.attrbuf;
1528         int res;
1529
1530         rtnl_lock();
1531         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1532                           tb, nl80211_fam.maxattr, nl80211_policy);
1533         if (res == 0) {
1534                 split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1535                 if (tb[NL80211_ATTR_WIPHY])
1536                         filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1537                 if (tb[NL80211_ATTR_WDEV])
1538                         filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1539                 if (tb[NL80211_ATTR_IFINDEX]) {
1540                         struct net_device *netdev;
1541                         int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1542
1543                         netdev = dev_get_by_index(sock_net(skb->sk), ifidx);
1544                         if (!netdev)
1545                                 return -ENODEV;
1546                         if (netdev->ieee80211_ptr) {
1547                                 dev = wiphy_to_dev(
1548                                         netdev->ieee80211_ptr->wiphy);
1549                                 filter_wiphy = dev->wiphy_idx;
1550                         }
1551                         dev_put(netdev);
1552                 }
1553         }
1554
1555         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1556                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1557                         continue;
1558                 if (++idx <= start)
1559                         continue;
1560                 if (filter_wiphy != -1 && dev->wiphy_idx != filter_wiphy)
1561                         continue;
1562                 /* attempt to fit multiple wiphy data chunks into the skb */
1563                 do {
1564                         ret = nl80211_send_wiphy(dev, skb,
1565                                                  NETLINK_CB(cb->skb).portid,
1566                                                  cb->nlh->nlmsg_seq,
1567                                                  NLM_F_MULTI,
1568                                                  split, &cb->args[1],
1569                                                  &cb->args[2],
1570                                                  &cb->args[3]);
1571                         if (ret < 0) {
1572                                 /*
1573                                  * If sending the wiphy data didn't fit (ENOBUFS
1574                                  * or EMSGSIZE returned), this SKB is still
1575                                  * empty (so it's not too big because another
1576                                  * wiphy dataset is already in the skb) and
1577                                  * we've not tried to adjust the dump allocation
1578                                  * yet ... then adjust the alloc size to be
1579                                  * bigger, and return 1 but with the empty skb.
1580                                  * This results in an empty message being RX'ed
1581                                  * in userspace, but that is ignored.
1582                                  *
1583                                  * We can then retry with the larger buffer.
1584                                  */
1585                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1586                                     !skb->len &&
1587                                     cb->min_dump_alloc < 4096) {
1588                                         cb->min_dump_alloc = 4096;
1589                                         return 1;
1590                                 }
1591                                 idx--;
1592                                 break;
1593                         }
1594                 } while (cb->args[1] > 0);
1595                 break;
1596         }
1597         rtnl_unlock();
1598
1599         cb->args[0] = idx;
1600
1601         return skb->len;
1602 }
1603
1604 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1605 {
1606         struct sk_buff *msg;
1607         struct cfg80211_registered_device *dev = info->user_ptr[0];
1608
1609         msg = nlmsg_new(4096, GFP_KERNEL);
1610         if (!msg)
1611                 return -ENOMEM;
1612
1613         if (nl80211_send_wiphy(dev, msg, info->snd_portid, info->snd_seq, 0,
1614                                false, NULL, NULL, NULL) < 0) {
1615                 nlmsg_free(msg);
1616                 return -ENOBUFS;
1617         }
1618
1619         return genlmsg_reply(msg, info);
1620 }
1621
1622 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1623         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1624         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1625         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1626         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1627         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1628 };
1629
1630 static int parse_txq_params(struct nlattr *tb[],
1631                             struct ieee80211_txq_params *txq_params)
1632 {
1633         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1634             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1635             !tb[NL80211_TXQ_ATTR_AIFS])
1636                 return -EINVAL;
1637
1638         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1639         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1640         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1641         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1642         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1643
1644         if (txq_params->ac >= NL80211_NUM_ACS)
1645                 return -EINVAL;
1646
1647         return 0;
1648 }
1649
1650 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1651 {
1652         /*
1653          * You can only set the channel explicitly for WDS interfaces,
1654          * all others have their channel managed via their respective
1655          * "establish a connection" command (connect, join, ...)
1656          *
1657          * For AP/GO and mesh mode, the channel can be set with the
1658          * channel userspace API, but is only stored and passed to the
1659          * low-level driver when the AP starts or the mesh is joined.
1660          * This is for backward compatibility, userspace can also give
1661          * the channel in the start-ap or join-mesh commands instead.
1662          *
1663          * Monitors are special as they are normally slaved to
1664          * whatever else is going on, so they have their own special
1665          * operation to set the monitor channel if possible.
1666          */
1667         return !wdev ||
1668                 wdev->iftype == NL80211_IFTYPE_AP ||
1669                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1670                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1671                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1672 }
1673
1674 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1675                                  struct genl_info *info,
1676                                  struct cfg80211_chan_def *chandef)
1677 {
1678         u32 control_freq;
1679
1680         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1681                 return -EINVAL;
1682
1683         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1684
1685         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1686         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1687         chandef->center_freq1 = control_freq;
1688         chandef->center_freq2 = 0;
1689
1690         /* Primary channel not allowed */
1691         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1692                 return -EINVAL;
1693
1694         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1695                 enum nl80211_channel_type chantype;
1696
1697                 chantype = nla_get_u32(
1698                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1699
1700                 switch (chantype) {
1701                 case NL80211_CHAN_NO_HT:
1702                 case NL80211_CHAN_HT20:
1703                 case NL80211_CHAN_HT40PLUS:
1704                 case NL80211_CHAN_HT40MINUS:
1705                         cfg80211_chandef_create(chandef, chandef->chan,
1706                                                 chantype);
1707                         break;
1708                 default:
1709                         return -EINVAL;
1710                 }
1711         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1712                 chandef->width =
1713                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1714                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1715                         chandef->center_freq1 =
1716                                 nla_get_u32(
1717                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1718                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1719                         chandef->center_freq2 =
1720                                 nla_get_u32(
1721                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1722         }
1723
1724         if (!cfg80211_chandef_valid(chandef))
1725                 return -EINVAL;
1726
1727         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1728                                      IEEE80211_CHAN_DISABLED))
1729                 return -EINVAL;
1730
1731         return 0;
1732 }
1733
1734 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1735                                  struct wireless_dev *wdev,
1736                                  struct genl_info *info)
1737 {
1738         struct cfg80211_chan_def chandef;
1739         int result;
1740         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1741
1742         if (wdev)
1743                 iftype = wdev->iftype;
1744
1745         if (!nl80211_can_set_dev_channel(wdev))
1746                 return -EOPNOTSUPP;
1747
1748         result = nl80211_parse_chandef(rdev, info, &chandef);
1749         if (result)
1750                 return result;
1751
1752         switch (iftype) {
1753         case NL80211_IFTYPE_AP:
1754         case NL80211_IFTYPE_P2P_GO:
1755                 if (wdev->beacon_interval) {
1756                         result = -EBUSY;
1757                         break;
1758                 }
1759                 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef)) {
1760                         result = -EINVAL;
1761                         break;
1762                 }
1763                 wdev->preset_chandef = chandef;
1764                 result = 0;
1765                 break;
1766         case NL80211_IFTYPE_MESH_POINT:
1767                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
1768                 break;
1769         case NL80211_IFTYPE_MONITOR:
1770                 result = cfg80211_set_monitor_channel(rdev, &chandef);
1771                 break;
1772         default:
1773                 result = -EINVAL;
1774         }
1775
1776         return result;
1777 }
1778
1779 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1780 {
1781         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1782         struct net_device *netdev = info->user_ptr[1];
1783
1784         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1785 }
1786
1787 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1788 {
1789         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1790         struct net_device *dev = info->user_ptr[1];
1791         struct wireless_dev *wdev = dev->ieee80211_ptr;
1792         const u8 *bssid;
1793
1794         if (!info->attrs[NL80211_ATTR_MAC])
1795                 return -EINVAL;
1796
1797         if (netif_running(dev))
1798                 return -EBUSY;
1799
1800         if (!rdev->ops->set_wds_peer)
1801                 return -EOPNOTSUPP;
1802
1803         if (wdev->iftype != NL80211_IFTYPE_WDS)
1804                 return -EOPNOTSUPP;
1805
1806         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1807         return rdev_set_wds_peer(rdev, dev, bssid);
1808 }
1809
1810
1811 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1812 {
1813         struct cfg80211_registered_device *rdev;
1814         struct net_device *netdev = NULL;
1815         struct wireless_dev *wdev;
1816         int result = 0, rem_txq_params = 0;
1817         struct nlattr *nl_txq_params;
1818         u32 changed;
1819         u8 retry_short = 0, retry_long = 0;
1820         u32 frag_threshold = 0, rts_threshold = 0;
1821         u8 coverage_class = 0;
1822
1823         ASSERT_RTNL();
1824
1825         /*
1826          * Try to find the wiphy and netdev. Normally this
1827          * function shouldn't need the netdev, but this is
1828          * done for backward compatibility -- previously
1829          * setting the channel was done per wiphy, but now
1830          * it is per netdev. Previous userland like hostapd
1831          * also passed a netdev to set_wiphy, so that it is
1832          * possible to let that go to the right netdev!
1833          */
1834
1835         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1836                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1837
1838                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1839                 if (netdev && netdev->ieee80211_ptr)
1840                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1841                 else
1842                         netdev = NULL;
1843         }
1844
1845         if (!netdev) {
1846                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
1847                                                   info->attrs);
1848                 if (IS_ERR(rdev))
1849                         return PTR_ERR(rdev);
1850                 wdev = NULL;
1851                 netdev = NULL;
1852                 result = 0;
1853         } else
1854                 wdev = netdev->ieee80211_ptr;
1855
1856         /*
1857          * end workaround code, by now the rdev is available
1858          * and locked, and wdev may or may not be NULL.
1859          */
1860
1861         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1862                 result = cfg80211_dev_rename(
1863                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1864
1865         if (result)
1866                 goto bad_res;
1867
1868         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1869                 struct ieee80211_txq_params txq_params;
1870                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1871
1872                 if (!rdev->ops->set_txq_params) {
1873                         result = -EOPNOTSUPP;
1874                         goto bad_res;
1875                 }
1876
1877                 if (!netdev) {
1878                         result = -EINVAL;
1879                         goto bad_res;
1880                 }
1881
1882                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1883                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
1884                         result = -EINVAL;
1885                         goto bad_res;
1886                 }
1887
1888                 if (!netif_running(netdev)) {
1889                         result = -ENETDOWN;
1890                         goto bad_res;
1891                 }
1892
1893                 nla_for_each_nested(nl_txq_params,
1894                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1895                                     rem_txq_params) {
1896                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1897                                   nla_data(nl_txq_params),
1898                                   nla_len(nl_txq_params),
1899                                   txq_params_policy);
1900                         result = parse_txq_params(tb, &txq_params);
1901                         if (result)
1902                                 goto bad_res;
1903
1904                         result = rdev_set_txq_params(rdev, netdev,
1905                                                      &txq_params);
1906                         if (result)
1907                                 goto bad_res;
1908                 }
1909         }
1910
1911         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1912                 result = __nl80211_set_channel(rdev,
1913                                 nl80211_can_set_dev_channel(wdev) ? wdev : NULL,
1914                                 info);
1915                 if (result)
1916                         goto bad_res;
1917         }
1918
1919         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1920                 struct wireless_dev *txp_wdev = wdev;
1921                 enum nl80211_tx_power_setting type;
1922                 int idx, mbm = 0;
1923
1924                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
1925                         txp_wdev = NULL;
1926
1927                 if (!rdev->ops->set_tx_power) {
1928                         result = -EOPNOTSUPP;
1929                         goto bad_res;
1930                 }
1931
1932                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1933                 type = nla_get_u32(info->attrs[idx]);
1934
1935                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1936                     (type != NL80211_TX_POWER_AUTOMATIC)) {
1937                         result = -EINVAL;
1938                         goto bad_res;
1939                 }
1940
1941                 if (type != NL80211_TX_POWER_AUTOMATIC) {
1942                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1943                         mbm = nla_get_u32(info->attrs[idx]);
1944                 }
1945
1946                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
1947                 if (result)
1948                         goto bad_res;
1949         }
1950
1951         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
1952             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
1953                 u32 tx_ant, rx_ant;
1954                 if ((!rdev->wiphy.available_antennas_tx &&
1955                      !rdev->wiphy.available_antennas_rx) ||
1956                     !rdev->ops->set_antenna) {
1957                         result = -EOPNOTSUPP;
1958                         goto bad_res;
1959                 }
1960
1961                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
1962                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
1963
1964                 /* reject antenna configurations which don't match the
1965                  * available antenna masks, except for the "all" mask */
1966                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
1967                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
1968                         result = -EINVAL;
1969                         goto bad_res;
1970                 }
1971
1972                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
1973                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
1974
1975                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
1976                 if (result)
1977                         goto bad_res;
1978         }
1979
1980         changed = 0;
1981
1982         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
1983                 retry_short = nla_get_u8(
1984                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
1985                 if (retry_short == 0) {
1986                         result = -EINVAL;
1987                         goto bad_res;
1988                 }
1989                 changed |= WIPHY_PARAM_RETRY_SHORT;
1990         }
1991
1992         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
1993                 retry_long = nla_get_u8(
1994                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
1995                 if (retry_long == 0) {
1996                         result = -EINVAL;
1997                         goto bad_res;
1998                 }
1999                 changed |= WIPHY_PARAM_RETRY_LONG;
2000         }
2001
2002         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2003                 frag_threshold = nla_get_u32(
2004                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2005                 if (frag_threshold < 256) {
2006                         result = -EINVAL;
2007                         goto bad_res;
2008                 }
2009                 if (frag_threshold != (u32) -1) {
2010                         /*
2011                          * Fragments (apart from the last one) are required to
2012                          * have even length. Make the fragmentation code
2013                          * simpler by stripping LSB should someone try to use
2014                          * odd threshold value.
2015                          */
2016                         frag_threshold &= ~0x1;
2017                 }
2018                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2019         }
2020
2021         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2022                 rts_threshold = nla_get_u32(
2023                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2024                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2025         }
2026
2027         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2028                 coverage_class = nla_get_u8(
2029                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2030                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2031         }
2032
2033         if (changed) {
2034                 u8 old_retry_short, old_retry_long;
2035                 u32 old_frag_threshold, old_rts_threshold;
2036                 u8 old_coverage_class;
2037
2038                 if (!rdev->ops->set_wiphy_params) {
2039                         result = -EOPNOTSUPP;
2040                         goto bad_res;
2041                 }
2042
2043                 old_retry_short = rdev->wiphy.retry_short;
2044                 old_retry_long = rdev->wiphy.retry_long;
2045                 old_frag_threshold = rdev->wiphy.frag_threshold;
2046                 old_rts_threshold = rdev->wiphy.rts_threshold;
2047                 old_coverage_class = rdev->wiphy.coverage_class;
2048
2049                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2050                         rdev->wiphy.retry_short = retry_short;
2051                 if (changed & WIPHY_PARAM_RETRY_LONG)
2052                         rdev->wiphy.retry_long = retry_long;
2053                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2054                         rdev->wiphy.frag_threshold = frag_threshold;
2055                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2056                         rdev->wiphy.rts_threshold = rts_threshold;
2057                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2058                         rdev->wiphy.coverage_class = coverage_class;
2059
2060                 result = rdev_set_wiphy_params(rdev, changed);
2061                 if (result) {
2062                         rdev->wiphy.retry_short = old_retry_short;
2063                         rdev->wiphy.retry_long = old_retry_long;
2064                         rdev->wiphy.frag_threshold = old_frag_threshold;
2065                         rdev->wiphy.rts_threshold = old_rts_threshold;
2066                         rdev->wiphy.coverage_class = old_coverage_class;
2067                 }
2068         }
2069
2070  bad_res:
2071         if (netdev)
2072                 dev_put(netdev);
2073         return result;
2074 }
2075
2076 static inline u64 wdev_id(struct wireless_dev *wdev)
2077 {
2078         return (u64)wdev->identifier |
2079                ((u64)wiphy_to_dev(wdev->wiphy)->wiphy_idx << 32);
2080 }
2081
2082 static int nl80211_send_chandef(struct sk_buff *msg,
2083                                  struct cfg80211_chan_def *chandef)
2084 {
2085         WARN_ON(!cfg80211_chandef_valid(chandef));
2086
2087         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2088                         chandef->chan->center_freq))
2089                 return -ENOBUFS;
2090         switch (chandef->width) {
2091         case NL80211_CHAN_WIDTH_20_NOHT:
2092         case NL80211_CHAN_WIDTH_20:
2093         case NL80211_CHAN_WIDTH_40:
2094                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2095                                 cfg80211_get_chandef_type(chandef)))
2096                         return -ENOBUFS;
2097                 break;
2098         default:
2099                 break;
2100         }
2101         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2102                 return -ENOBUFS;
2103         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2104                 return -ENOBUFS;
2105         if (chandef->center_freq2 &&
2106             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2107                 return -ENOBUFS;
2108         return 0;
2109 }
2110
2111 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2112                               struct cfg80211_registered_device *rdev,
2113                               struct wireless_dev *wdev)
2114 {
2115         struct net_device *dev = wdev->netdev;
2116         void *hdr;
2117
2118         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
2119         if (!hdr)
2120                 return -1;
2121
2122         if (dev &&
2123             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2124              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2125                 goto nla_put_failure;
2126
2127         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2128             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2129             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2130             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2131             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2132                         rdev->devlist_generation ^
2133                         (cfg80211_rdev_list_generation << 2)))
2134                 goto nla_put_failure;
2135
2136         if (rdev->ops->get_channel) {
2137                 int ret;
2138                 struct cfg80211_chan_def chandef;
2139
2140                 ret = rdev_get_channel(rdev, wdev, &chandef);
2141                 if (ret == 0) {
2142                         if (nl80211_send_chandef(msg, &chandef))
2143                                 goto nla_put_failure;
2144                 }
2145         }
2146
2147         if (wdev->ssid_len) {
2148                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2149                         goto nla_put_failure;
2150         }
2151
2152         return genlmsg_end(msg, hdr);
2153
2154  nla_put_failure:
2155         genlmsg_cancel(msg, hdr);
2156         return -EMSGSIZE;
2157 }
2158
2159 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2160 {
2161         int wp_idx = 0;
2162         int if_idx = 0;
2163         int wp_start = cb->args[0];
2164         int if_start = cb->args[1];
2165         struct cfg80211_registered_device *rdev;
2166         struct wireless_dev *wdev;
2167
2168         rtnl_lock();
2169         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2170                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2171                         continue;
2172                 if (wp_idx < wp_start) {
2173                         wp_idx++;
2174                         continue;
2175                 }
2176                 if_idx = 0;
2177
2178                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
2179                         if (if_idx < if_start) {
2180                                 if_idx++;
2181                                 continue;
2182                         }
2183                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2184                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2185                                                rdev, wdev) < 0) {
2186                                 goto out;
2187                         }
2188                         if_idx++;
2189                 }
2190
2191                 wp_idx++;
2192         }
2193  out:
2194         rtnl_unlock();
2195
2196         cb->args[0] = wp_idx;
2197         cb->args[1] = if_idx;
2198
2199         return skb->len;
2200 }
2201
2202 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2203 {
2204         struct sk_buff *msg;
2205         struct cfg80211_registered_device *dev = info->user_ptr[0];
2206         struct wireless_dev *wdev = info->user_ptr[1];
2207
2208         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2209         if (!msg)
2210                 return -ENOMEM;
2211
2212         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2213                                dev, wdev) < 0) {
2214                 nlmsg_free(msg);
2215                 return -ENOBUFS;
2216         }
2217
2218         return genlmsg_reply(msg, info);
2219 }
2220
2221 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2222         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2223         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2224         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2225         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2226         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2227         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2228 };
2229
2230 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2231 {
2232         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2233         int flag;
2234
2235         *mntrflags = 0;
2236
2237         if (!nla)
2238                 return -EINVAL;
2239
2240         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2241                              nla, mntr_flags_policy))
2242                 return -EINVAL;
2243
2244         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2245                 if (flags[flag])
2246                         *mntrflags |= (1<<flag);
2247
2248         return 0;
2249 }
2250
2251 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2252                                struct net_device *netdev, u8 use_4addr,
2253                                enum nl80211_iftype iftype)
2254 {
2255         if (!use_4addr) {
2256                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2257                         return -EBUSY;
2258                 return 0;
2259         }
2260
2261         switch (iftype) {
2262         case NL80211_IFTYPE_AP_VLAN:
2263                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2264                         return 0;
2265                 break;
2266         case NL80211_IFTYPE_STATION:
2267                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2268                         return 0;
2269                 break;
2270         default:
2271                 break;
2272         }
2273
2274         return -EOPNOTSUPP;
2275 }
2276
2277 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2278 {
2279         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2280         struct vif_params params;
2281         int err;
2282         enum nl80211_iftype otype, ntype;
2283         struct net_device *dev = info->user_ptr[1];
2284         u32 _flags, *flags = NULL;
2285         bool change = false;
2286
2287         memset(&params, 0, sizeof(params));
2288
2289         otype = ntype = dev->ieee80211_ptr->iftype;
2290
2291         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2292                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2293                 if (otype != ntype)
2294                         change = true;
2295                 if (ntype > NL80211_IFTYPE_MAX)
2296                         return -EINVAL;
2297         }
2298
2299         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2300                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2301
2302                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2303                         return -EINVAL;
2304                 if (netif_running(dev))
2305                         return -EBUSY;
2306
2307                 wdev_lock(wdev);
2308                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2309                              IEEE80211_MAX_MESH_ID_LEN);
2310                 wdev->mesh_id_up_len =
2311                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2312                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2313                        wdev->mesh_id_up_len);
2314                 wdev_unlock(wdev);
2315         }
2316
2317         if (info->attrs[NL80211_ATTR_4ADDR]) {
2318                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2319                 change = true;
2320                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2321                 if (err)
2322                         return err;
2323         } else {
2324                 params.use_4addr = -1;
2325         }
2326
2327         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2328                 if (ntype != NL80211_IFTYPE_MONITOR)
2329                         return -EINVAL;
2330                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2331                                           &_flags);
2332                 if (err)
2333                         return err;
2334
2335                 flags = &_flags;
2336                 change = true;
2337         }
2338
2339         if (flags && (*flags & NL80211_MNTR_FLAG_ACTIVE) &&
2340             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2341                 return -EOPNOTSUPP;
2342
2343         if (change)
2344                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2345         else
2346                 err = 0;
2347
2348         if (!err && params.use_4addr != -1)
2349                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2350
2351         return err;
2352 }
2353
2354 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2355 {
2356         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2357         struct vif_params params;
2358         struct wireless_dev *wdev;
2359         struct sk_buff *msg;
2360         int err;
2361         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2362         u32 flags;
2363
2364         memset(&params, 0, sizeof(params));
2365
2366         if (!info->attrs[NL80211_ATTR_IFNAME])
2367                 return -EINVAL;
2368
2369         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2370                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2371                 if (type > NL80211_IFTYPE_MAX)
2372                         return -EINVAL;
2373         }
2374
2375         if (!rdev->ops->add_virtual_intf ||
2376             !(rdev->wiphy.interface_modes & (1 << type)))
2377                 return -EOPNOTSUPP;
2378
2379         if (type == NL80211_IFTYPE_P2P_DEVICE && info->attrs[NL80211_ATTR_MAC]) {
2380                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2381                            ETH_ALEN);
2382                 if (!is_valid_ether_addr(params.macaddr))
2383                         return -EADDRNOTAVAIL;
2384         }
2385
2386         if (info->attrs[NL80211_ATTR_4ADDR]) {
2387                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2388                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2389                 if (err)
2390                         return err;
2391         }
2392
2393         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2394         if (!msg)
2395                 return -ENOMEM;
2396
2397         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2398                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2399                                   &flags);
2400
2401         if (!err && (flags & NL80211_MNTR_FLAG_ACTIVE) &&
2402             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2403                 return -EOPNOTSUPP;
2404
2405         wdev = rdev_add_virtual_intf(rdev,
2406                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2407                                 type, err ? NULL : &flags, &params);
2408         if (IS_ERR(wdev)) {
2409                 nlmsg_free(msg);
2410                 return PTR_ERR(wdev);
2411         }
2412
2413         switch (type) {
2414         case NL80211_IFTYPE_MESH_POINT:
2415                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2416                         break;
2417                 wdev_lock(wdev);
2418                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2419                              IEEE80211_MAX_MESH_ID_LEN);
2420                 wdev->mesh_id_up_len =
2421                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2422                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2423                        wdev->mesh_id_up_len);
2424                 wdev_unlock(wdev);
2425                 break;
2426         case NL80211_IFTYPE_P2P_DEVICE:
2427                 /*
2428                  * P2P Device doesn't have a netdev, so doesn't go
2429                  * through the netdev notifier and must be added here
2430                  */
2431                 mutex_init(&wdev->mtx);
2432                 INIT_LIST_HEAD(&wdev->event_list);
2433                 spin_lock_init(&wdev->event_lock);
2434                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2435                 spin_lock_init(&wdev->mgmt_registrations_lock);
2436
2437                 wdev->identifier = ++rdev->wdev_id;
2438                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2439                 rdev->devlist_generation++;
2440                 break;
2441         default:
2442                 break;
2443         }
2444
2445         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2446                                rdev, wdev) < 0) {
2447                 nlmsg_free(msg);
2448                 return -ENOBUFS;
2449         }
2450
2451         return genlmsg_reply(msg, info);
2452 }
2453
2454 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2455 {
2456         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2457         struct wireless_dev *wdev = info->user_ptr[1];
2458
2459         if (!rdev->ops->del_virtual_intf)
2460                 return -EOPNOTSUPP;
2461
2462         /*
2463          * If we remove a wireless device without a netdev then clear
2464          * user_ptr[1] so that nl80211_post_doit won't dereference it
2465          * to check if it needs to do dev_put(). Otherwise it crashes
2466          * since the wdev has been freed, unlike with a netdev where
2467          * we need the dev_put() for the netdev to really be freed.
2468          */
2469         if (!wdev->netdev)
2470                 info->user_ptr[1] = NULL;
2471
2472         return rdev_del_virtual_intf(rdev, wdev);
2473 }
2474
2475 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2476 {
2477         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2478         struct net_device *dev = info->user_ptr[1];
2479         u16 noack_map;
2480
2481         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2482                 return -EINVAL;
2483
2484         if (!rdev->ops->set_noack_map)
2485                 return -EOPNOTSUPP;
2486
2487         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2488
2489         return rdev_set_noack_map(rdev, dev, noack_map);
2490 }
2491
2492 struct get_key_cookie {
2493         struct sk_buff *msg;
2494         int error;
2495         int idx;
2496 };
2497
2498 static void get_key_callback(void *c, struct key_params *params)
2499 {
2500         struct nlattr *key;
2501         struct get_key_cookie *cookie = c;
2502
2503         if ((params->key &&
2504              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2505                      params->key_len, params->key)) ||
2506             (params->seq &&
2507              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2508                      params->seq_len, params->seq)) ||
2509             (params->cipher &&
2510              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2511                          params->cipher)))
2512                 goto nla_put_failure;
2513
2514         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2515         if (!key)
2516                 goto nla_put_failure;
2517
2518         if ((params->key &&
2519              nla_put(cookie->msg, NL80211_KEY_DATA,
2520                      params->key_len, params->key)) ||
2521             (params->seq &&
2522              nla_put(cookie->msg, NL80211_KEY_SEQ,
2523                      params->seq_len, params->seq)) ||
2524             (params->cipher &&
2525              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2526                          params->cipher)))
2527                 goto nla_put_failure;
2528
2529         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2530                 goto nla_put_failure;
2531
2532         nla_nest_end(cookie->msg, key);
2533
2534         return;
2535  nla_put_failure:
2536         cookie->error = 1;
2537 }
2538
2539 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2540 {
2541         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2542         int err;
2543         struct net_device *dev = info->user_ptr[1];
2544         u8 key_idx = 0;
2545         const u8 *mac_addr = NULL;
2546         bool pairwise;
2547         struct get_key_cookie cookie = {
2548                 .error = 0,
2549         };
2550         void *hdr;
2551         struct sk_buff *msg;
2552
2553         if (info->attrs[NL80211_ATTR_KEY_IDX])
2554                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2555
2556         if (key_idx > 5)
2557                 return -EINVAL;
2558
2559         if (info->attrs[NL80211_ATTR_MAC])
2560                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2561
2562         pairwise = !!mac_addr;
2563         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2564                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2565                 if (kt >= NUM_NL80211_KEYTYPES)
2566                         return -EINVAL;
2567                 if (kt != NL80211_KEYTYPE_GROUP &&
2568                     kt != NL80211_KEYTYPE_PAIRWISE)
2569                         return -EINVAL;
2570                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2571         }
2572
2573         if (!rdev->ops->get_key)
2574                 return -EOPNOTSUPP;
2575
2576         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2577         if (!msg)
2578                 return -ENOMEM;
2579
2580         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2581                              NL80211_CMD_NEW_KEY);
2582         if (IS_ERR(hdr))
2583                 return PTR_ERR(hdr);
2584
2585         cookie.msg = msg;
2586         cookie.idx = key_idx;
2587
2588         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2589             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2590                 goto nla_put_failure;
2591         if (mac_addr &&
2592             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2593                 goto nla_put_failure;
2594
2595         if (pairwise && mac_addr &&
2596             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2597                 return -ENOENT;
2598
2599         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2600                            get_key_callback);
2601
2602         if (err)
2603                 goto free_msg;
2604
2605         if (cookie.error)
2606                 goto nla_put_failure;
2607
2608         genlmsg_end(msg, hdr);
2609         return genlmsg_reply(msg, info);
2610
2611  nla_put_failure:
2612         err = -ENOBUFS;
2613  free_msg:
2614         nlmsg_free(msg);
2615         return err;
2616 }
2617
2618 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2619 {
2620         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2621         struct key_parse key;
2622         int err;
2623         struct net_device *dev = info->user_ptr[1];
2624
2625         err = nl80211_parse_key(info, &key);
2626         if (err)
2627                 return err;
2628
2629         if (key.idx < 0)
2630                 return -EINVAL;
2631
2632         /* only support setting default key */
2633         if (!key.def && !key.defmgmt)
2634                 return -EINVAL;
2635
2636         wdev_lock(dev->ieee80211_ptr);
2637
2638         if (key.def) {
2639                 if (!rdev->ops->set_default_key) {
2640                         err = -EOPNOTSUPP;
2641                         goto out;
2642                 }
2643
2644                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2645                 if (err)
2646                         goto out;
2647
2648                 err = rdev_set_default_key(rdev, dev, key.idx,
2649                                                  key.def_uni, key.def_multi);
2650
2651                 if (err)
2652                         goto out;
2653
2654 #ifdef CONFIG_CFG80211_WEXT
2655                 dev->ieee80211_ptr->wext.default_key = key.idx;
2656 #endif
2657         } else {
2658                 if (key.def_uni || !key.def_multi) {
2659                         err = -EINVAL;
2660                         goto out;
2661                 }
2662
2663                 if (!rdev->ops->set_default_mgmt_key) {
2664                         err = -EOPNOTSUPP;
2665                         goto out;
2666                 }
2667
2668                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2669                 if (err)
2670                         goto out;
2671
2672                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2673                 if (err)
2674                         goto out;
2675
2676 #ifdef CONFIG_CFG80211_WEXT
2677                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2678 #endif
2679         }
2680
2681  out:
2682         wdev_unlock(dev->ieee80211_ptr);
2683
2684         return err;
2685 }
2686
2687 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2688 {
2689         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2690         int err;
2691         struct net_device *dev = info->user_ptr[1];
2692         struct key_parse key;
2693         const u8 *mac_addr = NULL;
2694
2695         err = nl80211_parse_key(info, &key);
2696         if (err)
2697                 return err;
2698
2699         if (!key.p.key)
2700                 return -EINVAL;
2701
2702         if (info->attrs[NL80211_ATTR_MAC])
2703                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2704
2705         if (key.type == -1) {
2706                 if (mac_addr)
2707                         key.type = NL80211_KEYTYPE_PAIRWISE;
2708                 else
2709                         key.type = NL80211_KEYTYPE_GROUP;
2710         }
2711
2712         /* for now */
2713         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2714             key.type != NL80211_KEYTYPE_GROUP)
2715                 return -EINVAL;
2716
2717         if (!rdev->ops->add_key)
2718                 return -EOPNOTSUPP;
2719
2720         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2721                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2722                                            mac_addr))
2723                 return -EINVAL;
2724
2725         wdev_lock(dev->ieee80211_ptr);
2726         err = nl80211_key_allowed(dev->ieee80211_ptr);
2727         if (!err)
2728                 err = rdev_add_key(rdev, dev, key.idx,
2729                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2730                                     mac_addr, &key.p);
2731         wdev_unlock(dev->ieee80211_ptr);
2732
2733         return err;
2734 }
2735
2736 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2737 {
2738         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2739         int err;
2740         struct net_device *dev = info->user_ptr[1];
2741         u8 *mac_addr = NULL;
2742         struct key_parse key;
2743
2744         err = nl80211_parse_key(info, &key);
2745         if (err)
2746                 return err;
2747
2748         if (info->attrs[NL80211_ATTR_MAC])
2749                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2750
2751         if (key.type == -1) {
2752                 if (mac_addr)
2753                         key.type = NL80211_KEYTYPE_PAIRWISE;
2754                 else
2755                         key.type = NL80211_KEYTYPE_GROUP;
2756         }
2757
2758         /* for now */
2759         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2760             key.type != NL80211_KEYTYPE_GROUP)
2761                 return -EINVAL;
2762
2763         if (!rdev->ops->del_key)
2764                 return -EOPNOTSUPP;
2765
2766         wdev_lock(dev->ieee80211_ptr);
2767         err = nl80211_key_allowed(dev->ieee80211_ptr);
2768
2769         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2770             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2771                 err = -ENOENT;
2772
2773         if (!err)
2774                 err = rdev_del_key(rdev, dev, key.idx,
2775                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2776                                    mac_addr);
2777
2778 #ifdef CONFIG_CFG80211_WEXT
2779         if (!err) {
2780                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
2781                         dev->ieee80211_ptr->wext.default_key = -1;
2782                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2783                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2784         }
2785 #endif
2786         wdev_unlock(dev->ieee80211_ptr);
2787
2788         return err;
2789 }
2790
2791 /* This function returns an error or the number of nested attributes */
2792 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
2793 {
2794         struct nlattr *attr;
2795         int n_entries = 0, tmp;
2796
2797         nla_for_each_nested(attr, nl_attr, tmp) {
2798                 if (nla_len(attr) != ETH_ALEN)
2799                         return -EINVAL;
2800
2801                 n_entries++;
2802         }
2803
2804         return n_entries;
2805 }
2806
2807 /*
2808  * This function parses ACL information and allocates memory for ACL data.
2809  * On successful return, the calling function is responsible to free the
2810  * ACL buffer returned by this function.
2811  */
2812 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
2813                                                 struct genl_info *info)
2814 {
2815         enum nl80211_acl_policy acl_policy;
2816         struct nlattr *attr;
2817         struct cfg80211_acl_data *acl;
2818         int i = 0, n_entries, tmp;
2819
2820         if (!wiphy->max_acl_mac_addrs)
2821                 return ERR_PTR(-EOPNOTSUPP);
2822
2823         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
2824                 return ERR_PTR(-EINVAL);
2825
2826         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
2827         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
2828             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
2829                 return ERR_PTR(-EINVAL);
2830
2831         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
2832                 return ERR_PTR(-EINVAL);
2833
2834         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
2835         if (n_entries < 0)
2836                 return ERR_PTR(n_entries);
2837
2838         if (n_entries > wiphy->max_acl_mac_addrs)
2839                 return ERR_PTR(-ENOTSUPP);
2840
2841         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
2842                       GFP_KERNEL);
2843         if (!acl)
2844                 return ERR_PTR(-ENOMEM);
2845
2846         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
2847                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
2848                 i++;
2849         }
2850
2851         acl->n_acl_entries = n_entries;
2852         acl->acl_policy = acl_policy;
2853
2854         return acl;
2855 }
2856
2857 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
2858 {
2859         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2860         struct net_device *dev = info->user_ptr[1];
2861         struct cfg80211_acl_data *acl;
2862         int err;
2863
2864         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2865             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2866                 return -EOPNOTSUPP;
2867
2868         if (!dev->ieee80211_ptr->beacon_interval)
2869                 return -EINVAL;
2870
2871         acl = parse_acl_data(&rdev->wiphy, info);
2872         if (IS_ERR(acl))
2873                 return PTR_ERR(acl);
2874
2875         err = rdev_set_mac_acl(rdev, dev, acl);
2876
2877         kfree(acl);
2878
2879         return err;
2880 }
2881
2882 static int nl80211_parse_beacon(struct genl_info *info,
2883                                 struct cfg80211_beacon_data *bcn)
2884 {
2885         bool haveinfo = false;
2886
2887         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]) ||
2888             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]) ||
2889             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
2890             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2891                 return -EINVAL;
2892
2893         memset(bcn, 0, sizeof(*bcn));
2894
2895         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
2896                 bcn->head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2897                 bcn->head_len = nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2898                 if (!bcn->head_len)
2899                         return -EINVAL;
2900                 haveinfo = true;
2901         }
2902
2903         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
2904                 bcn->tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2905                 bcn->tail_len =
2906                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2907                 haveinfo = true;
2908         }
2909
2910         if (!haveinfo)
2911                 return -EINVAL;
2912
2913         if (info->attrs[NL80211_ATTR_IE]) {
2914                 bcn->beacon_ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2915                 bcn->beacon_ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2916         }
2917
2918         if (info->attrs[NL80211_ATTR_IE_PROBE_RESP]) {
2919                 bcn->proberesp_ies =
2920                         nla_data(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2921                 bcn->proberesp_ies_len =
2922                         nla_len(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2923         }
2924
2925         if (info->attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
2926                 bcn->assocresp_ies =
2927                         nla_data(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2928                 bcn->assocresp_ies_len =
2929                         nla_len(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2930         }
2931
2932         if (info->attrs[NL80211_ATTR_PROBE_RESP]) {
2933                 bcn->probe_resp =
2934                         nla_data(info->attrs[NL80211_ATTR_PROBE_RESP]);
2935                 bcn->probe_resp_len =
2936                         nla_len(info->attrs[NL80211_ATTR_PROBE_RESP]);
2937         }
2938
2939         return 0;
2940 }
2941
2942 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
2943                                    struct cfg80211_ap_settings *params)
2944 {
2945         struct wireless_dev *wdev;
2946         bool ret = false;
2947
2948         list_for_each_entry(wdev, &rdev->wdev_list, list) {
2949                 if (wdev->iftype != NL80211_IFTYPE_AP &&
2950                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
2951                         continue;
2952
2953                 if (!wdev->preset_chandef.chan)
2954                         continue;
2955
2956                 params->chandef = wdev->preset_chandef;
2957                 ret = true;
2958                 break;
2959         }
2960
2961         return ret;
2962 }
2963
2964 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
2965                                     enum nl80211_auth_type auth_type,
2966                                     enum nl80211_commands cmd)
2967 {
2968         if (auth_type > NL80211_AUTHTYPE_MAX)
2969                 return false;
2970
2971         switch (cmd) {
2972         case NL80211_CMD_AUTHENTICATE:
2973                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
2974                     auth_type == NL80211_AUTHTYPE_SAE)
2975                         return false;
2976                 return true;
2977         case NL80211_CMD_CONNECT:
2978         case NL80211_CMD_START_AP:
2979                 /* SAE not supported yet */
2980                 if (auth_type == NL80211_AUTHTYPE_SAE)
2981                         return false;
2982                 return true;
2983         default:
2984                 return false;
2985         }
2986 }
2987
2988 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
2989 {
2990         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2991         struct net_device *dev = info->user_ptr[1];
2992         struct wireless_dev *wdev = dev->ieee80211_ptr;
2993         struct cfg80211_ap_settings params;
2994         int err;
2995         u8 radar_detect_width = 0;
2996
2997         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2998             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2999                 return -EOPNOTSUPP;
3000
3001         if (!rdev->ops->start_ap)
3002                 return -EOPNOTSUPP;
3003
3004         if (wdev->beacon_interval)
3005                 return -EALREADY;
3006
3007         memset(&params, 0, sizeof(params));
3008
3009         /* these are required for START_AP */
3010         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3011             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3012             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3013                 return -EINVAL;
3014
3015         err = nl80211_parse_beacon(info, &params.beacon);
3016         if (err)
3017                 return err;
3018
3019         params.beacon_interval =
3020                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3021         params.dtim_period =
3022                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3023
3024         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
3025         if (err)
3026                 return err;
3027
3028         /*
3029          * In theory, some of these attributes should be required here
3030          * but since they were not used when the command was originally
3031          * added, keep them optional for old user space programs to let
3032          * them continue to work with drivers that do not need the
3033          * additional information -- drivers must check!
3034          */
3035         if (info->attrs[NL80211_ATTR_SSID]) {
3036                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3037                 params.ssid_len =
3038                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3039                 if (params.ssid_len == 0 ||
3040                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3041                         return -EINVAL;
3042         }
3043
3044         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3045                 params.hidden_ssid = nla_get_u32(
3046                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3047                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3048                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3049                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3050                         return -EINVAL;
3051         }
3052
3053         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3054
3055         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3056                 params.auth_type = nla_get_u32(
3057                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3058                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3059                                              NL80211_CMD_START_AP))
3060                         return -EINVAL;
3061         } else
3062                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3063
3064         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3065                                       NL80211_MAX_NR_CIPHER_SUITES);
3066         if (err)
3067                 return err;
3068
3069         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3070                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3071                         return -EOPNOTSUPP;
3072                 params.inactivity_timeout = nla_get_u16(
3073                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3074         }
3075
3076         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3077                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3078                         return -EINVAL;
3079                 params.p2p_ctwindow =
3080                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3081                 if (params.p2p_ctwindow > 127)
3082                         return -EINVAL;
3083                 if (params.p2p_ctwindow != 0 &&
3084                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3085                         return -EINVAL;
3086         }
3087
3088         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3089                 u8 tmp;
3090
3091                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3092                         return -EINVAL;
3093                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3094                 if (tmp > 1)
3095                         return -EINVAL;
3096                 params.p2p_opp_ps = tmp;
3097                 if (params.p2p_opp_ps != 0 &&
3098                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3099                         return -EINVAL;
3100         }
3101
3102         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3103                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
3104                 if (err)
3105                         return err;
3106         } else if (wdev->preset_chandef.chan) {
3107                 params.chandef = wdev->preset_chandef;
3108         } else if (!nl80211_get_ap_channel(rdev, &params))
3109                 return -EINVAL;
3110
3111         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
3112                 return -EINVAL;
3113
3114         err = cfg80211_chandef_dfs_required(wdev->wiphy, &params.chandef);
3115         if (err < 0)
3116                 return err;
3117         if (err) {
3118                 radar_detect_width = BIT(params.chandef.width);
3119                 params.radar_required = true;
3120         }
3121
3122         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
3123                                            params.chandef.chan,
3124                                            CHAN_MODE_SHARED,
3125                                            radar_detect_width);
3126         if (err)
3127                 return err;
3128
3129         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3130                 params.acl = parse_acl_data(&rdev->wiphy, info);
3131                 if (IS_ERR(params.acl))
3132                         return PTR_ERR(params.acl);
3133         }
3134
3135         err = rdev_start_ap(rdev, dev, &params);
3136         if (!err) {
3137                 wdev->preset_chandef = params.chandef;
3138                 wdev->beacon_interval = params.beacon_interval;
3139                 wdev->channel = params.chandef.chan;
3140                 wdev->ssid_len = params.ssid_len;
3141                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3142         }
3143
3144         kfree(params.acl);
3145
3146         return err;
3147 }
3148
3149 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3150 {
3151         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3152         struct net_device *dev = info->user_ptr[1];
3153         struct wireless_dev *wdev = dev->ieee80211_ptr;
3154         struct cfg80211_beacon_data params;
3155         int err;
3156
3157         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3158             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3159                 return -EOPNOTSUPP;
3160
3161         if (!rdev->ops->change_beacon)
3162                 return -EOPNOTSUPP;
3163
3164         if (!wdev->beacon_interval)
3165                 return -EINVAL;
3166
3167         err = nl80211_parse_beacon(info, &params);
3168         if (err)
3169                 return err;
3170
3171         return rdev_change_beacon(rdev, dev, &params);
3172 }
3173
3174 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3175 {
3176         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3177         struct net_device *dev = info->user_ptr[1];
3178
3179         return cfg80211_stop_ap(rdev, dev);
3180 }
3181
3182 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3183         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3184         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3185         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3186         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3187         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3188         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3189 };
3190
3191 static int parse_station_flags(struct genl_info *info,
3192                                enum nl80211_iftype iftype,
3193                                struct station_parameters *params)
3194 {
3195         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3196         struct nlattr *nla;
3197         int flag;
3198
3199         /*
3200          * Try parsing the new attribute first so userspace
3201          * can specify both for older kernels.
3202          */
3203         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3204         if (nla) {
3205                 struct nl80211_sta_flag_update *sta_flags;
3206
3207                 sta_flags = nla_data(nla);
3208                 params->sta_flags_mask = sta_flags->mask;
3209                 params->sta_flags_set = sta_flags->set;
3210                 params->sta_flags_set &= params->sta_flags_mask;
3211                 if ((params->sta_flags_mask |
3212                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3213                         return -EINVAL;
3214                 return 0;
3215         }
3216
3217         /* if present, parse the old attribute */
3218
3219         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3220         if (!nla)
3221                 return 0;
3222
3223         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3224                              nla, sta_flags_policy))
3225                 return -EINVAL;
3226
3227         /*
3228          * Only allow certain flags for interface types so that
3229          * other attributes are silently ignored. Remember that
3230          * this is backward compatibility code with old userspace
3231          * and shouldn't be hit in other cases anyway.
3232          */
3233         switch (iftype) {
3234         case NL80211_IFTYPE_AP:
3235         case NL80211_IFTYPE_AP_VLAN:
3236         case NL80211_IFTYPE_P2P_GO:
3237                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3238                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3239                                          BIT(NL80211_STA_FLAG_WME) |
3240                                          BIT(NL80211_STA_FLAG_MFP);
3241                 break;
3242         case NL80211_IFTYPE_P2P_CLIENT:
3243         case NL80211_IFTYPE_STATION:
3244                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3245                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3246                 break;
3247         case NL80211_IFTYPE_MESH_POINT:
3248                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3249                                          BIT(NL80211_STA_FLAG_MFP) |
3250                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3251         default:
3252                 return -EINVAL;
3253         }
3254
3255         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3256                 if (flags[flag]) {
3257                         params->sta_flags_set |= (1<<flag);
3258
3259                         /* no longer support new API additions in old API */
3260                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3261                                 return -EINVAL;
3262                 }
3263         }
3264
3265         return 0;
3266 }
3267
3268 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3269                                  int attr)
3270 {
3271         struct nlattr *rate;
3272         u32 bitrate;
3273         u16 bitrate_compat;
3274
3275         rate = nla_nest_start(msg, attr);
3276         if (!rate)
3277                 return false;
3278
3279         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3280         bitrate = cfg80211_calculate_bitrate(info);
3281         /* report 16-bit bitrate only if we can */
3282         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3283         if (bitrate > 0 &&
3284             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3285                 return false;
3286         if (bitrate_compat > 0 &&
3287             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3288                 return false;
3289
3290         if (info->flags & RATE_INFO_FLAGS_MCS) {
3291                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3292                         return false;
3293                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3294                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3295                         return false;
3296                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3297                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3298                         return false;
3299         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3300                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3301                         return false;
3302                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3303                         return false;
3304                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3305                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3306                         return false;
3307                 if (info->flags & RATE_INFO_FLAGS_80_MHZ_WIDTH &&
3308                     nla_put_flag(msg, NL80211_RATE_INFO_80_MHZ_WIDTH))
3309                         return false;
3310                 if (info->flags & RATE_INFO_FLAGS_80P80_MHZ_WIDTH &&
3311                     nla_put_flag(msg, NL80211_RATE_INFO_80P80_MHZ_WIDTH))
3312                         return false;
3313                 if (info->flags & RATE_INFO_FLAGS_160_MHZ_WIDTH &&
3314                     nla_put_flag(msg, NL80211_RATE_INFO_160_MHZ_WIDTH))
3315                         return false;
3316                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3317                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3318                         return false;
3319         }
3320
3321         nla_nest_end(msg, rate);
3322         return true;
3323 }
3324
3325 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
3326                                int id)
3327 {
3328         void *attr;
3329         int i = 0;
3330
3331         if (!mask)
3332                 return true;
3333
3334         attr = nla_nest_start(msg, id);
3335         if (!attr)
3336                 return false;
3337
3338         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
3339                 if (!(mask & BIT(i)))
3340                         continue;
3341
3342                 if (nla_put_u8(msg, i, signal[i]))
3343                         return false;
3344         }
3345
3346         nla_nest_end(msg, attr);
3347
3348         return true;
3349 }
3350
3351 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
3352                                 int flags,
3353                                 struct cfg80211_registered_device *rdev,
3354                                 struct net_device *dev,
3355                                 const u8 *mac_addr, struct station_info *sinfo)
3356 {
3357         void *hdr;
3358         struct nlattr *sinfoattr, *bss_param;
3359
3360         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3361         if (!hdr)
3362                 return -1;
3363
3364         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3365             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3366             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3367                 goto nla_put_failure;
3368
3369         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3370         if (!sinfoattr)
3371                 goto nla_put_failure;
3372         if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
3373             nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
3374                         sinfo->connected_time))
3375                 goto nla_put_failure;
3376         if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
3377             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
3378                         sinfo->inactive_time))
3379                 goto nla_put_failure;
3380         if ((sinfo->filled & (STATION_INFO_RX_BYTES |
3381                               STATION_INFO_RX_BYTES64)) &&
3382             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3383                         (u32)sinfo->rx_bytes))
3384                 goto nla_put_failure;
3385         if ((sinfo->filled & (STATION_INFO_TX_BYTES |
3386                               STATION_INFO_TX_BYTES64)) &&
3387             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3388                         (u32)sinfo->tx_bytes))
3389                 goto nla_put_failure;
3390         if ((sinfo->filled & STATION_INFO_RX_BYTES64) &&
3391             nla_put_u64(msg, NL80211_STA_INFO_RX_BYTES64,
3392                         sinfo->rx_bytes))
3393                 goto nla_put_failure;
3394         if ((sinfo->filled & STATION_INFO_TX_BYTES64) &&
3395             nla_put_u64(msg, NL80211_STA_INFO_TX_BYTES64,
3396                         sinfo->tx_bytes))
3397                 goto nla_put_failure;
3398         if ((sinfo->filled & STATION_INFO_LLID) &&
3399             nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
3400                 goto nla_put_failure;
3401         if ((sinfo->filled & STATION_INFO_PLID) &&
3402             nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
3403                 goto nla_put_failure;
3404         if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
3405             nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
3406                        sinfo->plink_state))
3407                 goto nla_put_failure;
3408         switch (rdev->wiphy.signal_type) {
3409         case CFG80211_SIGNAL_TYPE_MBM:
3410                 if ((sinfo->filled & STATION_INFO_SIGNAL) &&
3411                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
3412                                sinfo->signal))
3413                         goto nla_put_failure;
3414                 if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
3415                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
3416                                sinfo->signal_avg))
3417                         goto nla_put_failure;
3418                 break;
3419         default:
3420                 break;
3421         }
3422         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL) {
3423                 if (!nl80211_put_signal(msg, sinfo->chains,
3424                                         sinfo->chain_signal,
3425                                         NL80211_STA_INFO_CHAIN_SIGNAL))
3426                         goto nla_put_failure;
3427         }
3428         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL_AVG) {
3429                 if (!nl80211_put_signal(msg, sinfo->chains,
3430                                         sinfo->chain_signal_avg,
3431                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
3432                         goto nla_put_failure;
3433         }
3434         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
3435                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3436                                           NL80211_STA_INFO_TX_BITRATE))
3437                         goto nla_put_failure;
3438         }
3439         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
3440                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3441                                           NL80211_STA_INFO_RX_BITRATE))
3442                         goto nla_put_failure;
3443         }
3444         if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
3445             nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
3446                         sinfo->rx_packets))
3447                 goto nla_put_failure;
3448         if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
3449             nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
3450                         sinfo->tx_packets))
3451                 goto nla_put_failure;
3452         if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
3453             nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
3454                         sinfo->tx_retries))
3455                 goto nla_put_failure;
3456         if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
3457             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
3458                         sinfo->tx_failed))
3459                 goto nla_put_failure;
3460         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
3461             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
3462                         sinfo->beacon_loss_count))
3463                 goto nla_put_failure;
3464         if ((sinfo->filled & STATION_INFO_LOCAL_PM) &&
3465             nla_put_u32(msg, NL80211_STA_INFO_LOCAL_PM,
3466                         sinfo->local_pm))
3467                 goto nla_put_failure;
3468         if ((sinfo->filled & STATION_INFO_PEER_PM) &&
3469             nla_put_u32(msg, NL80211_STA_INFO_PEER_PM,
3470                         sinfo->peer_pm))
3471                 goto nla_put_failure;
3472         if ((sinfo->filled & STATION_INFO_NONPEER_PM) &&
3473             nla_put_u32(msg, NL80211_STA_INFO_NONPEER_PM,
3474                         sinfo->nonpeer_pm))
3475                 goto nla_put_failure;
3476         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
3477                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3478                 if (!bss_param)
3479                         goto nla_put_failure;
3480
3481                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3482                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3483                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3484                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3485                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3486                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3487                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3488                                sinfo->bss_param.dtim_period) ||
3489                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3490                                 sinfo->bss_param.beacon_interval))
3491                         goto nla_put_failure;
3492
3493                 nla_nest_end(msg, bss_param);
3494         }
3495         if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
3496             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3497                     sizeof(struct nl80211_sta_flag_update),
3498                     &sinfo->sta_flags))
3499                 goto nla_put_failure;
3500         if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
3501                 nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
3502                             sinfo->t_offset))
3503                 goto nla_put_failure;
3504         nla_nest_end(msg, sinfoattr);
3505
3506         if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
3507             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3508                     sinfo->assoc_req_ies))
3509                 goto nla_put_failure;
3510
3511         return genlmsg_end(msg, hdr);
3512
3513  nla_put_failure:
3514         genlmsg_cancel(msg, hdr);
3515         return -EMSGSIZE;
3516 }
3517
3518 static int nl80211_dump_station(struct sk_buff *skb,
3519                                 struct netlink_callback *cb)
3520 {
3521         struct station_info sinfo;
3522         struct cfg80211_registered_device *dev;
3523         struct wireless_dev *wdev;
3524         u8 mac_addr[ETH_ALEN];
3525         int sta_idx = cb->args[2];
3526         int err;
3527
3528         err = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
3529         if (err)
3530                 return err;
3531
3532         if (!wdev->netdev) {
3533                 err = -EINVAL;
3534                 goto out_err;
3535         }
3536
3537         if (!dev->ops->dump_station) {
3538                 err = -EOPNOTSUPP;
3539                 goto out_err;
3540         }
3541
3542         while (1) {
3543                 memset(&sinfo, 0, sizeof(sinfo));
3544                 err = rdev_dump_station(dev, wdev->netdev, sta_idx,
3545                                         mac_addr, &sinfo);
3546                 if (err == -ENOENT)
3547                         break;
3548                 if (err)
3549                         goto out_err;
3550
3551                 if (nl80211_send_station(skb,
3552                                 NETLINK_CB(cb->skb).portid,
3553                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3554                                 dev, wdev->netdev, mac_addr,
3555                                 &sinfo) < 0)
3556                         goto out;
3557
3558                 sta_idx++;
3559         }
3560
3561
3562  out:
3563         cb->args[2] = sta_idx;
3564         err = skb->len;
3565  out_err:
3566         nl80211_finish_wdev_dump(dev);
3567
3568         return err;
3569 }
3570
3571 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3572 {
3573         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3574         struct net_device *dev = info->user_ptr[1];
3575         struct station_info sinfo;
3576         struct sk_buff *msg;
3577         u8 *mac_addr = NULL;
3578         int err;
3579
3580         memset(&sinfo, 0, sizeof(sinfo));
3581
3582         if (!info->attrs[NL80211_ATTR_MAC])
3583                 return -EINVAL;
3584
3585         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3586
3587         if (!rdev->ops->get_station)
3588                 return -EOPNOTSUPP;
3589
3590         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3591         if (err)
3592                 return err;
3593
3594         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3595         if (!msg)
3596                 return -ENOMEM;
3597
3598         if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3599                                  rdev, dev, mac_addr, &sinfo) < 0) {
3600                 nlmsg_free(msg);
3601                 return -ENOBUFS;
3602         }
3603
3604         return genlmsg_reply(msg, info);
3605 }
3606
3607 int cfg80211_check_station_change(struct wiphy *wiphy,
3608                                   struct station_parameters *params,
3609                                   enum cfg80211_station_type statype)
3610 {
3611         if (params->listen_interval != -1)
3612                 return -EINVAL;
3613         if (params->aid)
3614                 return -EINVAL;
3615
3616         /* When you run into this, adjust the code below for the new flag */
3617         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
3618
3619         switch (statype) {
3620         case CFG80211_STA_MESH_PEER_KERNEL:
3621         case CFG80211_STA_MESH_PEER_USER:
3622                 /*
3623                  * No ignoring the TDLS flag here -- the userspace mesh
3624                  * code doesn't have the bug of including TDLS in the
3625                  * mask everywhere.
3626                  */
3627                 if (params->sta_flags_mask &
3628                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3629                                   BIT(NL80211_STA_FLAG_MFP) |
3630                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3631                         return -EINVAL;
3632                 break;
3633         case CFG80211_STA_TDLS_PEER_SETUP:
3634         case CFG80211_STA_TDLS_PEER_ACTIVE:
3635                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3636                         return -EINVAL;
3637                 /* ignore since it can't change */
3638                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3639                 break;
3640         default:
3641                 /* disallow mesh-specific things */
3642                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3643                         return -EINVAL;
3644                 if (params->local_pm)
3645                         return -EINVAL;
3646                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3647                         return -EINVAL;
3648         }
3649
3650         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
3651             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
3652                 /* TDLS can't be set, ... */
3653                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3654                         return -EINVAL;
3655                 /*
3656                  * ... but don't bother the driver with it. This works around
3657                  * a hostapd/wpa_supplicant issue -- it always includes the
3658                  * TLDS_PEER flag in the mask even for AP mode.
3659                  */
3660                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3661         }
3662
3663         if (statype != CFG80211_STA_TDLS_PEER_SETUP) {
3664                 /* reject other things that can't change */
3665                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
3666                         return -EINVAL;
3667                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
3668                         return -EINVAL;
3669                 if (params->supported_rates)
3670                         return -EINVAL;
3671                 if (params->ext_capab || params->ht_capa || params->vht_capa)
3672                         return -EINVAL;
3673         }
3674
3675         if (statype != CFG80211_STA_AP_CLIENT) {
3676                 if (params->vlan)
3677                         return -EINVAL;
3678         }
3679
3680         switch (statype) {
3681         case CFG80211_STA_AP_MLME_CLIENT:
3682                 /* Use this only for authorizing/unauthorizing a station */
3683                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
3684                         return -EOPNOTSUPP;
3685                 break;
3686         case CFG80211_STA_AP_CLIENT:
3687                 /* accept only the listed bits */
3688                 if (params->sta_flags_mask &
3689                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3690                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3691                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
3692                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3693                                   BIT(NL80211_STA_FLAG_WME) |
3694                                   BIT(NL80211_STA_FLAG_MFP)))
3695                         return -EINVAL;
3696
3697                 /* but authenticated/associated only if driver handles it */
3698                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
3699                     params->sta_flags_mask &
3700                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3701                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
3702                         return -EINVAL;
3703                 break;
3704         case CFG80211_STA_IBSS:
3705         case CFG80211_STA_AP_STA:
3706                 /* reject any changes other than AUTHORIZED */
3707                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
3708                         return -EINVAL;
3709                 break;
3710         case CFG80211_STA_TDLS_PEER_SETUP:
3711                 /* reject any changes other than AUTHORIZED or WME */
3712                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3713                                                BIT(NL80211_STA_FLAG_WME)))
3714                         return -EINVAL;
3715                 /* force (at least) rates when authorizing */
3716                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
3717                     !params->supported_rates)
3718                         return -EINVAL;
3719                 break;
3720         case CFG80211_STA_TDLS_PEER_ACTIVE:
3721                 /* reject any changes */
3722                 return -EINVAL;
3723         case CFG80211_STA_MESH_PEER_KERNEL:
3724                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3725                         return -EINVAL;
3726                 break;
3727         case CFG80211_STA_MESH_PEER_USER:
3728                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3729                         return -EINVAL;
3730                 break;
3731         }
3732
3733         return 0;
3734 }
3735 EXPORT_SYMBOL(cfg80211_check_station_change);
3736
3737 /*
3738  * Get vlan interface making sure it is running and on the right wiphy.
3739  */
3740 static struct net_device *get_vlan(struct genl_info *info,
3741                                    struct cfg80211_registered_device *rdev)
3742 {
3743         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
3744         struct net_device *v;
3745         int ret;
3746
3747         if (!vlanattr)
3748                 return NULL;
3749
3750         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
3751         if (!v)
3752                 return ERR_PTR(-ENODEV);
3753
3754         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
3755                 ret = -EINVAL;
3756                 goto error;
3757         }
3758
3759         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
3760             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3761             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
3762                 ret = -EINVAL;
3763                 goto error;
3764         }
3765
3766         if (!netif_running(v)) {
3767                 ret = -ENETDOWN;
3768                 goto error;
3769         }
3770
3771         return v;
3772  error:
3773         dev_put(v);
3774         return ERR_PTR(ret);
3775 }
3776
3777 static struct nla_policy
3778 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
3779         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
3780         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
3781 };
3782
3783 static int nl80211_parse_sta_wme(struct genl_info *info,
3784                                  struct station_parameters *params)
3785 {
3786         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
3787         struct nlattr *nla;
3788         int err;
3789
3790         /* parse WME attributes if present */
3791         if (!info->attrs[NL80211_ATTR_STA_WME])
3792                 return 0;
3793
3794         nla = info->attrs[NL80211_ATTR_STA_WME];
3795         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
3796                                nl80211_sta_wme_policy);
3797         if (err)
3798                 return err;
3799
3800         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
3801                 params->uapsd_queues = nla_get_u8(
3802                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
3803         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
3804                 return -EINVAL;
3805
3806         if (tb[NL80211_STA_WME_MAX_SP])
3807                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
3808
3809         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
3810                 return -EINVAL;
3811
3812         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
3813
3814         return 0;
3815 }
3816
3817 static int nl80211_set_station_tdls(struct genl_info *info,
3818                                     struct station_parameters *params)
3819 {
3820         /* Dummy STA entry gets updated once the peer capabilities are known */
3821         if (info->attrs[NL80211_ATTR_PEER_AID])
3822                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
3823         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3824                 params->ht_capa =
3825                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3826         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
3827                 params->vht_capa =
3828                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
3829
3830         return nl80211_parse_sta_wme(info, params);
3831 }
3832
3833 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
3834 {
3835         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3836         struct net_device *dev = info->user_ptr[1];
3837         struct station_parameters params;
3838         u8 *mac_addr;
3839         int err;
3840
3841         memset(&params, 0, sizeof(params));
3842
3843         params.listen_interval = -1;
3844
3845         if (!rdev->ops->change_station)
3846                 return -EOPNOTSUPP;
3847
3848         if (info->attrs[NL80211_ATTR_STA_AID])
3849                 return -EINVAL;
3850
3851         if (!info->attrs[NL80211_ATTR_MAC])
3852                 return -EINVAL;
3853
3854         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3855
3856         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
3857                 params.supported_rates =
3858                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3859                 params.supported_rates_len =
3860                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3861         }
3862
3863         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
3864                 params.capability =
3865                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
3866                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
3867         }
3868
3869         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
3870                 params.ext_capab =
3871                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3872                 params.ext_capab_len =
3873                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3874         }
3875
3876         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3877                 return -EINVAL;
3878
3879         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3880                 return -EINVAL;
3881
3882         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
3883                 params.plink_action =
3884                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3885                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
3886                         return -EINVAL;
3887         }
3888
3889         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
3890                 params.plink_state =
3891                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
3892                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
3893                         return -EINVAL;
3894                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
3895         }
3896
3897         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
3898                 enum nl80211_mesh_power_mode pm = nla_get_u32(
3899                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
3900
3901                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
3902                     pm > NL80211_MESH_POWER_MAX)
3903                         return -EINVAL;
3904
3905                 params.local_pm = pm;
3906         }
3907
3908         /* Include parameters for TDLS peer (will check later) */
3909         err = nl80211_set_station_tdls(info, &params);
3910         if (err)
3911                 return err;
3912
3913         params.vlan = get_vlan(info, rdev);
3914         if (IS_ERR(params.vlan))
3915                 return PTR_ERR(params.vlan);
3916
3917         switch (dev->ieee80211_ptr->iftype) {
3918         case NL80211_IFTYPE_AP:
3919         case NL80211_IFTYPE_AP_VLAN:
3920         case NL80211_IFTYPE_P2P_GO:
3921         case NL80211_IFTYPE_P2P_CLIENT:
3922         case NL80211_IFTYPE_STATION:
3923         case NL80211_IFTYPE_ADHOC:
3924         case NL80211_IFTYPE_MESH_POINT:
3925                 break;
3926         default:
3927                 err = -EOPNOTSUPP;
3928                 goto out_put_vlan;
3929         }
3930
3931         /* driver will call cfg80211_check_station_change() */
3932         err = rdev_change_station(rdev, dev, mac_addr, &params);
3933
3934  out_put_vlan:
3935         if (params.vlan)
3936                 dev_put(params.vlan);
3937
3938         return err;
3939 }
3940
3941 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
3942 {
3943         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3944         int err;
3945         struct net_device *dev = info->user_ptr[1];
3946         struct station_parameters params;
3947         u8 *mac_addr = NULL;
3948
3949         memset(&params, 0, sizeof(params));
3950
3951         if (!rdev->ops->add_station)
3952                 return -EOPNOTSUPP;
3953
3954         if (!info->attrs[NL80211_ATTR_MAC])
3955                 return -EINVAL;
3956
3957         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3958                 return -EINVAL;
3959
3960         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
3961                 return -EINVAL;
3962
3963         if (!info->attrs[NL80211_ATTR_STA_AID] &&
3964             !info->attrs[NL80211_ATTR_PEER_AID])
3965                 return -EINVAL;
3966
3967         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3968         params.supported_rates =
3969                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3970         params.supported_rates_len =
3971                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3972         params.listen_interval =
3973                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
3974
3975         if (info->attrs[NL80211_ATTR_STA_AID])
3976                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
3977         else
3978                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
3979         if (!params.aid || params.aid > IEEE80211_MAX_AID)
3980                 return -EINVAL;
3981
3982         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
3983                 params.capability =
3984                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
3985                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
3986         }
3987
3988         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
3989                 params.ext_capab =
3990                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3991                 params.ext_capab_len =
3992                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3993         }
3994
3995         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3996                 params.ht_capa =
3997                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3998
3999         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4000                 params.vht_capa =
4001                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4002
4003         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4004                 params.plink_action =
4005                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4006                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4007                         return -EINVAL;
4008         }
4009
4010         err = nl80211_parse_sta_wme(info, &params);
4011         if (err)
4012                 return err;
4013
4014         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4015                 return -EINVAL;
4016
4017         /* When you run into this, adjust the code below for the new flag */
4018         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4019
4020         switch (dev->ieee80211_ptr->iftype) {
4021         case NL80211_IFTYPE_AP:
4022         case NL80211_IFTYPE_AP_VLAN:
4023         case NL80211_IFTYPE_P2P_GO:
4024                 /* ignore WME attributes if iface/sta is not capable */
4025                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
4026                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
4027                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4028
4029                 /* TDLS peers cannot be added */
4030                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4031                         return -EINVAL;
4032                 /* but don't bother the driver with it */
4033                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4034
4035                 /* allow authenticated/associated only if driver handles it */
4036                 if (!(rdev->wiphy.features &
4037                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4038                     params.sta_flags_mask &
4039                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4040                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4041                         return -EINVAL;
4042
4043                 /* must be last in here for error handling */
4044                 params.vlan = get_vlan(info, rdev);
4045                 if (IS_ERR(params.vlan))
4046                         return PTR_ERR(params.vlan);
4047                 break;
4048         case NL80211_IFTYPE_MESH_POINT:
4049                 /* ignore uAPSD data */
4050                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4051
4052                 /* associated is disallowed */
4053                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
4054                         return -EINVAL;
4055                 /* TDLS peers cannot be added */
4056                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4057                         return -EINVAL;
4058                 break;
4059         case NL80211_IFTYPE_STATION:
4060         case NL80211_IFTYPE_P2P_CLIENT:
4061                 /* ignore uAPSD data */
4062                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4063
4064                 /* these are disallowed */
4065                 if (params.sta_flags_mask &
4066                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
4067                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4068                         return -EINVAL;
4069                 /* Only TDLS peers can be added */
4070                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4071                         return -EINVAL;
4072                 /* Can only add if TDLS ... */
4073                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
4074                         return -EOPNOTSUPP;
4075                 /* ... with external setup is supported */
4076                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
4077                         return -EOPNOTSUPP;
4078                 /*
4079                  * Older wpa_supplicant versions always mark the TDLS peer
4080                  * as authorized, but it shouldn't yet be.
4081                  */
4082                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4083                 break;
4084         default:
4085                 return -EOPNOTSUPP;
4086         }
4087
4088         /* be aware of params.vlan when changing code here */
4089
4090         err = rdev_add_station(rdev, dev, mac_addr, &params);
4091
4092         if (params.vlan)
4093                 dev_put(params.vlan);
4094         return err;
4095 }
4096
4097 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
4098 {
4099         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4100         struct net_device *dev = info->user_ptr[1];
4101         u8 *mac_addr = NULL;
4102
4103         if (info->attrs[NL80211_ATTR_MAC])
4104                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4105
4106         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4107             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4108             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4109             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4110                 return -EINVAL;
4111
4112         if (!rdev->ops->del_station)
4113                 return -EOPNOTSUPP;
4114
4115         return rdev_del_station(rdev, dev, mac_addr);
4116 }
4117
4118 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4119                                 int flags, struct net_device *dev,
4120                                 u8 *dst, u8 *next_hop,
4121                                 struct mpath_info *pinfo)
4122 {
4123         void *hdr;
4124         struct nlattr *pinfoattr;
4125
4126         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
4127         if (!hdr)
4128                 return -1;
4129
4130         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4131             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
4132             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
4133             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
4134                 goto nla_put_failure;
4135
4136         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
4137         if (!pinfoattr)
4138                 goto nla_put_failure;
4139         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
4140             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
4141                         pinfo->frame_qlen))
4142                 goto nla_put_failure;
4143         if (((pinfo->filled & MPATH_INFO_SN) &&
4144              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
4145             ((pinfo->filled & MPATH_INFO_METRIC) &&
4146              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
4147                          pinfo->metric)) ||
4148             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
4149              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
4150                          pinfo->exptime)) ||
4151             ((pinfo->filled & MPATH_INFO_FLAGS) &&
4152              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
4153                         pinfo->flags)) ||
4154             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
4155              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
4156                          pinfo->discovery_timeout)) ||
4157             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
4158              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
4159                         pinfo->discovery_retries)))
4160                 goto nla_put_failure;
4161
4162         nla_nest_end(msg, pinfoattr);
4163
4164         return genlmsg_end(msg, hdr);
4165
4166  nla_put_failure:
4167         genlmsg_cancel(msg, hdr);
4168         return -EMSGSIZE;
4169 }
4170
4171 static int nl80211_dump_mpath(struct sk_buff *skb,
4172                               struct netlink_callback *cb)
4173 {
4174         struct mpath_info pinfo;
4175         struct cfg80211_registered_device *dev;
4176         struct wireless_dev *wdev;
4177         u8 dst[ETH_ALEN];
4178         u8 next_hop[ETH_ALEN];
4179         int path_idx = cb->args[2];
4180         int err;
4181
4182         err = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
4183         if (err)
4184                 return err;
4185
4186         if (!dev->ops->dump_mpath) {
4187                 err = -EOPNOTSUPP;
4188                 goto out_err;
4189         }
4190
4191         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4192                 err = -EOPNOTSUPP;
4193                 goto out_err;
4194         }
4195
4196         while (1) {
4197                 err = rdev_dump_mpath(dev, wdev->netdev, path_idx, dst,
4198                                       next_hop, &pinfo);
4199                 if (err == -ENOENT)
4200                         break;
4201                 if (err)
4202                         goto out_err;
4203
4204                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4205                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4206                                        wdev->netdev, dst, next_hop,
4207                                        &pinfo) < 0)
4208                         goto out;
4209
4210                 path_idx++;
4211         }
4212
4213
4214  out:
4215         cb->args[2] = path_idx;
4216         err = skb->len;
4217  out_err:
4218         nl80211_finish_wdev_dump(dev);
4219         return err;
4220 }
4221
4222 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
4223 {
4224         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4225         int err;
4226         struct net_device *dev = info->user_ptr[1];
4227         struct mpath_info pinfo;
4228         struct sk_buff *msg;
4229         u8 *dst = NULL;
4230         u8 next_hop[ETH_ALEN];
4231
4232         memset(&pinfo, 0, sizeof(pinfo));
4233
4234         if (!info->attrs[NL80211_ATTR_MAC])
4235                 return -EINVAL;
4236
4237         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4238
4239         if (!rdev->ops->get_mpath)
4240                 return -EOPNOTSUPP;
4241
4242         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4243                 return -EOPNOTSUPP;
4244
4245         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4246         if (err)
4247                 return err;
4248
4249         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4250         if (!msg)
4251                 return -ENOMEM;
4252
4253         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4254                                  dev, dst, next_hop, &pinfo) < 0) {
4255                 nlmsg_free(msg);
4256                 return -ENOBUFS;
4257         }
4258
4259         return genlmsg_reply(msg, info);
4260 }
4261
4262 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
4263 {
4264         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4265         struct net_device *dev = info->user_ptr[1];
4266         u8 *dst = NULL;
4267         u8 *next_hop = NULL;
4268
4269         if (!info->attrs[NL80211_ATTR_MAC])
4270                 return -EINVAL;
4271
4272         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4273                 return -EINVAL;
4274
4275         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4276         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4277
4278         if (!rdev->ops->change_mpath)
4279                 return -EOPNOTSUPP;
4280
4281         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4282                 return -EOPNOTSUPP;
4283
4284         return rdev_change_mpath(rdev, dev, dst, next_hop);
4285 }
4286
4287 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
4288 {
4289         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4290         struct net_device *dev = info->user_ptr[1];
4291         u8 *dst = NULL;
4292         u8 *next_hop = NULL;
4293
4294         if (!info->attrs[NL80211_ATTR_MAC])
4295                 return -EINVAL;
4296
4297         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4298                 return -EINVAL;
4299
4300         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4301         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4302
4303         if (!rdev->ops->add_mpath)
4304                 return -EOPNOTSUPP;
4305
4306         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4307                 return -EOPNOTSUPP;
4308
4309         return rdev_add_mpath(rdev, dev, dst, next_hop);
4310 }
4311
4312 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
4313 {
4314         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4315         struct net_device *dev = info->user_ptr[1];
4316         u8 *dst = NULL;
4317
4318         if (info->attrs[NL80211_ATTR_MAC])
4319                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4320
4321         if (!rdev->ops->del_mpath)
4322                 return -EOPNOTSUPP;
4323
4324         return rdev_del_mpath(rdev, dev, dst);
4325 }
4326
4327 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
4328 {
4329         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4330         struct net_device *dev = info->user_ptr[1];
4331         struct bss_parameters params;
4332
4333         memset(&params, 0, sizeof(params));
4334         /* default to not changing parameters */
4335         params.use_cts_prot = -1;
4336         params.use_short_preamble = -1;
4337         params.use_short_slot_time = -1;
4338         params.ap_isolate = -1;
4339         params.ht_opmode = -1;
4340         params.p2p_ctwindow = -1;
4341         params.p2p_opp_ps = -1;
4342
4343         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
4344                 params.use_cts_prot =
4345                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
4346         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
4347                 params.use_short_preamble =
4348                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
4349         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
4350                 params.use_short_slot_time =
4351                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4352         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4353                 params.basic_rates =
4354                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4355                 params.basic_rates_len =
4356                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4357         }
4358         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
4359                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4360         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
4361                 params.ht_opmode =
4362                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4363
4364         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4365                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4366                         return -EINVAL;
4367                 params.p2p_ctwindow =
4368                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4369                 if (params.p2p_ctwindow < 0)
4370                         return -EINVAL;
4371                 if (params.p2p_ctwindow != 0 &&
4372                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4373                         return -EINVAL;
4374         }
4375
4376         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4377                 u8 tmp;
4378
4379                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4380                         return -EINVAL;
4381                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4382                 if (tmp > 1)
4383                         return -EINVAL;
4384                 params.p2p_opp_ps = tmp;
4385                 if (params.p2p_opp_ps &&
4386                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4387                         return -EINVAL;
4388         }
4389
4390         if (!rdev->ops->change_bss)
4391                 return -EOPNOTSUPP;
4392
4393         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4394             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4395                 return -EOPNOTSUPP;
4396
4397         return rdev_change_bss(rdev, dev, &params);
4398 }
4399
4400 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
4401         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
4402         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
4403         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
4404         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
4405         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
4406         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
4407 };
4408
4409 static int parse_reg_rule(struct nlattr *tb[],
4410         struct ieee80211_reg_rule *reg_rule)
4411 {
4412         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
4413         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
4414
4415         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
4416                 return -EINVAL;
4417         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
4418                 return -EINVAL;
4419         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
4420                 return -EINVAL;
4421         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
4422                 return -EINVAL;
4423         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
4424                 return -EINVAL;
4425
4426         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
4427
4428         freq_range->start_freq_khz =
4429                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
4430         freq_range->end_freq_khz =
4431                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
4432         freq_range->max_bandwidth_khz =
4433                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
4434
4435         power_rule->max_eirp =
4436                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
4437
4438         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
4439                 power_rule->max_antenna_gain =
4440                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
4441
4442         return 0;
4443 }
4444
4445 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
4446 {
4447         int r;
4448         char *data = NULL;
4449         enum nl80211_user_reg_hint_type user_reg_hint_type;
4450
4451         /*
4452          * You should only get this when cfg80211 hasn't yet initialized
4453          * completely when built-in to the kernel right between the time
4454          * window between nl80211_init() and regulatory_init(), if that is
4455          * even possible.
4456          */
4457         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4458                 return -EINPROGRESS;
4459
4460         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4461                 return -EINVAL;
4462
4463         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4464
4465         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
4466                 user_reg_hint_type =
4467                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
4468         else
4469                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
4470
4471         switch (user_reg_hint_type) {
4472         case NL80211_USER_REG_HINT_USER:
4473         case NL80211_USER_REG_HINT_CELL_BASE:
4474                 break;
4475         default:
4476                 return -EINVAL;
4477         }
4478
4479         r = regulatory_hint_user(data, user_reg_hint_type);
4480
4481         return r;
4482 }
4483
4484 static int nl80211_get_mesh_config(struct sk_buff *skb,
4485                                    struct genl_info *info)
4486 {
4487         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4488         struct net_device *dev = info->user_ptr[1];
4489         struct wireless_dev *wdev = dev->ieee80211_ptr;
4490         struct mesh_config cur_params;
4491         int err = 0;
4492         void *hdr;
4493         struct nlattr *pinfoattr;
4494         struct sk_buff *msg;
4495
4496         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4497                 return -EOPNOTSUPP;
4498
4499         if (!rdev->ops->get_mesh_config)
4500                 return -EOPNOTSUPP;
4501
4502         wdev_lock(wdev);
4503         /* If not connected, get default parameters */
4504         if (!wdev->mesh_id_len)
4505                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
4506         else
4507                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
4508         wdev_unlock(wdev);
4509
4510         if (err)
4511                 return err;
4512
4513         /* Draw up a netlink message to send back */
4514         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4515         if (!msg)
4516                 return -ENOMEM;
4517         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4518                              NL80211_CMD_GET_MESH_CONFIG);
4519         if (!hdr)
4520                 goto out;
4521         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
4522         if (!pinfoattr)
4523                 goto nla_put_failure;
4524         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4525             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
4526                         cur_params.dot11MeshRetryTimeout) ||
4527             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4528                         cur_params.dot11MeshConfirmTimeout) ||
4529             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
4530                         cur_params.dot11MeshHoldingTimeout) ||
4531             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
4532                         cur_params.dot11MeshMaxPeerLinks) ||
4533             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
4534                        cur_params.dot11MeshMaxRetries) ||
4535             nla_put_u8(msg, NL80211_MESHCONF_TTL,
4536                        cur_params.dot11MeshTTL) ||
4537             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
4538                        cur_params.element_ttl) ||
4539             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4540                        cur_params.auto_open_plinks) ||
4541             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4542                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
4543             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4544                        cur_params.dot11MeshHWMPmaxPREQretries) ||
4545             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
4546                         cur_params.path_refresh_time) ||
4547             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4548                         cur_params.min_discovery_timeout) ||
4549             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4550                         cur_params.dot11MeshHWMPactivePathTimeout) ||
4551             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4552                         cur_params.dot11MeshHWMPpreqMinInterval) ||
4553             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4554                         cur_params.dot11MeshHWMPperrMinInterval) ||
4555             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4556                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
4557             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
4558                        cur_params.dot11MeshHWMPRootMode) ||
4559             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4560                         cur_params.dot11MeshHWMPRannInterval) ||
4561             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4562                        cur_params.dot11MeshGateAnnouncementProtocol) ||
4563             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
4564                        cur_params.dot11MeshForwarding) ||
4565             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
4566                         cur_params.rssi_threshold) ||
4567             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
4568                         cur_params.ht_opmode) ||
4569             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4570                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
4571             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4572                         cur_params.dot11MeshHWMProotInterval) ||
4573             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4574                         cur_params.dot11MeshHWMPconfirmationInterval) ||
4575             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
4576                         cur_params.power_mode) ||
4577             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
4578                         cur_params.dot11MeshAwakeWindowDuration) ||
4579             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
4580                         cur_params.plink_timeout))
4581                 goto nla_put_failure;
4582         nla_nest_end(msg, pinfoattr);
4583         genlmsg_end(msg, hdr);
4584         return genlmsg_reply(msg, info);
4585
4586  nla_put_failure:
4587         genlmsg_cancel(msg, hdr);
4588  out:
4589         nlmsg_free(msg);
4590         return -ENOBUFS;
4591 }
4592
4593 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
4594         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
4595         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
4596         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
4597         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
4598         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
4599         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
4600         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
4601         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
4602         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
4603         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
4604         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
4605         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
4606         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
4607         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
4608         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
4609         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
4610         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
4611         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
4612         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
4613         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
4614         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
4615         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
4616         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
4617         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
4618         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
4619         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
4620         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
4621         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
4622 };
4623
4624 static const struct nla_policy
4625         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
4626         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
4627         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
4628         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
4629         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
4630         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
4631         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
4632         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
4633                                     .len = IEEE80211_MAX_DATA_LEN },
4634         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
4635 };
4636
4637 static int nl80211_parse_mesh_config(struct genl_info *info,
4638                                      struct mesh_config *cfg,
4639                                      u32 *mask_out)
4640 {
4641         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
4642         u32 mask = 0;
4643
4644 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
4645 do {                                                                        \
4646         if (tb[attr]) {                                                     \
4647                 if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
4648                         return -EINVAL;                                     \
4649                 cfg->param = fn(tb[attr]);                                  \
4650                 mask |= (1 << (attr - 1));                                  \
4651         }                                                                   \
4652 } while (0)
4653
4654
4655         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
4656                 return -EINVAL;
4657         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
4658                              info->attrs[NL80211_ATTR_MESH_CONFIG],
4659                              nl80211_meshconf_params_policy))
4660                 return -EINVAL;
4661
4662         /* This makes sure that there aren't more than 32 mesh config
4663          * parameters (otherwise our bitfield scheme would not work.) */
4664         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
4665
4666         /* Fill in the params struct */
4667         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
4668                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
4669                                   nla_get_u16);
4670         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
4671                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4672                                   nla_get_u16);
4673         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
4674                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
4675                                   nla_get_u16);
4676         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
4677                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
4678                                   nla_get_u16);
4679         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
4680                                   mask, NL80211_MESHCONF_MAX_RETRIES,
4681                                   nla_get_u8);
4682         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
4683                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
4684         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
4685                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
4686                                   nla_get_u8);
4687         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
4688                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4689                                   nla_get_u8);
4690         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
4691                                   1, 255, mask,
4692                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4693                                   nla_get_u32);
4694         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
4695                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4696                                   nla_get_u8);
4697         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
4698                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
4699                                   nla_get_u32);
4700         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
4701                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4702                                   nla_get_u16);
4703         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
4704                                   1, 65535, mask,
4705                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4706                                   nla_get_u32);
4707         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
4708                                   1, 65535, mask,
4709                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4710                                   nla_get_u16);
4711         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
4712                                   1, 65535, mask,
4713                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4714                                   nla_get_u16);
4715         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4716                                   dot11MeshHWMPnetDiameterTraversalTime,
4717                                   1, 65535, mask,
4718                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4719                                   nla_get_u16);
4720         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
4721                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
4722                                   nla_get_u8);
4723         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
4724                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4725                                   nla_get_u16);
4726         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4727                                   dot11MeshGateAnnouncementProtocol, 0, 1,
4728                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4729                                   nla_get_u8);
4730         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
4731                                   mask, NL80211_MESHCONF_FORWARDING,
4732                                   nla_get_u8);
4733         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, 1, 255,
4734                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
4735                                   nla_get_u32);
4736         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
4737                                   mask, NL80211_MESHCONF_HT_OPMODE,
4738                                   nla_get_u16);
4739         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
4740                                   1, 65535, mask,
4741                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4742                                   nla_get_u32);
4743         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
4744                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4745                                   nla_get_u16);
4746         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4747                                   dot11MeshHWMPconfirmationInterval,
4748                                   1, 65535, mask,
4749                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4750                                   nla_get_u16);
4751         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
4752                                   NL80211_MESH_POWER_ACTIVE,
4753                                   NL80211_MESH_POWER_MAX,
4754                                   mask, NL80211_MESHCONF_POWER_MODE,
4755                                   nla_get_u32);
4756         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
4757                                   0, 65535, mask,
4758                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
4759         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 1, 0xffffffff,
4760                                   mask, NL80211_MESHCONF_PLINK_TIMEOUT,
4761                                   nla_get_u32);
4762         if (mask_out)
4763                 *mask_out = mask;
4764
4765         return 0;
4766
4767 #undef FILL_IN_MESH_PARAM_IF_SET
4768 }
4769
4770 static int nl80211_parse_mesh_setup(struct genl_info *info,
4771                                      struct mesh_setup *setup)
4772 {
4773         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4774         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
4775
4776         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
4777                 return -EINVAL;
4778         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
4779                              info->attrs[NL80211_ATTR_MESH_SETUP],
4780                              nl80211_mesh_setup_params_policy))
4781                 return -EINVAL;
4782
4783         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
4784                 setup->sync_method =
4785                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
4786                  IEEE80211_SYNC_METHOD_VENDOR :
4787                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
4788
4789         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
4790                 setup->path_sel_proto =
4791                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
4792                  IEEE80211_PATH_PROTOCOL_VENDOR :
4793                  IEEE80211_PATH_PROTOCOL_HWMP;
4794
4795         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
4796                 setup->path_metric =
4797                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
4798                  IEEE80211_PATH_METRIC_VENDOR :
4799                  IEEE80211_PATH_METRIC_AIRTIME;
4800
4801
4802         if (tb[NL80211_MESH_SETUP_IE]) {
4803                 struct nlattr *ieattr =
4804                         tb[NL80211_MESH_SETUP_IE];
4805                 if (!is_valid_ie_attr(ieattr))
4806                         return -EINVAL;
4807                 setup->ie = nla_data(ieattr);
4808                 setup->ie_len = nla_len(ieattr);
4809         }
4810         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
4811             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
4812                 return -EINVAL;
4813         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
4814         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
4815         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
4816         if (setup->is_secure)
4817                 setup->user_mpm = true;
4818
4819         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
4820                 if (!setup->user_mpm)
4821                         return -EINVAL;
4822                 setup->auth_id =
4823                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
4824         }
4825
4826         return 0;
4827 }
4828
4829 static int nl80211_update_mesh_config(struct sk_buff *skb,
4830                                       struct genl_info *info)
4831 {
4832         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4833         struct net_device *dev = info->user_ptr[1];
4834         struct wireless_dev *wdev = dev->ieee80211_ptr;
4835         struct mesh_config cfg;
4836         u32 mask;
4837         int err;
4838
4839         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4840                 return -EOPNOTSUPP;
4841
4842         if (!rdev->ops->update_mesh_config)
4843                 return -EOPNOTSUPP;
4844
4845         err = nl80211_parse_mesh_config(info, &cfg, &mask);
4846         if (err)
4847                 return err;
4848
4849         wdev_lock(wdev);
4850         if (!wdev->mesh_id_len)
4851                 err = -ENOLINK;
4852
4853         if (!err)
4854                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
4855
4856         wdev_unlock(wdev);
4857
4858         return err;
4859 }
4860
4861 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
4862 {
4863         const struct ieee80211_regdomain *regdom;
4864         struct sk_buff *msg;
4865         void *hdr = NULL;
4866         struct nlattr *nl_reg_rules;
4867         unsigned int i;
4868
4869         if (!cfg80211_regdomain)
4870                 return -EINVAL;
4871
4872         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4873         if (!msg)
4874                 return -ENOBUFS;
4875
4876         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4877                              NL80211_CMD_GET_REG);
4878         if (!hdr)
4879                 goto put_failure;
4880
4881         if (reg_last_request_cell_base() &&
4882             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
4883                         NL80211_USER_REG_HINT_CELL_BASE))
4884                 goto nla_put_failure;
4885
4886         rcu_read_lock();
4887         regdom = rcu_dereference(cfg80211_regdomain);
4888
4889         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
4890             (regdom->dfs_region &&
4891              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
4892                 goto nla_put_failure_rcu;
4893
4894         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
4895         if (!nl_reg_rules)
4896                 goto nla_put_failure_rcu;
4897
4898         for (i = 0; i < regdom->n_reg_rules; i++) {
4899                 struct nlattr *nl_reg_rule;
4900                 const struct ieee80211_reg_rule *reg_rule;
4901                 const struct ieee80211_freq_range *freq_range;
4902                 const struct ieee80211_power_rule *power_rule;
4903
4904                 reg_rule = &regdom->reg_rules[i];
4905                 freq_range = &reg_rule->freq_range;
4906                 power_rule = &reg_rule->power_rule;
4907
4908                 nl_reg_rule = nla_nest_start(msg, i);
4909                 if (!nl_reg_rule)
4910                         goto nla_put_failure_rcu;
4911
4912                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
4913                                 reg_rule->flags) ||
4914                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
4915                                 freq_range->start_freq_khz) ||
4916                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
4917                                 freq_range->end_freq_khz) ||
4918                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
4919                                 freq_range->max_bandwidth_khz) ||
4920                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
4921                                 power_rule->max_antenna_gain) ||
4922                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
4923                                 power_rule->max_eirp))
4924                         goto nla_put_failure_rcu;
4925
4926                 nla_nest_end(msg, nl_reg_rule);
4927         }
4928         rcu_read_unlock();
4929
4930         nla_nest_end(msg, nl_reg_rules);
4931
4932         genlmsg_end(msg, hdr);
4933         return genlmsg_reply(msg, info);
4934
4935 nla_put_failure_rcu:
4936         rcu_read_unlock();
4937 nla_put_failure:
4938         genlmsg_cancel(msg, hdr);
4939 put_failure:
4940         nlmsg_free(msg);
4941         return -EMSGSIZE;
4942 }
4943
4944 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
4945 {
4946         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
4947         struct nlattr *nl_reg_rule;
4948         char *alpha2 = NULL;
4949         int rem_reg_rules = 0, r = 0;
4950         u32 num_rules = 0, rule_idx = 0, size_of_regd;
4951         u8 dfs_region = 0;
4952         struct ieee80211_regdomain *rd = NULL;
4953
4954         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4955                 return -EINVAL;
4956
4957         if (!info->attrs[NL80211_ATTR_REG_RULES])
4958                 return -EINVAL;
4959
4960         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4961
4962         if (info->attrs[NL80211_ATTR_DFS_REGION])
4963                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
4964
4965         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
4966                             rem_reg_rules) {
4967                 num_rules++;
4968                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
4969                         return -EINVAL;
4970         }
4971
4972         size_of_regd = sizeof(struct ieee80211_regdomain) +
4973                        num_rules * sizeof(struct ieee80211_reg_rule);
4974
4975         rd = kzalloc(size_of_regd, GFP_KERNEL);
4976         if (!rd)
4977                 return -ENOMEM;
4978
4979         rd->n_reg_rules = num_rules;
4980         rd->alpha2[0] = alpha2[0];
4981         rd->alpha2[1] = alpha2[1];
4982
4983         /*
4984          * Disable DFS master mode if the DFS region was
4985          * not supported or known on this kernel.
4986          */
4987         if (reg_supported_dfs_region(dfs_region))
4988                 rd->dfs_region = dfs_region;
4989
4990         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
4991                             rem_reg_rules) {
4992                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
4993                           nla_data(nl_reg_rule), nla_len(nl_reg_rule),
4994                           reg_rule_policy);
4995                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
4996                 if (r)
4997                         goto bad_reg;
4998
4999                 rule_idx++;
5000
5001                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
5002                         r = -EINVAL;
5003                         goto bad_reg;
5004                 }
5005         }
5006
5007         r = set_regdom(rd);
5008         /* set_regdom took ownership */
5009         rd = NULL;
5010
5011  bad_reg:
5012         kfree(rd);
5013         return r;
5014 }
5015
5016 static int validate_scan_freqs(struct nlattr *freqs)
5017 {
5018         struct nlattr *attr1, *attr2;
5019         int n_channels = 0, tmp1, tmp2;
5020
5021         nla_for_each_nested(attr1, freqs, tmp1) {
5022                 n_channels++;
5023                 /*
5024                  * Some hardware has a limited channel list for
5025                  * scanning, and it is pretty much nonsensical
5026                  * to scan for a channel twice, so disallow that
5027                  * and don't require drivers to check that the
5028                  * channel list they get isn't longer than what
5029                  * they can scan, as long as they can scan all
5030                  * the channels they registered at once.
5031                  */
5032                 nla_for_each_nested(attr2, freqs, tmp2)
5033                         if (attr1 != attr2 &&
5034                             nla_get_u32(attr1) == nla_get_u32(attr2))
5035                                 return 0;
5036         }
5037
5038         return n_channels;
5039 }
5040
5041 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
5042 {
5043         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5044         struct wireless_dev *wdev = info->user_ptr[1];
5045         struct cfg80211_scan_request *request;
5046         struct nlattr *attr;
5047         struct wiphy *wiphy;
5048         int err, tmp, n_ssids = 0, n_channels, i;
5049         size_t ie_len;
5050
5051         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5052                 return -EINVAL;
5053
5054         wiphy = &rdev->wiphy;
5055
5056         if (!rdev->ops->scan)
5057                 return -EOPNOTSUPP;
5058
5059         if (rdev->scan_req) {
5060                 err = -EBUSY;
5061                 goto unlock;
5062         }
5063
5064         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5065                 n_channels = validate_scan_freqs(
5066                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5067                 if (!n_channels) {
5068                         err = -EINVAL;
5069                         goto unlock;
5070                 }
5071         } else {
5072                 enum ieee80211_band band;
5073                 n_channels = 0;
5074
5075                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
5076                         if (wiphy->bands[band])
5077                                 n_channels += wiphy->bands[band]->n_channels;
5078         }
5079
5080         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5081                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
5082                         n_ssids++;
5083
5084         if (n_ssids > wiphy->max_scan_ssids) {
5085                 err = -EINVAL;
5086                 goto unlock;
5087         }
5088
5089         if (info->attrs[NL80211_ATTR_IE])
5090                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5091         else
5092                 ie_len = 0;
5093
5094         if (ie_len > wiphy->max_scan_ie_len) {
5095                 err = -EINVAL;
5096                 goto unlock;
5097         }
5098
5099         request = kzalloc(sizeof(*request)
5100                         + sizeof(*request->ssids) * n_ssids
5101                         + sizeof(*request->channels) * n_channels
5102                         + ie_len, GFP_KERNEL);
5103         if (!request) {
5104                 err = -ENOMEM;
5105                 goto unlock;
5106         }
5107
5108         if (n_ssids)
5109                 request->ssids = (void *)&request->channels[n_channels];
5110         request->n_ssids = n_ssids;
5111         if (ie_len) {
5112                 if (request->ssids)
5113                         request->ie = (void *)(request->ssids + n_ssids);
5114                 else
5115                         request->ie = (void *)(request->channels + n_channels);
5116         }
5117
5118         i = 0;
5119         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5120                 /* user specified, bail out if channel not found */
5121                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
5122                         struct ieee80211_channel *chan;
5123
5124                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5125
5126                         if (!chan) {
5127                                 err = -EINVAL;
5128                                 goto out_free;
5129                         }
5130
5131                         /* ignore disabled channels */
5132                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5133                                 continue;
5134
5135                         request->channels[i] = chan;
5136                         i++;
5137                 }
5138         } else {
5139                 enum ieee80211_band band;
5140
5141                 /* all channels */
5142                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5143                         int j;
5144                         if (!wiphy->bands[band])
5145                                 continue;
5146                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5147                                 struct ieee80211_channel *chan;
5148
5149                                 chan = &wiphy->bands[band]->channels[j];
5150
5151                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5152                                         continue;
5153
5154                                 request->channels[i] = chan;
5155                                 i++;
5156                         }
5157                 }
5158         }
5159
5160         if (!i) {
5161                 err = -EINVAL;
5162                 goto out_free;
5163         }
5164
5165         request->n_channels = i;
5166
5167         i = 0;
5168         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5169                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
5170                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5171                                 err = -EINVAL;
5172                                 goto out_free;
5173                         }
5174                         request->ssids[i].ssid_len = nla_len(attr);
5175                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
5176                         i++;
5177                 }
5178         }
5179
5180         if (info->attrs[NL80211_ATTR_IE]) {
5181                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5182                 memcpy((void *)request->ie,
5183                        nla_data(info->attrs[NL80211_ATTR_IE]),
5184                        request->ie_len);
5185         }
5186
5187         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
5188                 if (wiphy->bands[i])
5189                         request->rates[i] =
5190                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
5191
5192         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
5193                 nla_for_each_nested(attr,
5194                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
5195                                     tmp) {
5196                         enum ieee80211_band band = nla_type(attr);
5197
5198                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
5199                                 err = -EINVAL;
5200                                 goto out_free;
5201                         }
5202                         err = ieee80211_get_ratemask(wiphy->bands[band],
5203                                                      nla_data(attr),
5204                                                      nla_len(attr),
5205                                                      &request->rates[band]);
5206                         if (err)
5207                                 goto out_free;
5208                 }
5209         }
5210
5211         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5212                 request->flags = nla_get_u32(
5213                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5214                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5215                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
5216                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
5217                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
5218                         err = -EOPNOTSUPP;
5219                         goto out_free;
5220                 }
5221         }
5222
5223         request->no_cck =
5224                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
5225
5226         request->wdev = wdev;
5227         request->wiphy = &rdev->wiphy;
5228         request->scan_start = jiffies;
5229
5230         rdev->scan_req = request;
5231         err = rdev_scan(rdev, request);
5232
5233         if (!err) {
5234                 nl80211_send_scan_start(rdev, wdev);
5235                 if (wdev->netdev)
5236                         dev_hold(wdev->netdev);
5237         } else {
5238  out_free:
5239                 rdev->scan_req = NULL;
5240                 kfree(request);
5241         }
5242
5243  unlock:
5244         return err;
5245 }
5246
5247 static int nl80211_start_sched_scan(struct sk_buff *skb,
5248                                     struct genl_info *info)
5249 {
5250         struct cfg80211_sched_scan_request *request;
5251         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5252         struct net_device *dev = info->user_ptr[1];
5253         struct nlattr *attr;
5254         struct wiphy *wiphy;
5255         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
5256         u32 interval;
5257         enum ieee80211_band band;
5258         size_t ie_len;
5259         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
5260
5261         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5262             !rdev->ops->sched_scan_start)
5263                 return -EOPNOTSUPP;
5264
5265         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5266                 return -EINVAL;
5267
5268         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
5269                 return -EINVAL;
5270
5271         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
5272         if (interval == 0)
5273                 return -EINVAL;
5274
5275         wiphy = &rdev->wiphy;
5276
5277         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5278                 n_channels = validate_scan_freqs(
5279                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5280                 if (!n_channels)
5281                         return -EINVAL;
5282         } else {
5283                 n_channels = 0;
5284
5285                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
5286                         if (wiphy->bands[band])
5287                                 n_channels += wiphy->bands[band]->n_channels;
5288         }
5289
5290         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5291                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5292                                     tmp)
5293                         n_ssids++;
5294
5295         if (n_ssids > wiphy->max_sched_scan_ssids)
5296                 return -EINVAL;
5297
5298         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
5299                 nla_for_each_nested(attr,
5300                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5301                                     tmp)
5302                         n_match_sets++;
5303
5304         if (n_match_sets > wiphy->max_match_sets)
5305                 return -EINVAL;
5306
5307         if (info->attrs[NL80211_ATTR_IE])
5308                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5309         else
5310                 ie_len = 0;
5311
5312         if (ie_len > wiphy->max_sched_scan_ie_len)
5313                 return -EINVAL;
5314
5315         if (rdev->sched_scan_req) {
5316                 err = -EINPROGRESS;
5317                 goto out;
5318         }
5319
5320         request = kzalloc(sizeof(*request)
5321                         + sizeof(*request->ssids) * n_ssids
5322                         + sizeof(*request->match_sets) * n_match_sets
5323                         + sizeof(*request->channels) * n_channels
5324                         + ie_len, GFP_KERNEL);
5325         if (!request) {
5326                 err = -ENOMEM;
5327                 goto out;
5328         }
5329
5330         if (n_ssids)
5331                 request->ssids = (void *)&request->channels[n_channels];
5332         request->n_ssids = n_ssids;
5333         if (ie_len) {
5334                 if (request->ssids)
5335                         request->ie = (void *)(request->ssids + n_ssids);
5336                 else
5337                         request->ie = (void *)(request->channels + n_channels);
5338         }
5339
5340         if (n_match_sets) {
5341                 if (request->ie)
5342                         request->match_sets = (void *)(request->ie + ie_len);
5343                 else if (request->ssids)
5344                         request->match_sets =
5345                                 (void *)(request->ssids + n_ssids);
5346                 else
5347                         request->match_sets =
5348                                 (void *)(request->channels + n_channels);
5349         }
5350         request->n_match_sets = n_match_sets;
5351
5352         i = 0;
5353         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5354                 /* user specified, bail out if channel not found */
5355                 nla_for_each_nested(attr,
5356                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
5357                                     tmp) {
5358                         struct ieee80211_channel *chan;
5359
5360                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5361
5362                         if (!chan) {
5363                                 err = -EINVAL;
5364                                 goto out_free;
5365                         }
5366
5367                         /* ignore disabled channels */
5368                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5369                                 continue;
5370
5371                         request->channels[i] = chan;
5372                         i++;
5373                 }
5374         } else {
5375                 /* all channels */
5376                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5377                         int j;
5378                         if (!wiphy->bands[band])
5379                                 continue;
5380                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5381                                 struct ieee80211_channel *chan;
5382
5383                                 chan = &wiphy->bands[band]->channels[j];
5384
5385                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5386                                         continue;
5387
5388                                 request->channels[i] = chan;
5389                                 i++;
5390                         }
5391                 }
5392         }
5393
5394         if (!i) {
5395                 err = -EINVAL;
5396                 goto out_free;
5397         }
5398
5399         request->n_channels = i;
5400
5401         i = 0;
5402         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5403                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5404                                     tmp) {
5405                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5406                                 err = -EINVAL;
5407                                 goto out_free;
5408                         }
5409                         request->ssids[i].ssid_len = nla_len(attr);
5410                         memcpy(request->ssids[i].ssid, nla_data(attr),
5411                                nla_len(attr));
5412                         i++;
5413                 }
5414         }
5415
5416         i = 0;
5417         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5418                 nla_for_each_nested(attr,
5419                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5420                                     tmp) {
5421                         struct nlattr *ssid, *rssi;
5422
5423                         nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5424                                   nla_data(attr), nla_len(attr),
5425                                   nl80211_match_policy);
5426                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
5427                         if (ssid) {
5428                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
5429                                         err = -EINVAL;
5430                                         goto out_free;
5431                                 }
5432                                 memcpy(request->match_sets[i].ssid.ssid,
5433                                        nla_data(ssid), nla_len(ssid));
5434                                 request->match_sets[i].ssid.ssid_len =
5435                                         nla_len(ssid);
5436                         }
5437                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5438                         if (rssi)
5439                                 request->rssi_thold = nla_get_u32(rssi);
5440                         else
5441                                 request->rssi_thold =
5442                                                    NL80211_SCAN_RSSI_THOLD_OFF;
5443                         i++;
5444                 }
5445         }
5446
5447         if (info->attrs[NL80211_ATTR_IE]) {
5448                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5449                 memcpy((void *)request->ie,
5450                        nla_data(info->attrs[NL80211_ATTR_IE]),
5451                        request->ie_len);
5452         }
5453
5454         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5455                 request->flags = nla_get_u32(
5456                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5457                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5458                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
5459                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
5460                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
5461                         err = -EOPNOTSUPP;
5462                         goto out_free;
5463                 }
5464         }
5465
5466         request->dev = dev;
5467         request->wiphy = &rdev->wiphy;
5468         request->interval = interval;
5469         request->scan_start = jiffies;
5470
5471         err = rdev_sched_scan_start(rdev, dev, request);
5472         if (!err) {
5473                 rdev->sched_scan_req = request;
5474                 nl80211_send_sched_scan(rdev, dev,
5475                                         NL80211_CMD_START_SCHED_SCAN);
5476                 goto out;
5477         }
5478
5479 out_free:
5480         kfree(request);
5481 out:
5482         return err;
5483 }
5484
5485 static int nl80211_stop_sched_scan(struct sk_buff *skb,
5486                                    struct genl_info *info)
5487 {
5488         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5489
5490         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5491             !rdev->ops->sched_scan_stop)
5492                 return -EOPNOTSUPP;
5493
5494         return __cfg80211_stop_sched_scan(rdev, false);
5495 }
5496
5497 static int nl80211_start_radar_detection(struct sk_buff *skb,
5498                                          struct genl_info *info)
5499 {
5500         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5501         struct net_device *dev = info->user_ptr[1];
5502         struct wireless_dev *wdev = dev->ieee80211_ptr;
5503         struct cfg80211_chan_def chandef;
5504         int err;
5505
5506         err = nl80211_parse_chandef(rdev, info, &chandef);
5507         if (err)
5508                 return err;
5509
5510         if (wdev->cac_started)
5511                 return -EBUSY;
5512
5513         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef);
5514         if (err < 0)
5515                 return err;
5516
5517         if (err == 0)
5518                 return -EINVAL;
5519
5520         if (chandef.chan->dfs_state != NL80211_DFS_USABLE)
5521                 return -EINVAL;
5522
5523         if (!rdev->ops->start_radar_detection)
5524                 return -EOPNOTSUPP;
5525
5526         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
5527                                            chandef.chan, CHAN_MODE_SHARED,
5528                                            BIT(chandef.width));
5529         if (err)
5530                 return err;
5531
5532         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef);
5533         if (!err) {
5534                 wdev->channel = chandef.chan;
5535                 wdev->cac_started = true;
5536                 wdev->cac_start_time = jiffies;
5537         }
5538         return err;
5539 }
5540
5541 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
5542                             u32 seq, int flags,
5543                             struct cfg80211_registered_device *rdev,
5544                             struct wireless_dev *wdev,
5545                             struct cfg80211_internal_bss *intbss)
5546 {
5547         struct cfg80211_bss *res = &intbss->pub;
5548         const struct cfg80211_bss_ies *ies;
5549         void *hdr;
5550         struct nlattr *bss;
5551         bool tsf = false;
5552
5553         ASSERT_WDEV_LOCK(wdev);
5554
5555         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
5556                              NL80211_CMD_NEW_SCAN_RESULTS);
5557         if (!hdr)
5558                 return -1;
5559
5560         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
5561
5562         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
5563                 goto nla_put_failure;
5564         if (wdev->netdev &&
5565             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
5566                 goto nla_put_failure;
5567         if (nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
5568                 goto nla_put_failure;
5569
5570         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
5571         if (!bss)
5572                 goto nla_put_failure;
5573         if ((!is_zero_ether_addr(res->bssid) &&
5574              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
5575                 goto nla_put_failure;
5576
5577         rcu_read_lock();
5578         ies = rcu_dereference(res->ies);
5579         if (ies) {
5580                 if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5581                         goto fail_unlock_rcu;
5582                 tsf = true;
5583                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
5584                                         ies->len, ies->data))
5585                         goto fail_unlock_rcu;
5586         }
5587         ies = rcu_dereference(res->beacon_ies);
5588         if (ies) {
5589                 if (!tsf && nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5590                         goto fail_unlock_rcu;
5591                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
5592                                         ies->len, ies->data))
5593                         goto fail_unlock_rcu;
5594         }
5595         rcu_read_unlock();
5596
5597         if (res->beacon_interval &&
5598             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
5599                 goto nla_put_failure;
5600         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
5601             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
5602             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
5603                         jiffies_to_msecs(jiffies - intbss->ts)))
5604                 goto nla_put_failure;
5605
5606         switch (rdev->wiphy.signal_type) {
5607         case CFG80211_SIGNAL_TYPE_MBM:
5608                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
5609                         goto nla_put_failure;
5610                 break;
5611         case CFG80211_SIGNAL_TYPE_UNSPEC:
5612                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
5613                         goto nla_put_failure;
5614                 break;
5615         default:
5616                 break;
5617         }
5618
5619         switch (wdev->iftype) {
5620         case NL80211_IFTYPE_P2P_CLIENT:
5621         case NL80211_IFTYPE_STATION:
5622                 if (intbss == wdev->current_bss &&
5623                     nla_put_u32(msg, NL80211_BSS_STATUS,
5624                                 NL80211_BSS_STATUS_ASSOCIATED))
5625                         goto nla_put_failure;
5626                 break;
5627         case NL80211_IFTYPE_ADHOC:
5628                 if (intbss == wdev->current_bss &&
5629                     nla_put_u32(msg, NL80211_BSS_STATUS,
5630                                 NL80211_BSS_STATUS_IBSS_JOINED))
5631                         goto nla_put_failure;
5632                 break;
5633         default:
5634                 break;
5635         }
5636
5637         nla_nest_end(msg, bss);
5638
5639         return genlmsg_end(msg, hdr);
5640
5641  fail_unlock_rcu:
5642         rcu_read_unlock();
5643  nla_put_failure:
5644         genlmsg_cancel(msg, hdr);
5645         return -EMSGSIZE;
5646 }
5647
5648 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
5649 {
5650         struct cfg80211_registered_device *rdev;
5651         struct cfg80211_internal_bss *scan;
5652         struct wireless_dev *wdev;
5653         int start = cb->args[2], idx = 0;
5654         int err;
5655
5656         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5657         if (err)
5658                 return err;
5659
5660         wdev_lock(wdev);
5661         spin_lock_bh(&rdev->bss_lock);
5662         cfg80211_bss_expire(rdev);
5663
5664         cb->seq = rdev->bss_generation;
5665
5666         list_for_each_entry(scan, &rdev->bss_list, list) {
5667                 if (++idx <= start)
5668                         continue;
5669                 if (nl80211_send_bss(skb, cb,
5670                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5671                                 rdev, wdev, scan) < 0) {
5672                         idx--;
5673                         break;
5674                 }
5675         }
5676
5677         spin_unlock_bh(&rdev->bss_lock);
5678         wdev_unlock(wdev);
5679
5680         cb->args[2] = idx;
5681         nl80211_finish_wdev_dump(rdev);
5682
5683         return skb->len;
5684 }
5685
5686 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
5687                                 int flags, struct net_device *dev,
5688                                 struct survey_info *survey)
5689 {
5690         void *hdr;
5691         struct nlattr *infoattr;
5692
5693         hdr = nl80211hdr_put(msg, portid, seq, flags,
5694                              NL80211_CMD_NEW_SURVEY_RESULTS);
5695         if (!hdr)
5696                 return -ENOMEM;
5697
5698         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
5699                 goto nla_put_failure;
5700
5701         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
5702         if (!infoattr)
5703                 goto nla_put_failure;
5704
5705         if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
5706                         survey->channel->center_freq))
5707                 goto nla_put_failure;
5708
5709         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
5710             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
5711                 goto nla_put_failure;
5712         if ((survey->filled & SURVEY_INFO_IN_USE) &&
5713             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
5714                 goto nla_put_failure;
5715         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
5716             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
5717                         survey->channel_time))
5718                 goto nla_put_failure;
5719         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
5720             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
5721                         survey->channel_time_busy))
5722                 goto nla_put_failure;
5723         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
5724             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
5725                         survey->channel_time_ext_busy))
5726                 goto nla_put_failure;
5727         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
5728             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
5729                         survey->channel_time_rx))
5730                 goto nla_put_failure;
5731         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
5732             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
5733                         survey->channel_time_tx))
5734                 goto nla_put_failure;
5735
5736         nla_nest_end(msg, infoattr);
5737
5738         return genlmsg_end(msg, hdr);
5739
5740  nla_put_failure:
5741         genlmsg_cancel(msg, hdr);
5742         return -EMSGSIZE;
5743 }
5744
5745 static int nl80211_dump_survey(struct sk_buff *skb,
5746                         struct netlink_callback *cb)
5747 {
5748         struct survey_info survey;
5749         struct cfg80211_registered_device *dev;
5750         struct wireless_dev *wdev;
5751         int survey_idx = cb->args[2];
5752         int res;
5753
5754         res = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
5755         if (res)
5756                 return res;
5757
5758         if (!wdev->netdev) {
5759                 res = -EINVAL;
5760                 goto out_err;
5761         }
5762
5763         if (!dev->ops->dump_survey) {
5764                 res = -EOPNOTSUPP;
5765                 goto out_err;
5766         }
5767
5768         while (1) {
5769                 struct ieee80211_channel *chan;
5770
5771                 res = rdev_dump_survey(dev, wdev->netdev, survey_idx, &survey);
5772                 if (res == -ENOENT)
5773                         break;
5774                 if (res)
5775                         goto out_err;
5776
5777                 /* Survey without a channel doesn't make sense */
5778                 if (!survey.channel) {
5779                         res = -EINVAL;
5780                         goto out;
5781                 }
5782
5783                 chan = ieee80211_get_channel(&dev->wiphy,
5784                                              survey.channel->center_freq);
5785                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
5786                         survey_idx++;
5787                         continue;
5788                 }
5789
5790                 if (nl80211_send_survey(skb,
5791                                 NETLINK_CB(cb->skb).portid,
5792                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5793                                 wdev->netdev, &survey) < 0)
5794                         goto out;
5795                 survey_idx++;
5796         }
5797
5798  out:
5799         cb->args[2] = survey_idx;
5800         res = skb->len;
5801  out_err:
5802         nl80211_finish_wdev_dump(dev);
5803         return res;
5804 }
5805
5806 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
5807 {
5808         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
5809                                   NL80211_WPA_VERSION_2));
5810 }
5811
5812 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
5813 {
5814         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5815         struct net_device *dev = info->user_ptr[1];
5816         struct ieee80211_channel *chan;
5817         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
5818         int err, ssid_len, ie_len = 0, sae_data_len = 0;
5819         enum nl80211_auth_type auth_type;
5820         struct key_parse key;
5821         bool local_state_change;
5822
5823         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5824                 return -EINVAL;
5825
5826         if (!info->attrs[NL80211_ATTR_MAC])
5827                 return -EINVAL;
5828
5829         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
5830                 return -EINVAL;
5831
5832         if (!info->attrs[NL80211_ATTR_SSID])
5833                 return -EINVAL;
5834
5835         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
5836                 return -EINVAL;
5837
5838         err = nl80211_parse_key(info, &key);
5839         if (err)
5840                 return err;
5841
5842         if (key.idx >= 0) {
5843                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
5844                         return -EINVAL;
5845                 if (!key.p.key || !key.p.key_len)
5846                         return -EINVAL;
5847                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
5848                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
5849                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
5850                      key.p.key_len != WLAN_KEY_LEN_WEP104))
5851                         return -EINVAL;
5852                 if (key.idx > 4)
5853                         return -EINVAL;
5854         } else {
5855                 key.p.key_len = 0;
5856                 key.p.key = NULL;
5857         }
5858
5859         if (key.idx >= 0) {
5860                 int i;
5861                 bool ok = false;
5862                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
5863                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
5864                                 ok = true;
5865                                 break;
5866                         }
5867                 }
5868                 if (!ok)
5869                         return -EINVAL;
5870         }
5871
5872         if (!rdev->ops->auth)
5873                 return -EOPNOTSUPP;
5874
5875         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5876             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5877                 return -EOPNOTSUPP;
5878
5879         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5880         chan = ieee80211_get_channel(&rdev->wiphy,
5881                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5882         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
5883                 return -EINVAL;
5884
5885         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5886         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5887
5888         if (info->attrs[NL80211_ATTR_IE]) {
5889                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5890                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5891         }
5892
5893         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
5894         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
5895                 return -EINVAL;
5896
5897         if (auth_type == NL80211_AUTHTYPE_SAE &&
5898             !info->attrs[NL80211_ATTR_SAE_DATA])
5899                 return -EINVAL;
5900
5901         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
5902                 if (auth_type != NL80211_AUTHTYPE_SAE)
5903                         return -EINVAL;
5904                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
5905                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
5906                 /* need to include at least Auth Transaction and Status Code */
5907                 if (sae_data_len < 4)
5908                         return -EINVAL;
5909         }
5910
5911         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5912
5913         /*
5914          * Since we no longer track auth state, ignore
5915          * requests to only change local state.
5916          */
5917         if (local_state_change)
5918                 return 0;
5919
5920         wdev_lock(dev->ieee80211_ptr);
5921         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
5922                                  ssid, ssid_len, ie, ie_len,
5923                                  key.p.key, key.p.key_len, key.idx,
5924                                  sae_data, sae_data_len);
5925         wdev_unlock(dev->ieee80211_ptr);
5926         return err;
5927 }
5928
5929 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
5930                                    struct genl_info *info,
5931                                    struct cfg80211_crypto_settings *settings,
5932                                    int cipher_limit)
5933 {
5934         memset(settings, 0, sizeof(*settings));
5935
5936         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
5937
5938         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
5939                 u16 proto;
5940                 proto = nla_get_u16(
5941                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
5942                 settings->control_port_ethertype = cpu_to_be16(proto);
5943                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
5944                     proto != ETH_P_PAE)
5945                         return -EINVAL;
5946                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
5947                         settings->control_port_no_encrypt = true;
5948         } else
5949                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
5950
5951         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
5952                 void *data;
5953                 int len, i;
5954
5955                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5956                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5957                 settings->n_ciphers_pairwise = len / sizeof(u32);
5958
5959                 if (len % sizeof(u32))
5960                         return -EINVAL;
5961
5962                 if (settings->n_ciphers_pairwise > cipher_limit)
5963                         return -EINVAL;
5964
5965                 memcpy(settings->ciphers_pairwise, data, len);
5966
5967                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
5968                         if (!cfg80211_supported_cipher_suite(
5969                                         &rdev->wiphy,
5970                                         settings->ciphers_pairwise[i]))
5971                                 return -EINVAL;
5972         }
5973
5974         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
5975                 settings->cipher_group =
5976                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
5977                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
5978                                                      settings->cipher_group))
5979                         return -EINVAL;
5980         }
5981
5982         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
5983                 settings->wpa_versions =
5984                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
5985                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
5986                         return -EINVAL;
5987         }
5988
5989         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
5990                 void *data;
5991                 int len;
5992
5993                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
5994                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
5995                 settings->n_akm_suites = len / sizeof(u32);
5996
5997                 if (len % sizeof(u32))
5998                         return -EINVAL;
5999
6000                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
6001                         return -EINVAL;
6002
6003                 memcpy(settings->akm_suites, data, len);
6004         }
6005
6006         return 0;
6007 }
6008
6009 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
6010 {
6011         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6012         struct net_device *dev = info->user_ptr[1];
6013         struct ieee80211_channel *chan;
6014         struct cfg80211_assoc_request req = {};
6015         const u8 *bssid, *ssid;
6016         int err, ssid_len = 0;
6017
6018         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6019                 return -EINVAL;
6020
6021         if (!info->attrs[NL80211_ATTR_MAC] ||
6022             !info->attrs[NL80211_ATTR_SSID] ||
6023             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
6024                 return -EINVAL;
6025
6026         if (!rdev->ops->assoc)
6027                 return -EOPNOTSUPP;
6028
6029         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6030             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6031                 return -EOPNOTSUPP;
6032
6033         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6034
6035         chan = ieee80211_get_channel(&rdev->wiphy,
6036                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6037         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
6038                 return -EINVAL;
6039
6040         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6041         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6042
6043         if (info->attrs[NL80211_ATTR_IE]) {
6044                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6045                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6046         }
6047
6048         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6049                 enum nl80211_mfp mfp =
6050                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6051                 if (mfp == NL80211_MFP_REQUIRED)
6052                         req.use_mfp = true;
6053                 else if (mfp != NL80211_MFP_NO)
6054                         return -EINVAL;
6055         }
6056
6057         if (info->attrs[NL80211_ATTR_PREV_BSSID])
6058                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
6059
6060         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6061                 req.flags |= ASSOC_REQ_DISABLE_HT;
6062
6063         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6064                 memcpy(&req.ht_capa_mask,
6065                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6066                        sizeof(req.ht_capa_mask));
6067
6068         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6069                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6070                         return -EINVAL;
6071                 memcpy(&req.ht_capa,
6072                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6073                        sizeof(req.ht_capa));
6074         }
6075
6076         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
6077                 req.flags |= ASSOC_REQ_DISABLE_VHT;
6078
6079         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6080                 memcpy(&req.vht_capa_mask,
6081                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
6082                        sizeof(req.vht_capa_mask));
6083
6084         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
6085                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6086                         return -EINVAL;
6087                 memcpy(&req.vht_capa,
6088                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
6089                        sizeof(req.vht_capa));
6090         }
6091
6092         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
6093         if (!err) {
6094                 wdev_lock(dev->ieee80211_ptr);
6095                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
6096                                           ssid, ssid_len, &req);
6097                 wdev_unlock(dev->ieee80211_ptr);
6098         }
6099
6100         return err;
6101 }
6102
6103 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
6104 {
6105         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6106         struct net_device *dev = info->user_ptr[1];
6107         const u8 *ie = NULL, *bssid;
6108         int ie_len = 0, err;
6109         u16 reason_code;
6110         bool local_state_change;
6111
6112         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6113                 return -EINVAL;
6114
6115         if (!info->attrs[NL80211_ATTR_MAC])
6116                 return -EINVAL;
6117
6118         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6119                 return -EINVAL;
6120
6121         if (!rdev->ops->deauth)
6122                 return -EOPNOTSUPP;
6123
6124         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6125             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6126                 return -EOPNOTSUPP;
6127
6128         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6129
6130         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6131         if (reason_code == 0) {
6132                 /* Reason Code 0 is reserved */
6133                 return -EINVAL;
6134         }
6135
6136         if (info->attrs[NL80211_ATTR_IE]) {
6137                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6138                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6139         }
6140
6141         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6142
6143         wdev_lock(dev->ieee80211_ptr);
6144         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
6145                                    local_state_change);
6146         wdev_unlock(dev->ieee80211_ptr);
6147         return err;
6148 }
6149
6150 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
6151 {
6152         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6153         struct net_device *dev = info->user_ptr[1];
6154         const u8 *ie = NULL, *bssid;
6155         int ie_len = 0, err;
6156         u16 reason_code;
6157         bool local_state_change;
6158
6159         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6160                 return -EINVAL;
6161
6162         if (!info->attrs[NL80211_ATTR_MAC])
6163                 return -EINVAL;
6164
6165         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6166                 return -EINVAL;
6167
6168         if (!rdev->ops->disassoc)
6169                 return -EOPNOTSUPP;
6170
6171         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6172             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6173                 return -EOPNOTSUPP;
6174
6175         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6176
6177         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6178         if (reason_code == 0) {
6179                 /* Reason Code 0 is reserved */
6180                 return -EINVAL;
6181         }
6182
6183         if (info->attrs[NL80211_ATTR_IE]) {
6184                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6185                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6186         }
6187
6188         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6189
6190         wdev_lock(dev->ieee80211_ptr);
6191         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
6192                                      local_state_change);
6193         wdev_unlock(dev->ieee80211_ptr);
6194         return err;
6195 }
6196
6197 static bool
6198 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
6199                          int mcast_rate[IEEE80211_NUM_BANDS],
6200                          int rateval)
6201 {
6202         struct wiphy *wiphy = &rdev->wiphy;
6203         bool found = false;
6204         int band, i;
6205
6206         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
6207                 struct ieee80211_supported_band *sband;
6208
6209                 sband = wiphy->bands[band];
6210                 if (!sband)
6211                         continue;
6212
6213                 for (i = 0; i < sband->n_bitrates; i++) {
6214                         if (sband->bitrates[i].bitrate == rateval) {
6215                                 mcast_rate[band] = i + 1;
6216                                 found = true;
6217                                 break;
6218                         }
6219                 }
6220         }
6221
6222         return found;
6223 }
6224
6225 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
6226 {
6227         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6228         struct net_device *dev = info->user_ptr[1];
6229         struct cfg80211_ibss_params ibss;
6230         struct wiphy *wiphy;
6231         struct cfg80211_cached_keys *connkeys = NULL;
6232         int err;
6233
6234         memset(&ibss, 0, sizeof(ibss));
6235
6236         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6237                 return -EINVAL;
6238
6239         if (!info->attrs[NL80211_ATTR_SSID] ||
6240             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6241                 return -EINVAL;
6242
6243         ibss.beacon_interval = 100;
6244
6245         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
6246                 ibss.beacon_interval =
6247                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
6248                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
6249                         return -EINVAL;
6250         }
6251
6252         if (!rdev->ops->join_ibss)
6253                 return -EOPNOTSUPP;
6254
6255         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6256                 return -EOPNOTSUPP;
6257
6258         wiphy = &rdev->wiphy;
6259
6260         if (info->attrs[NL80211_ATTR_MAC]) {
6261                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6262
6263                 if (!is_valid_ether_addr(ibss.bssid))
6264                         return -EINVAL;
6265         }
6266         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6267         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6268
6269         if (info->attrs[NL80211_ATTR_IE]) {
6270                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6271                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6272         }
6273
6274         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
6275         if (err)
6276                 return err;
6277
6278         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef))
6279                 return -EINVAL;
6280
6281         if (ibss.chandef.width > NL80211_CHAN_WIDTH_40)
6282                 return -EINVAL;
6283         if (ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
6284             !(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
6285                 return -EINVAL;
6286
6287         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
6288         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
6289
6290         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
6291                 u8 *rates =
6292                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6293                 int n_rates =
6294                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6295                 struct ieee80211_supported_band *sband =
6296                         wiphy->bands[ibss.chandef.chan->band];
6297
6298                 err = ieee80211_get_ratemask(sband, rates, n_rates,
6299                                              &ibss.basic_rates);
6300                 if (err)
6301                         return err;
6302         }
6303
6304         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
6305             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
6306                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
6307                 return -EINVAL;
6308
6309         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6310                 bool no_ht = false;
6311
6312                 connkeys = nl80211_parse_connkeys(rdev,
6313                                           info->attrs[NL80211_ATTR_KEYS],
6314                                           &no_ht);
6315                 if (IS_ERR(connkeys))
6316                         return PTR_ERR(connkeys);
6317
6318                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
6319                     no_ht) {
6320                         kfree(connkeys);
6321                         return -EINVAL;
6322                 }
6323         }
6324
6325         ibss.control_port =
6326                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
6327
6328         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
6329         if (err)
6330                 kfree(connkeys);
6331         return err;
6332 }
6333
6334 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
6335 {
6336         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6337         struct net_device *dev = info->user_ptr[1];
6338
6339         if (!rdev->ops->leave_ibss)
6340                 return -EOPNOTSUPP;
6341
6342         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6343                 return -EOPNOTSUPP;
6344
6345         return cfg80211_leave_ibss(rdev, dev, false);
6346 }
6347
6348 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
6349 {
6350         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6351         struct net_device *dev = info->user_ptr[1];
6352         int mcast_rate[IEEE80211_NUM_BANDS];
6353         u32 nla_rate;
6354         int err;
6355
6356         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
6357             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6358                 return -EOPNOTSUPP;
6359
6360         if (!rdev->ops->set_mcast_rate)
6361                 return -EOPNOTSUPP;
6362
6363         memset(mcast_rate, 0, sizeof(mcast_rate));
6364
6365         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
6366                 return -EINVAL;
6367
6368         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
6369         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
6370                 return -EINVAL;
6371
6372         err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
6373
6374         return err;
6375 }
6376
6377
6378 #ifdef CONFIG_NL80211_TESTMODE
6379 static struct genl_multicast_group nl80211_testmode_mcgrp = {
6380         .name = "testmode",
6381 };
6382
6383 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
6384 {
6385         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6386         int err;
6387
6388         if (!info->attrs[NL80211_ATTR_TESTDATA])
6389                 return -EINVAL;
6390
6391         err = -EOPNOTSUPP;
6392         if (rdev->ops->testmode_cmd) {
6393                 rdev->testmode_info = info;
6394                 err = rdev_testmode_cmd(rdev,
6395                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
6396                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
6397                 rdev->testmode_info = NULL;
6398         }
6399
6400         return err;
6401 }
6402
6403 static int nl80211_testmode_dump(struct sk_buff *skb,
6404                                  struct netlink_callback *cb)
6405 {
6406         struct cfg80211_registered_device *rdev;
6407         int err;
6408         long phy_idx;
6409         void *data = NULL;
6410         int data_len = 0;
6411
6412         rtnl_lock();
6413
6414         if (cb->args[0]) {
6415                 /*
6416                  * 0 is a valid index, but not valid for args[0],
6417                  * so we need to offset by 1.
6418                  */
6419                 phy_idx = cb->args[0] - 1;
6420         } else {
6421                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
6422                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
6423                                   nl80211_policy);
6424                 if (err)
6425                         goto out_err;
6426
6427                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
6428                                                   nl80211_fam.attrbuf);
6429                 if (IS_ERR(rdev)) {
6430                         err = PTR_ERR(rdev);
6431                         goto out_err;
6432                 }
6433                 phy_idx = rdev->wiphy_idx;
6434                 rdev = NULL;
6435
6436                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
6437                         cb->args[1] =
6438                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
6439         }
6440
6441         if (cb->args[1]) {
6442                 data = nla_data((void *)cb->args[1]);
6443                 data_len = nla_len((void *)cb->args[1]);
6444         }
6445
6446         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
6447         if (!rdev) {
6448                 err = -ENOENT;
6449                 goto out_err;
6450         }
6451
6452         if (!rdev->ops->testmode_dump) {
6453                 err = -EOPNOTSUPP;
6454                 goto out_err;
6455         }
6456
6457         while (1) {
6458                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
6459                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
6460                                            NL80211_CMD_TESTMODE);
6461                 struct nlattr *tmdata;
6462
6463                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
6464                         genlmsg_cancel(skb, hdr);
6465                         break;
6466                 }
6467
6468                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6469                 if (!tmdata) {
6470                         genlmsg_cancel(skb, hdr);
6471                         break;
6472                 }
6473                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
6474                 nla_nest_end(skb, tmdata);
6475
6476                 if (err == -ENOBUFS || err == -ENOENT) {
6477                         genlmsg_cancel(skb, hdr);
6478                         break;
6479                 } else if (err) {
6480                         genlmsg_cancel(skb, hdr);
6481                         goto out_err;
6482                 }
6483
6484                 genlmsg_end(skb, hdr);
6485         }
6486
6487         err = skb->len;
6488         /* see above */
6489         cb->args[0] = phy_idx + 1;
6490  out_err:
6491         rtnl_unlock();
6492         return err;
6493 }
6494
6495 static struct sk_buff *
6496 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
6497                               int approxlen, u32 portid, u32 seq, gfp_t gfp)
6498 {
6499         struct sk_buff *skb;
6500         void *hdr;
6501         struct nlattr *data;
6502
6503         skb = nlmsg_new(approxlen + 100, gfp);
6504         if (!skb)
6505                 return NULL;
6506
6507         hdr = nl80211hdr_put(skb, portid, seq, 0, NL80211_CMD_TESTMODE);
6508         if (!hdr) {
6509                 kfree_skb(skb);
6510                 return NULL;
6511         }
6512
6513         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
6514                 goto nla_put_failure;
6515         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6516
6517         ((void **)skb->cb)[0] = rdev;
6518         ((void **)skb->cb)[1] = hdr;
6519         ((void **)skb->cb)[2] = data;
6520
6521         return skb;
6522
6523  nla_put_failure:
6524         kfree_skb(skb);
6525         return NULL;
6526 }
6527
6528 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
6529                                                   int approxlen)
6530 {
6531         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6532
6533         if (WARN_ON(!rdev->testmode_info))
6534                 return NULL;
6535
6536         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
6537                                 rdev->testmode_info->snd_portid,
6538                                 rdev->testmode_info->snd_seq,
6539                                 GFP_KERNEL);
6540 }
6541 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
6542
6543 int cfg80211_testmode_reply(struct sk_buff *skb)
6544 {
6545         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
6546         void *hdr = ((void **)skb->cb)[1];
6547         struct nlattr *data = ((void **)skb->cb)[2];
6548
6549         if (WARN_ON(!rdev->testmode_info)) {
6550                 kfree_skb(skb);
6551                 return -EINVAL;
6552         }
6553
6554         nla_nest_end(skb, data);
6555         genlmsg_end(skb, hdr);
6556         return genlmsg_reply(skb, rdev->testmode_info);
6557 }
6558 EXPORT_SYMBOL(cfg80211_testmode_reply);
6559
6560 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
6561                                                   int approxlen, gfp_t gfp)
6562 {
6563         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6564
6565         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
6566 }
6567 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
6568
6569 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
6570 {
6571         void *hdr = ((void **)skb->cb)[1];
6572         struct nlattr *data = ((void **)skb->cb)[2];
6573
6574         nla_nest_end(skb, data);
6575         genlmsg_end(skb, hdr);
6576         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
6577 }
6578 EXPORT_SYMBOL(cfg80211_testmode_event);
6579 #endif
6580
6581 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
6582 {
6583         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6584         struct net_device *dev = info->user_ptr[1];
6585         struct cfg80211_connect_params connect;
6586         struct wiphy *wiphy;
6587         struct cfg80211_cached_keys *connkeys = NULL;
6588         int err;
6589
6590         memset(&connect, 0, sizeof(connect));
6591
6592         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6593                 return -EINVAL;
6594
6595         if (!info->attrs[NL80211_ATTR_SSID] ||
6596             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6597                 return -EINVAL;
6598
6599         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
6600                 connect.auth_type =
6601                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6602                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
6603                                              NL80211_CMD_CONNECT))
6604                         return -EINVAL;
6605         } else
6606                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
6607
6608         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
6609
6610         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
6611                                       NL80211_MAX_NR_CIPHER_SUITES);
6612         if (err)
6613                 return err;
6614
6615         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6616             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6617                 return -EOPNOTSUPP;
6618
6619         wiphy = &rdev->wiphy;
6620
6621         connect.bg_scan_period = -1;
6622         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
6623                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
6624                 connect.bg_scan_period =
6625                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
6626         }
6627
6628         if (info->attrs[NL80211_ATTR_MAC])
6629                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6630         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6631         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6632
6633         if (info->attrs[NL80211_ATTR_IE]) {
6634                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6635                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6636         }
6637
6638         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6639                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6640                 if (connect.mfp != NL80211_MFP_REQUIRED &&
6641                     connect.mfp != NL80211_MFP_NO)
6642                         return -EINVAL;
6643         } else {
6644                 connect.mfp = NL80211_MFP_NO;
6645         }
6646
6647         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6648                 connect.channel =
6649                         ieee80211_get_channel(wiphy,
6650                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6651                 if (!connect.channel ||
6652                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
6653                         return -EINVAL;
6654         }
6655
6656         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6657                 connkeys = nl80211_parse_connkeys(rdev,
6658                                           info->attrs[NL80211_ATTR_KEYS], NULL);
6659                 if (IS_ERR(connkeys))
6660                         return PTR_ERR(connkeys);
6661         }
6662
6663         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6664                 connect.flags |= ASSOC_REQ_DISABLE_HT;
6665
6666         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6667                 memcpy(&connect.ht_capa_mask,
6668                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6669                        sizeof(connect.ht_capa_mask));
6670
6671         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6672                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
6673                         kfree(connkeys);
6674                         return -EINVAL;
6675                 }
6676                 memcpy(&connect.ht_capa,
6677                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6678                        sizeof(connect.ht_capa));
6679         }
6680
6681         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
6682                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
6683
6684         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6685                 memcpy(&connect.vht_capa_mask,
6686                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
6687                        sizeof(connect.vht_capa_mask));
6688
6689         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
6690                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
6691                         kfree(connkeys);
6692                         return -EINVAL;
6693                 }
6694                 memcpy(&connect.vht_capa,
6695                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
6696                        sizeof(connect.vht_capa));
6697         }
6698
6699         wdev_lock(dev->ieee80211_ptr);
6700         err = cfg80211_connect(rdev, dev, &connect, connkeys, NULL);
6701         wdev_unlock(dev->ieee80211_ptr);
6702         if (err)
6703                 kfree(connkeys);
6704         return err;
6705 }
6706
6707 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
6708 {
6709         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6710         struct net_device *dev = info->user_ptr[1];
6711         u16 reason;
6712         int ret;
6713
6714         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6715                 reason = WLAN_REASON_DEAUTH_LEAVING;
6716         else
6717                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6718
6719         if (reason == 0)
6720                 return -EINVAL;
6721
6722         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6723             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6724                 return -EOPNOTSUPP;
6725
6726         wdev_lock(dev->ieee80211_ptr);
6727         ret = cfg80211_disconnect(rdev, dev, reason, true);
6728         wdev_unlock(dev->ieee80211_ptr);
6729         return ret;
6730 }
6731
6732 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
6733 {
6734         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6735         struct net *net;
6736         int err;
6737         u32 pid;
6738
6739         if (!info->attrs[NL80211_ATTR_PID])
6740                 return -EINVAL;
6741
6742         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
6743
6744         net = get_net_ns_by_pid(pid);
6745         if (IS_ERR(net))
6746                 return PTR_ERR(net);
6747
6748         err = 0;
6749
6750         /* check if anything to do */
6751         if (!net_eq(wiphy_net(&rdev->wiphy), net))
6752                 err = cfg80211_switch_netns(rdev, net);
6753
6754         put_net(net);
6755         return err;
6756 }
6757
6758 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
6759 {
6760         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6761         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
6762                         struct cfg80211_pmksa *pmksa) = NULL;
6763         struct net_device *dev = info->user_ptr[1];
6764         struct cfg80211_pmksa pmksa;
6765
6766         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
6767
6768         if (!info->attrs[NL80211_ATTR_MAC])
6769                 return -EINVAL;
6770
6771         if (!info->attrs[NL80211_ATTR_PMKID])
6772                 return -EINVAL;
6773
6774         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
6775         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6776
6777         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6778             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6779                 return -EOPNOTSUPP;
6780
6781         switch (info->genlhdr->cmd) {
6782         case NL80211_CMD_SET_PMKSA:
6783                 rdev_ops = rdev->ops->set_pmksa;
6784                 break;
6785         case NL80211_CMD_DEL_PMKSA:
6786                 rdev_ops = rdev->ops->del_pmksa;
6787                 break;
6788         default:
6789                 WARN_ON(1);
6790                 break;
6791         }
6792
6793         if (!rdev_ops)
6794                 return -EOPNOTSUPP;
6795
6796         return rdev_ops(&rdev->wiphy, dev, &pmksa);
6797 }
6798
6799 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
6800 {
6801         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6802         struct net_device *dev = info->user_ptr[1];
6803
6804         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6805             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6806                 return -EOPNOTSUPP;
6807
6808         if (!rdev->ops->flush_pmksa)
6809                 return -EOPNOTSUPP;
6810
6811         return rdev_flush_pmksa(rdev, dev);
6812 }
6813
6814 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
6815 {
6816         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6817         struct net_device *dev = info->user_ptr[1];
6818         u8 action_code, dialog_token;
6819         u16 status_code;
6820         u8 *peer;
6821
6822         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
6823             !rdev->ops->tdls_mgmt)
6824                 return -EOPNOTSUPP;
6825
6826         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
6827             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
6828             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
6829             !info->attrs[NL80211_ATTR_IE] ||
6830             !info->attrs[NL80211_ATTR_MAC])
6831                 return -EINVAL;
6832
6833         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
6834         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
6835         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
6836         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
6837
6838         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
6839                               dialog_token, status_code,
6840                               nla_data(info->attrs[NL80211_ATTR_IE]),
6841                               nla_len(info->attrs[NL80211_ATTR_IE]));
6842 }
6843
6844 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
6845 {
6846         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6847         struct net_device *dev = info->user_ptr[1];
6848         enum nl80211_tdls_operation operation;
6849         u8 *peer;
6850
6851         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
6852             !rdev->ops->tdls_oper)
6853                 return -EOPNOTSUPP;
6854
6855         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
6856             !info->attrs[NL80211_ATTR_MAC])
6857                 return -EINVAL;
6858
6859         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
6860         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
6861
6862         return rdev_tdls_oper(rdev, dev, peer, operation);
6863 }
6864
6865 static int nl80211_remain_on_channel(struct sk_buff *skb,
6866                                      struct genl_info *info)
6867 {
6868         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6869         struct wireless_dev *wdev = info->user_ptr[1];
6870         struct cfg80211_chan_def chandef;
6871         struct sk_buff *msg;
6872         void *hdr;
6873         u64 cookie;
6874         u32 duration;
6875         int err;
6876
6877         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
6878             !info->attrs[NL80211_ATTR_DURATION])
6879                 return -EINVAL;
6880
6881         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
6882
6883         if (!rdev->ops->remain_on_channel ||
6884             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
6885                 return -EOPNOTSUPP;
6886
6887         /*
6888          * We should be on that channel for at least a minimum amount of
6889          * time (10ms) but no longer than the driver supports.
6890          */
6891         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
6892             duration > rdev->wiphy.max_remain_on_channel_duration)
6893                 return -EINVAL;
6894
6895         err = nl80211_parse_chandef(rdev, info, &chandef);
6896         if (err)
6897                 return err;
6898
6899         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6900         if (!msg)
6901                 return -ENOMEM;
6902
6903         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6904                              NL80211_CMD_REMAIN_ON_CHANNEL);
6905
6906         if (IS_ERR(hdr)) {
6907                 err = PTR_ERR(hdr);
6908                 goto free_msg;
6909         }
6910
6911         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
6912                                      duration, &cookie);
6913
6914         if (err)
6915                 goto free_msg;
6916
6917         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6918                 goto nla_put_failure;
6919
6920         genlmsg_end(msg, hdr);
6921
6922         return genlmsg_reply(msg, info);
6923
6924  nla_put_failure:
6925         err = -ENOBUFS;
6926  free_msg:
6927         nlmsg_free(msg);
6928         return err;
6929 }
6930
6931 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
6932                                             struct genl_info *info)
6933 {
6934         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6935         struct wireless_dev *wdev = info->user_ptr[1];
6936         u64 cookie;
6937
6938         if (!info->attrs[NL80211_ATTR_COOKIE])
6939                 return -EINVAL;
6940
6941         if (!rdev->ops->cancel_remain_on_channel)
6942                 return -EOPNOTSUPP;
6943
6944         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
6945
6946         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
6947 }
6948
6949 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
6950                            u8 *rates, u8 rates_len)
6951 {
6952         u8 i;
6953         u32 mask = 0;
6954
6955         for (i = 0; i < rates_len; i++) {
6956                 int rate = (rates[i] & 0x7f) * 5;
6957                 int ridx;
6958                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
6959                         struct ieee80211_rate *srate =
6960                                 &sband->bitrates[ridx];
6961                         if (rate == srate->bitrate) {
6962                                 mask |= 1 << ridx;
6963                                 break;
6964                         }
6965                 }
6966                 if (ridx == sband->n_bitrates)
6967                         return 0; /* rate not found */
6968         }
6969
6970         return mask;
6971 }
6972
6973 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
6974                                u8 *rates, u8 rates_len,
6975                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
6976 {
6977         u8 i;
6978
6979         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
6980
6981         for (i = 0; i < rates_len; i++) {
6982                 int ridx, rbit;
6983
6984                 ridx = rates[i] / 8;
6985                 rbit = BIT(rates[i] % 8);
6986
6987                 /* check validity */
6988                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
6989                         return false;
6990
6991                 /* check availability */
6992                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
6993                         mcs[ridx] |= rbit;
6994                 else
6995                         return false;
6996         }
6997
6998         return true;
6999 }
7000
7001 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
7002         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
7003                                     .len = NL80211_MAX_SUPP_RATES },
7004         [NL80211_TXRATE_MCS] = { .type = NLA_BINARY,
7005                                  .len = NL80211_MAX_SUPP_HT_RATES },
7006 };
7007
7008 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
7009                                        struct genl_info *info)
7010 {
7011         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
7012         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7013         struct cfg80211_bitrate_mask mask;
7014         int rem, i;
7015         struct net_device *dev = info->user_ptr[1];
7016         struct nlattr *tx_rates;
7017         struct ieee80211_supported_band *sband;
7018
7019         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
7020                 return -EINVAL;
7021
7022         if (!rdev->ops->set_bitrate_mask)
7023                 return -EOPNOTSUPP;
7024
7025         memset(&mask, 0, sizeof(mask));
7026         /* Default to all rates enabled */
7027         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
7028                 sband = rdev->wiphy.bands[i];
7029                 mask.control[i].legacy =
7030                         sband ? (1 << sband->n_bitrates) - 1 : 0;
7031                 if (sband)
7032                         memcpy(mask.control[i].mcs,
7033                                sband->ht_cap.mcs.rx_mask,
7034                                sizeof(mask.control[i].mcs));
7035                 else
7036                         memset(mask.control[i].mcs, 0,
7037                                sizeof(mask.control[i].mcs));
7038         }
7039
7040         /*
7041          * The nested attribute uses enum nl80211_band as the index. This maps
7042          * directly to the enum ieee80211_band values used in cfg80211.
7043          */
7044         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
7045         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
7046         {
7047                 enum ieee80211_band band = nla_type(tx_rates);
7048                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
7049                         return -EINVAL;
7050                 sband = rdev->wiphy.bands[band];
7051                 if (sband == NULL)
7052                         return -EINVAL;
7053                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
7054                           nla_len(tx_rates), nl80211_txattr_policy);
7055                 if (tb[NL80211_TXRATE_LEGACY]) {
7056                         mask.control[band].legacy = rateset_to_mask(
7057                                 sband,
7058                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
7059                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
7060                         if ((mask.control[band].legacy == 0) &&
7061                             nla_len(tb[NL80211_TXRATE_LEGACY]))
7062                                 return -EINVAL;
7063                 }
7064                 if (tb[NL80211_TXRATE_MCS]) {
7065                         if (!ht_rateset_to_mask(
7066                                         sband,
7067                                         nla_data(tb[NL80211_TXRATE_MCS]),
7068                                         nla_len(tb[NL80211_TXRATE_MCS]),
7069                                         mask.control[band].mcs))
7070                                 return -EINVAL;
7071                 }
7072
7073                 if (mask.control[band].legacy == 0) {
7074                         /* don't allow empty legacy rates if HT
7075                          * is not even supported. */
7076                         if (!rdev->wiphy.bands[band]->ht_cap.ht_supported)
7077                                 return -EINVAL;
7078
7079                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
7080                                 if (mask.control[band].mcs[i])
7081                                         break;
7082
7083                         /* legacy and mcs rates may not be both empty */
7084                         if (i == IEEE80211_HT_MCS_MASK_LEN)
7085                                 return -EINVAL;
7086                 }
7087         }
7088
7089         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
7090 }
7091
7092 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
7093 {
7094         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7095         struct wireless_dev *wdev = info->user_ptr[1];
7096         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
7097
7098         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
7099                 return -EINVAL;
7100
7101         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
7102                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
7103
7104         switch (wdev->iftype) {
7105         case NL80211_IFTYPE_STATION:
7106         case NL80211_IFTYPE_ADHOC:
7107         case NL80211_IFTYPE_P2P_CLIENT:
7108         case NL80211_IFTYPE_AP:
7109         case NL80211_IFTYPE_AP_VLAN:
7110         case NL80211_IFTYPE_MESH_POINT:
7111         case NL80211_IFTYPE_P2P_GO:
7112         case NL80211_IFTYPE_P2P_DEVICE:
7113                 break;
7114         default:
7115                 return -EOPNOTSUPP;
7116         }
7117
7118         /* not much point in registering if we can't reply */
7119         if (!rdev->ops->mgmt_tx)
7120                 return -EOPNOTSUPP;
7121
7122         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
7123                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
7124                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
7125 }
7126
7127 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
7128 {
7129         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7130         struct wireless_dev *wdev = info->user_ptr[1];
7131         struct cfg80211_chan_def chandef;
7132         int err;
7133         void *hdr = NULL;
7134         u64 cookie;
7135         struct sk_buff *msg = NULL;
7136         unsigned int wait = 0;
7137         bool offchan, no_cck, dont_wait_for_ack;
7138
7139         dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
7140
7141         if (!info->attrs[NL80211_ATTR_FRAME])
7142                 return -EINVAL;
7143
7144         if (!rdev->ops->mgmt_tx)
7145                 return -EOPNOTSUPP;
7146
7147         switch (wdev->iftype) {
7148         case NL80211_IFTYPE_STATION:
7149         case NL80211_IFTYPE_ADHOC:
7150         case NL80211_IFTYPE_P2P_CLIENT:
7151         case NL80211_IFTYPE_AP:
7152         case NL80211_IFTYPE_AP_VLAN:
7153         case NL80211_IFTYPE_MESH_POINT:
7154         case NL80211_IFTYPE_P2P_GO:
7155         case NL80211_IFTYPE_P2P_DEVICE:
7156                 break;
7157         default:
7158                 return -EOPNOTSUPP;
7159         }
7160
7161         if (info->attrs[NL80211_ATTR_DURATION]) {
7162                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7163                         return -EINVAL;
7164                 wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7165
7166                 /*
7167                  * We should wait on the channel for at least a minimum amount
7168                  * of time (10ms) but no longer than the driver supports.
7169                  */
7170                 if (wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7171                     wait > rdev->wiphy.max_remain_on_channel_duration)
7172                         return -EINVAL;
7173
7174         }
7175
7176         offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
7177
7178         if (offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7179                 return -EINVAL;
7180
7181         no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7182
7183         err = nl80211_parse_chandef(rdev, info, &chandef);
7184         if (err)
7185                 return err;
7186
7187         if (!dont_wait_for_ack) {
7188                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7189                 if (!msg)
7190                         return -ENOMEM;
7191
7192                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7193                                      NL80211_CMD_FRAME);
7194
7195                 if (IS_ERR(hdr)) {
7196                         err = PTR_ERR(hdr);
7197                         goto free_msg;
7198                 }
7199         }
7200
7201         err = cfg80211_mlme_mgmt_tx(rdev, wdev, chandef.chan, offchan, wait,
7202                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
7203                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
7204                                     no_cck, dont_wait_for_ack, &cookie);
7205         if (err)
7206                 goto free_msg;
7207
7208         if (msg) {
7209                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7210                         goto nla_put_failure;
7211
7212                 genlmsg_end(msg, hdr);
7213                 return genlmsg_reply(msg, info);
7214         }
7215
7216         return 0;
7217
7218  nla_put_failure:
7219         err = -ENOBUFS;
7220  free_msg:
7221         nlmsg_free(msg);
7222         return err;
7223 }
7224
7225 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
7226 {
7227         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7228         struct wireless_dev *wdev = info->user_ptr[1];
7229         u64 cookie;
7230
7231         if (!info->attrs[NL80211_ATTR_COOKIE])
7232                 return -EINVAL;
7233
7234         if (!rdev->ops->mgmt_tx_cancel_wait)
7235                 return -EOPNOTSUPP;
7236
7237         switch (wdev->iftype) {
7238         case NL80211_IFTYPE_STATION:
7239         case NL80211_IFTYPE_ADHOC:
7240         case NL80211_IFTYPE_P2P_CLIENT:
7241         case NL80211_IFTYPE_AP:
7242         case NL80211_IFTYPE_AP_VLAN:
7243         case NL80211_IFTYPE_P2P_GO:
7244         case NL80211_IFTYPE_P2P_DEVICE:
7245                 break;
7246         default:
7247                 return -EOPNOTSUPP;
7248         }
7249
7250         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7251
7252         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
7253 }
7254
7255 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
7256 {
7257         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7258         struct wireless_dev *wdev;
7259         struct net_device *dev = info->user_ptr[1];
7260         u8 ps_state;
7261         bool state;
7262         int err;
7263
7264         if (!info->attrs[NL80211_ATTR_PS_STATE])
7265                 return -EINVAL;
7266
7267         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
7268
7269         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
7270                 return -EINVAL;
7271
7272         wdev = dev->ieee80211_ptr;
7273
7274         if (!rdev->ops->set_power_mgmt)
7275                 return -EOPNOTSUPP;
7276
7277         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
7278
7279         if (state == wdev->ps)
7280                 return 0;
7281
7282         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
7283         if (!err)
7284                 wdev->ps = state;
7285         return err;
7286 }
7287
7288 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
7289 {
7290         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7291         enum nl80211_ps_state ps_state;
7292         struct wireless_dev *wdev;
7293         struct net_device *dev = info->user_ptr[1];
7294         struct sk_buff *msg;
7295         void *hdr;
7296         int err;
7297
7298         wdev = dev->ieee80211_ptr;
7299
7300         if (!rdev->ops->set_power_mgmt)
7301                 return -EOPNOTSUPP;
7302
7303         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7304         if (!msg)
7305                 return -ENOMEM;
7306
7307         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7308                              NL80211_CMD_GET_POWER_SAVE);
7309         if (!hdr) {
7310                 err = -ENOBUFS;
7311                 goto free_msg;
7312         }
7313
7314         if (wdev->ps)
7315                 ps_state = NL80211_PS_ENABLED;
7316         else
7317                 ps_state = NL80211_PS_DISABLED;
7318
7319         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
7320                 goto nla_put_failure;
7321
7322         genlmsg_end(msg, hdr);
7323         return genlmsg_reply(msg, info);
7324
7325  nla_put_failure:
7326         err = -ENOBUFS;
7327  free_msg:
7328         nlmsg_free(msg);
7329         return err;
7330 }
7331
7332 static struct nla_policy
7333 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
7334         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
7335         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
7336         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
7337         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
7338         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
7339         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
7340 };
7341
7342 static int nl80211_set_cqm_txe(struct genl_info *info,
7343                                u32 rate, u32 pkts, u32 intvl)
7344 {
7345         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7346         struct wireless_dev *wdev;
7347         struct net_device *dev = info->user_ptr[1];
7348
7349         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
7350                 return -EINVAL;
7351
7352         wdev = dev->ieee80211_ptr;
7353
7354         if (!rdev->ops->set_cqm_txe_config)
7355                 return -EOPNOTSUPP;
7356
7357         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7358             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7359                 return -EOPNOTSUPP;
7360
7361         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
7362 }
7363
7364 static int nl80211_set_cqm_rssi(struct genl_info *info,
7365                                 s32 threshold, u32 hysteresis)
7366 {
7367         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7368         struct wireless_dev *wdev;
7369         struct net_device *dev = info->user_ptr[1];
7370
7371         if (threshold > 0)
7372                 return -EINVAL;
7373
7374         wdev = dev->ieee80211_ptr;
7375
7376         if (!rdev->ops->set_cqm_rssi_config)
7377                 return -EOPNOTSUPP;
7378
7379         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7380             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7381                 return -EOPNOTSUPP;
7382
7383         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
7384 }
7385
7386 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
7387 {
7388         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
7389         struct nlattr *cqm;
7390         int err;
7391
7392         cqm = info->attrs[NL80211_ATTR_CQM];
7393         if (!cqm) {
7394                 err = -EINVAL;
7395                 goto out;
7396         }
7397
7398         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
7399                                nl80211_attr_cqm_policy);
7400         if (err)
7401                 goto out;
7402
7403         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
7404             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
7405                 s32 threshold;
7406                 u32 hysteresis;
7407                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
7408                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
7409                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
7410         } else if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
7411                    attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
7412                    attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
7413                 u32 rate, pkts, intvl;
7414                 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
7415                 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
7416                 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
7417                 err = nl80211_set_cqm_txe(info, rate, pkts, intvl);
7418         } else
7419                 err = -EINVAL;
7420
7421 out:
7422         return err;
7423 }
7424
7425 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
7426 {
7427         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7428         struct net_device *dev = info->user_ptr[1];
7429         struct mesh_config cfg;
7430         struct mesh_setup setup;
7431         int err;
7432
7433         /* start with default */
7434         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
7435         memcpy(&setup, &default_mesh_setup, sizeof(setup));
7436
7437         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
7438                 /* and parse parameters if given */
7439                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
7440                 if (err)
7441                         return err;
7442         }
7443
7444         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
7445             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
7446                 return -EINVAL;
7447
7448         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
7449         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
7450
7451         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
7452             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
7453                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
7454                         return -EINVAL;
7455
7456         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
7457                 setup.beacon_interval =
7458                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
7459                 if (setup.beacon_interval < 10 ||
7460                     setup.beacon_interval > 10000)
7461                         return -EINVAL;
7462         }
7463
7464         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
7465                 setup.dtim_period =
7466                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
7467                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
7468                         return -EINVAL;
7469         }
7470
7471         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
7472                 /* parse additional setup parameters if given */
7473                 err = nl80211_parse_mesh_setup(info, &setup);
7474                 if (err)
7475                         return err;
7476         }
7477
7478         if (setup.user_mpm)
7479                 cfg.auto_open_plinks = false;
7480
7481         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7482                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
7483                 if (err)
7484                         return err;
7485         } else {
7486                 /* cfg80211_join_mesh() will sort it out */
7487                 setup.chandef.chan = NULL;
7488         }
7489
7490         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
7491                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7492                 int n_rates =
7493                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7494                 struct ieee80211_supported_band *sband;
7495
7496                 if (!setup.chandef.chan)
7497                         return -EINVAL;
7498
7499                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
7500
7501                 err = ieee80211_get_ratemask(sband, rates, n_rates,
7502                                              &setup.basic_rates);
7503                 if (err)
7504                         return err;
7505         }
7506
7507         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
7508 }
7509
7510 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
7511 {
7512         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7513         struct net_device *dev = info->user_ptr[1];
7514
7515         return cfg80211_leave_mesh(rdev, dev);
7516 }
7517
7518 #ifdef CONFIG_PM
7519 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
7520                                         struct cfg80211_registered_device *rdev)
7521 {
7522         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
7523         struct nlattr *nl_pats, *nl_pat;
7524         int i, pat_len;
7525
7526         if (!wowlan->n_patterns)
7527                 return 0;
7528
7529         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
7530         if (!nl_pats)
7531                 return -ENOBUFS;
7532
7533         for (i = 0; i < wowlan->n_patterns; i++) {
7534                 nl_pat = nla_nest_start(msg, i + 1);
7535                 if (!nl_pat)
7536                         return -ENOBUFS;
7537                 pat_len = wowlan->patterns[i].pattern_len;
7538                 if (nla_put(msg, NL80211_WOWLAN_PKTPAT_MASK,
7539                             DIV_ROUND_UP(pat_len, 8),
7540                             wowlan->patterns[i].mask) ||
7541                     nla_put(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
7542                             pat_len, wowlan->patterns[i].pattern) ||
7543                     nla_put_u32(msg, NL80211_WOWLAN_PKTPAT_OFFSET,
7544                                 wowlan->patterns[i].pkt_offset))
7545                         return -ENOBUFS;
7546                 nla_nest_end(msg, nl_pat);
7547         }
7548         nla_nest_end(msg, nl_pats);
7549
7550         return 0;
7551 }
7552
7553 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
7554                                    struct cfg80211_wowlan_tcp *tcp)
7555 {
7556         struct nlattr *nl_tcp;
7557
7558         if (!tcp)
7559                 return 0;
7560
7561         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
7562         if (!nl_tcp)
7563                 return -ENOBUFS;
7564
7565         if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
7566             nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
7567             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
7568             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
7569             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
7570             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
7571                     tcp->payload_len, tcp->payload) ||
7572             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
7573                         tcp->data_interval) ||
7574             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
7575                     tcp->wake_len, tcp->wake_data) ||
7576             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
7577                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
7578                 return -ENOBUFS;
7579
7580         if (tcp->payload_seq.len &&
7581             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
7582                     sizeof(tcp->payload_seq), &tcp->payload_seq))
7583                 return -ENOBUFS;
7584
7585         if (tcp->payload_tok.len &&
7586             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
7587                     sizeof(tcp->payload_tok) + tcp->tokens_size,
7588                     &tcp->payload_tok))
7589                 return -ENOBUFS;
7590
7591         nla_nest_end(msg, nl_tcp);
7592
7593         return 0;
7594 }
7595
7596 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
7597 {
7598         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7599         struct sk_buff *msg;
7600         void *hdr;
7601         u32 size = NLMSG_DEFAULT_SIZE;
7602
7603         if (!rdev->wiphy.wowlan)
7604                 return -EOPNOTSUPP;
7605
7606         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
7607                 /* adjust size to have room for all the data */
7608                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
7609                         rdev->wiphy.wowlan_config->tcp->payload_len +
7610                         rdev->wiphy.wowlan_config->tcp->wake_len +
7611                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
7612         }
7613
7614         msg = nlmsg_new(size, GFP_KERNEL);
7615         if (!msg)
7616                 return -ENOMEM;
7617
7618         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7619                              NL80211_CMD_GET_WOWLAN);
7620         if (!hdr)
7621                 goto nla_put_failure;
7622
7623         if (rdev->wiphy.wowlan_config) {
7624                 struct nlattr *nl_wowlan;
7625
7626                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
7627                 if (!nl_wowlan)
7628                         goto nla_put_failure;
7629
7630                 if ((rdev->wiphy.wowlan_config->any &&
7631                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
7632                     (rdev->wiphy.wowlan_config->disconnect &&
7633                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
7634                     (rdev->wiphy.wowlan_config->magic_pkt &&
7635                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
7636                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
7637                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
7638                     (rdev->wiphy.wowlan_config->eap_identity_req &&
7639                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
7640                     (rdev->wiphy.wowlan_config->four_way_handshake &&
7641                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
7642                     (rdev->wiphy.wowlan_config->rfkill_release &&
7643                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
7644                         goto nla_put_failure;
7645
7646                 if (nl80211_send_wowlan_patterns(msg, rdev))
7647                         goto nla_put_failure;
7648
7649                 if (nl80211_send_wowlan_tcp(msg,
7650                                             rdev->wiphy.wowlan_config->tcp))
7651                         goto nla_put_failure;
7652
7653                 nla_nest_end(msg, nl_wowlan);
7654         }
7655
7656         genlmsg_end(msg, hdr);
7657         return genlmsg_reply(msg, info);
7658
7659 nla_put_failure:
7660         nlmsg_free(msg);
7661         return -ENOBUFS;
7662 }
7663
7664 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
7665                                     struct nlattr *attr,
7666                                     struct cfg80211_wowlan *trig)
7667 {
7668         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
7669         struct cfg80211_wowlan_tcp *cfg;
7670         struct nl80211_wowlan_tcp_data_token *tok = NULL;
7671         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
7672         u32 size;
7673         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
7674         int err, port;
7675
7676         if (!rdev->wiphy.wowlan->tcp)
7677                 return -EINVAL;
7678
7679         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
7680                         nla_data(attr), nla_len(attr),
7681                         nl80211_wowlan_tcp_policy);
7682         if (err)
7683                 return err;
7684
7685         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
7686             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
7687             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
7688             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
7689             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
7690             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
7691             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
7692             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
7693                 return -EINVAL;
7694
7695         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
7696         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
7697                 return -EINVAL;
7698
7699         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
7700                         rdev->wiphy.wowlan->tcp->data_interval_max ||
7701             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
7702                 return -EINVAL;
7703
7704         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
7705         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
7706                 return -EINVAL;
7707
7708         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
7709         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
7710                 return -EINVAL;
7711
7712         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
7713                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
7714
7715                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
7716                 tokens_size = tokln - sizeof(*tok);
7717
7718                 if (!tok->len || tokens_size % tok->len)
7719                         return -EINVAL;
7720                 if (!rdev->wiphy.wowlan->tcp->tok)
7721                         return -EINVAL;
7722                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
7723                         return -EINVAL;
7724                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
7725                         return -EINVAL;
7726                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
7727                         return -EINVAL;
7728                 if (tok->offset + tok->len > data_size)
7729                         return -EINVAL;
7730         }
7731
7732         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
7733                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
7734                 if (!rdev->wiphy.wowlan->tcp->seq)
7735                         return -EINVAL;
7736                 if (seq->len == 0 || seq->len > 4)
7737                         return -EINVAL;
7738                 if (seq->len + seq->offset > data_size)
7739                         return -EINVAL;
7740         }
7741
7742         size = sizeof(*cfg);
7743         size += data_size;
7744         size += wake_size + wake_mask_size;
7745         size += tokens_size;
7746
7747         cfg = kzalloc(size, GFP_KERNEL);
7748         if (!cfg)
7749                 return -ENOMEM;
7750         cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
7751         cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
7752         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
7753                ETH_ALEN);
7754         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
7755                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
7756         else
7757                 port = 0;
7758 #ifdef CONFIG_INET
7759         /* allocate a socket and port for it and use it */
7760         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
7761                             IPPROTO_TCP, &cfg->sock, 1);
7762         if (err) {
7763                 kfree(cfg);
7764                 return err;
7765         }
7766         if (inet_csk_get_port(cfg->sock->sk, port)) {
7767                 sock_release(cfg->sock);
7768                 kfree(cfg);
7769                 return -EADDRINUSE;
7770         }
7771         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
7772 #else
7773         if (!port) {
7774                 kfree(cfg);
7775                 return -EINVAL;
7776         }
7777         cfg->src_port = port;
7778 #endif
7779
7780         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
7781         cfg->payload_len = data_size;
7782         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
7783         memcpy((void *)cfg->payload,
7784                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
7785                data_size);
7786         if (seq)
7787                 cfg->payload_seq = *seq;
7788         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
7789         cfg->wake_len = wake_size;
7790         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
7791         memcpy((void *)cfg->wake_data,
7792                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
7793                wake_size);
7794         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
7795                          data_size + wake_size;
7796         memcpy((void *)cfg->wake_mask,
7797                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
7798                wake_mask_size);
7799         if (tok) {
7800                 cfg->tokens_size = tokens_size;
7801                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
7802         }
7803
7804         trig->tcp = cfg;
7805
7806         return 0;
7807 }
7808
7809 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
7810 {
7811         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7812         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
7813         struct cfg80211_wowlan new_triggers = {};
7814         struct cfg80211_wowlan *ntrig;
7815         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
7816         int err, i;
7817         bool prev_enabled = rdev->wiphy.wowlan_config;
7818
7819         if (!wowlan)
7820                 return -EOPNOTSUPP;
7821
7822         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
7823                 cfg80211_rdev_free_wowlan(rdev);
7824                 rdev->wiphy.wowlan_config = NULL;
7825                 goto set_wakeup;
7826         }
7827
7828         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
7829                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
7830                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
7831                         nl80211_wowlan_policy);
7832         if (err)
7833                 return err;
7834
7835         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
7836                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
7837                         return -EINVAL;
7838                 new_triggers.any = true;
7839         }
7840
7841         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
7842                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
7843                         return -EINVAL;
7844                 new_triggers.disconnect = true;
7845         }
7846
7847         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
7848                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
7849                         return -EINVAL;
7850                 new_triggers.magic_pkt = true;
7851         }
7852
7853         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
7854                 return -EINVAL;
7855
7856         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
7857                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
7858                         return -EINVAL;
7859                 new_triggers.gtk_rekey_failure = true;
7860         }
7861
7862         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
7863                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
7864                         return -EINVAL;
7865                 new_triggers.eap_identity_req = true;
7866         }
7867
7868         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
7869                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
7870                         return -EINVAL;
7871                 new_triggers.four_way_handshake = true;
7872         }
7873
7874         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
7875                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
7876                         return -EINVAL;
7877                 new_triggers.rfkill_release = true;
7878         }
7879
7880         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
7881                 struct nlattr *pat;
7882                 int n_patterns = 0;
7883                 int rem, pat_len, mask_len, pkt_offset;
7884                 struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
7885
7886                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
7887                                     rem)
7888                         n_patterns++;
7889                 if (n_patterns > wowlan->n_patterns)
7890                         return -EINVAL;
7891
7892                 new_triggers.patterns = kcalloc(n_patterns,
7893                                                 sizeof(new_triggers.patterns[0]),
7894                                                 GFP_KERNEL);
7895                 if (!new_triggers.patterns)
7896                         return -ENOMEM;
7897
7898                 new_triggers.n_patterns = n_patterns;
7899                 i = 0;
7900
7901                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
7902                                     rem) {
7903                         nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
7904                                   nla_data(pat), nla_len(pat), NULL);
7905                         err = -EINVAL;
7906                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
7907                             !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
7908                                 goto error;
7909                         pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
7910                         mask_len = DIV_ROUND_UP(pat_len, 8);
7911                         if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
7912                             mask_len)
7913                                 goto error;
7914                         if (pat_len > wowlan->pattern_max_len ||
7915                             pat_len < wowlan->pattern_min_len)
7916                                 goto error;
7917
7918                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET])
7919                                 pkt_offset = 0;
7920                         else
7921                                 pkt_offset = nla_get_u32(
7922                                         pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET]);
7923                         if (pkt_offset > wowlan->max_pkt_offset)
7924                                 goto error;
7925                         new_triggers.patterns[i].pkt_offset = pkt_offset;
7926
7927                         new_triggers.patterns[i].mask =
7928                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
7929                         if (!new_triggers.patterns[i].mask) {
7930                                 err = -ENOMEM;
7931                                 goto error;
7932                         }
7933                         new_triggers.patterns[i].pattern =
7934                                 new_triggers.patterns[i].mask + mask_len;
7935                         memcpy(new_triggers.patterns[i].mask,
7936                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
7937                                mask_len);
7938                         new_triggers.patterns[i].pattern_len = pat_len;
7939                         memcpy(new_triggers.patterns[i].pattern,
7940                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
7941                                pat_len);
7942                         i++;
7943                 }
7944         }
7945
7946         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
7947                 err = nl80211_parse_wowlan_tcp(
7948                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
7949                         &new_triggers);
7950                 if (err)
7951                         goto error;
7952         }
7953
7954         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
7955         if (!ntrig) {
7956                 err = -ENOMEM;
7957                 goto error;
7958         }
7959         cfg80211_rdev_free_wowlan(rdev);
7960         rdev->wiphy.wowlan_config = ntrig;
7961
7962  set_wakeup:
7963         if (rdev->ops->set_wakeup &&
7964             prev_enabled != !!rdev->wiphy.wowlan_config)
7965                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
7966
7967         return 0;
7968  error:
7969         for (i = 0; i < new_triggers.n_patterns; i++)
7970                 kfree(new_triggers.patterns[i].mask);
7971         kfree(new_triggers.patterns);
7972         if (new_triggers.tcp && new_triggers.tcp->sock)
7973                 sock_release(new_triggers.tcp->sock);
7974         kfree(new_triggers.tcp);
7975         return err;
7976 }
7977 #endif
7978
7979 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
7980 {
7981         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7982         struct net_device *dev = info->user_ptr[1];
7983         struct wireless_dev *wdev = dev->ieee80211_ptr;
7984         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
7985         struct cfg80211_gtk_rekey_data rekey_data;
7986         int err;
7987
7988         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
7989                 return -EINVAL;
7990
7991         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
7992                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
7993                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
7994                         nl80211_rekey_policy);
7995         if (err)
7996                 return err;
7997
7998         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
7999                 return -ERANGE;
8000         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
8001                 return -ERANGE;
8002         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
8003                 return -ERANGE;
8004
8005         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
8006                NL80211_KEK_LEN);
8007         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
8008                NL80211_KCK_LEN);
8009         memcpy(rekey_data.replay_ctr,
8010                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
8011                NL80211_REPLAY_CTR_LEN);
8012
8013         wdev_lock(wdev);
8014         if (!wdev->current_bss) {
8015                 err = -ENOTCONN;
8016                 goto out;
8017         }
8018
8019         if (!rdev->ops->set_rekey_data) {
8020                 err = -EOPNOTSUPP;
8021                 goto out;
8022         }
8023
8024         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
8025  out:
8026         wdev_unlock(wdev);
8027         return err;
8028 }
8029
8030 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
8031                                              struct genl_info *info)
8032 {
8033         struct net_device *dev = info->user_ptr[1];
8034         struct wireless_dev *wdev = dev->ieee80211_ptr;
8035
8036         if (wdev->iftype != NL80211_IFTYPE_AP &&
8037             wdev->iftype != NL80211_IFTYPE_P2P_GO)
8038                 return -EINVAL;
8039
8040         if (wdev->ap_unexpected_nlportid)
8041                 return -EBUSY;
8042
8043         wdev->ap_unexpected_nlportid = info->snd_portid;
8044         return 0;
8045 }
8046
8047 static int nl80211_probe_client(struct sk_buff *skb,
8048                                 struct genl_info *info)
8049 {
8050         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8051         struct net_device *dev = info->user_ptr[1];
8052         struct wireless_dev *wdev = dev->ieee80211_ptr;
8053         struct sk_buff *msg;
8054         void *hdr;
8055         const u8 *addr;
8056         u64 cookie;
8057         int err;
8058
8059         if (wdev->iftype != NL80211_IFTYPE_AP &&
8060             wdev->iftype != NL80211_IFTYPE_P2P_GO)
8061                 return -EOPNOTSUPP;
8062
8063         if (!info->attrs[NL80211_ATTR_MAC])
8064                 return -EINVAL;
8065
8066         if (!rdev->ops->probe_client)
8067                 return -EOPNOTSUPP;
8068
8069         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8070         if (!msg)
8071                 return -ENOMEM;
8072
8073         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8074                              NL80211_CMD_PROBE_CLIENT);
8075
8076         if (IS_ERR(hdr)) {
8077                 err = PTR_ERR(hdr);
8078                 goto free_msg;
8079         }
8080
8081         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
8082
8083         err = rdev_probe_client(rdev, dev, addr, &cookie);
8084         if (err)
8085                 goto free_msg;
8086
8087         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8088                 goto nla_put_failure;
8089
8090         genlmsg_end(msg, hdr);
8091
8092         return genlmsg_reply(msg, info);
8093
8094  nla_put_failure:
8095         err = -ENOBUFS;
8096  free_msg:
8097         nlmsg_free(msg);
8098         return err;
8099 }
8100
8101 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
8102 {
8103         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8104         struct cfg80211_beacon_registration *reg, *nreg;
8105         int rv;
8106
8107         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
8108                 return -EOPNOTSUPP;
8109
8110         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
8111         if (!nreg)
8112                 return -ENOMEM;
8113
8114         /* First, check if already registered. */
8115         spin_lock_bh(&rdev->beacon_registrations_lock);
8116         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
8117                 if (reg->nlportid == info->snd_portid) {
8118                         rv = -EALREADY;
8119                         goto out_err;
8120                 }
8121         }
8122         /* Add it to the list */
8123         nreg->nlportid = info->snd_portid;
8124         list_add(&nreg->list, &rdev->beacon_registrations);
8125
8126         spin_unlock_bh(&rdev->beacon_registrations_lock);
8127
8128         return 0;
8129 out_err:
8130         spin_unlock_bh(&rdev->beacon_registrations_lock);
8131         kfree(nreg);
8132         return rv;
8133 }
8134
8135 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
8136 {
8137         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8138         struct wireless_dev *wdev = info->user_ptr[1];
8139         int err;
8140
8141         if (!rdev->ops->start_p2p_device)
8142                 return -EOPNOTSUPP;
8143
8144         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
8145                 return -EOPNOTSUPP;
8146
8147         if (wdev->p2p_started)
8148                 return 0;
8149
8150         err = cfg80211_can_add_interface(rdev, wdev->iftype);
8151         if (err)
8152                 return err;
8153
8154         err = rdev_start_p2p_device(rdev, wdev);
8155         if (err)
8156                 return err;
8157
8158         wdev->p2p_started = true;
8159         rdev->opencount++;
8160
8161         return 0;
8162 }
8163
8164 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
8165 {
8166         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8167         struct wireless_dev *wdev = info->user_ptr[1];
8168
8169         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
8170                 return -EOPNOTSUPP;
8171
8172         if (!rdev->ops->stop_p2p_device)
8173                 return -EOPNOTSUPP;
8174
8175         cfg80211_stop_p2p_device(rdev, wdev);
8176
8177         return 0;
8178 }
8179
8180 static int nl80211_get_protocol_features(struct sk_buff *skb,
8181                                          struct genl_info *info)
8182 {
8183         void *hdr;
8184         struct sk_buff *msg;
8185
8186         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8187         if (!msg)
8188                 return -ENOMEM;
8189
8190         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8191                              NL80211_CMD_GET_PROTOCOL_FEATURES);
8192         if (!hdr)
8193                 goto nla_put_failure;
8194
8195         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
8196                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
8197                 goto nla_put_failure;
8198
8199         genlmsg_end(msg, hdr);
8200         return genlmsg_reply(msg, info);
8201
8202  nla_put_failure:
8203         kfree_skb(msg);
8204         return -ENOBUFS;
8205 }
8206
8207 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
8208 {
8209         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8210         struct cfg80211_update_ft_ies_params ft_params;
8211         struct net_device *dev = info->user_ptr[1];
8212
8213         if (!rdev->ops->update_ft_ies)
8214                 return -EOPNOTSUPP;
8215
8216         if (!info->attrs[NL80211_ATTR_MDID] ||
8217             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8218                 return -EINVAL;
8219
8220         memset(&ft_params, 0, sizeof(ft_params));
8221         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
8222         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8223         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8224
8225         return rdev_update_ft_ies(rdev, dev, &ft_params);
8226 }
8227
8228 static int nl80211_crit_protocol_start(struct sk_buff *skb,
8229                                        struct genl_info *info)
8230 {
8231         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8232         struct wireless_dev *wdev = info->user_ptr[1];
8233         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
8234         u16 duration;
8235         int ret;
8236
8237         if (!rdev->ops->crit_proto_start)
8238                 return -EOPNOTSUPP;
8239
8240         if (WARN_ON(!rdev->ops->crit_proto_stop))
8241                 return -EINVAL;
8242
8243         if (rdev->crit_proto_nlportid)
8244                 return -EBUSY;
8245
8246         /* determine protocol if provided */
8247         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
8248                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
8249
8250         if (proto >= NUM_NL80211_CRIT_PROTO)
8251                 return -EINVAL;
8252
8253         /* timeout must be provided */
8254         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
8255                 return -EINVAL;
8256
8257         duration =
8258                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
8259
8260         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
8261                 return -ERANGE;
8262
8263         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
8264         if (!ret)
8265                 rdev->crit_proto_nlportid = info->snd_portid;
8266
8267         return ret;
8268 }
8269
8270 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
8271                                       struct genl_info *info)
8272 {
8273         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8274         struct wireless_dev *wdev = info->user_ptr[1];
8275
8276         if (!rdev->ops->crit_proto_stop)
8277                 return -EOPNOTSUPP;
8278
8279         if (rdev->crit_proto_nlportid) {
8280                 rdev->crit_proto_nlportid = 0;
8281                 rdev_crit_proto_stop(rdev, wdev);
8282         }
8283         return 0;
8284 }
8285
8286 #define NL80211_FLAG_NEED_WIPHY         0x01
8287 #define NL80211_FLAG_NEED_NETDEV        0x02
8288 #define NL80211_FLAG_NEED_RTNL          0x04
8289 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
8290 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
8291                                          NL80211_FLAG_CHECK_NETDEV_UP)
8292 #define NL80211_FLAG_NEED_WDEV          0x10
8293 /* If a netdev is associated, it must be UP, P2P must be started */
8294 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
8295                                          NL80211_FLAG_CHECK_NETDEV_UP)
8296
8297 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
8298                             struct genl_info *info)
8299 {
8300         struct cfg80211_registered_device *rdev;
8301         struct wireless_dev *wdev;
8302         struct net_device *dev;
8303         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
8304
8305         if (rtnl)
8306                 rtnl_lock();
8307
8308         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
8309                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
8310                 if (IS_ERR(rdev)) {
8311                         if (rtnl)
8312                                 rtnl_unlock();
8313                         return PTR_ERR(rdev);
8314                 }
8315                 info->user_ptr[0] = rdev;
8316         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
8317                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
8318                 ASSERT_RTNL();
8319
8320                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
8321                                                   info->attrs);
8322                 if (IS_ERR(wdev)) {
8323                         if (rtnl)
8324                                 rtnl_unlock();
8325                         return PTR_ERR(wdev);
8326                 }
8327
8328                 dev = wdev->netdev;
8329                 rdev = wiphy_to_dev(wdev->wiphy);
8330
8331                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
8332                         if (!dev) {
8333                                 if (rtnl)
8334                                         rtnl_unlock();
8335                                 return -EINVAL;
8336                         }
8337
8338                         info->user_ptr[1] = dev;
8339                 } else {
8340                         info->user_ptr[1] = wdev;
8341                 }
8342
8343                 if (dev) {
8344                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
8345                             !netif_running(dev)) {
8346                                 if (rtnl)
8347                                         rtnl_unlock();
8348                                 return -ENETDOWN;
8349                         }
8350
8351                         dev_hold(dev);
8352                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
8353                         if (!wdev->p2p_started) {
8354                                 if (rtnl)
8355                                         rtnl_unlock();
8356                                 return -ENETDOWN;
8357                         }
8358                 }
8359
8360                 info->user_ptr[0] = rdev;
8361         }
8362
8363         return 0;
8364 }
8365
8366 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
8367                               struct genl_info *info)
8368 {
8369         if (info->user_ptr[1]) {
8370                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
8371                         struct wireless_dev *wdev = info->user_ptr[1];
8372
8373                         if (wdev->netdev)
8374                                 dev_put(wdev->netdev);
8375                 } else {
8376                         dev_put(info->user_ptr[1]);
8377                 }
8378         }
8379         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
8380                 rtnl_unlock();
8381 }
8382
8383 static struct genl_ops nl80211_ops[] = {
8384         {
8385                 .cmd = NL80211_CMD_GET_WIPHY,
8386                 .doit = nl80211_get_wiphy,
8387                 .dumpit = nl80211_dump_wiphy,
8388                 .policy = nl80211_policy,
8389                 /* can be retrieved by unprivileged users */
8390                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8391                                   NL80211_FLAG_NEED_RTNL,
8392         },
8393         {
8394                 .cmd = NL80211_CMD_SET_WIPHY,
8395                 .doit = nl80211_set_wiphy,
8396                 .policy = nl80211_policy,
8397                 .flags = GENL_ADMIN_PERM,
8398                 .internal_flags = NL80211_FLAG_NEED_RTNL,
8399         },
8400         {
8401                 .cmd = NL80211_CMD_GET_INTERFACE,
8402                 .doit = nl80211_get_interface,
8403                 .dumpit = nl80211_dump_interface,
8404                 .policy = nl80211_policy,
8405                 /* can be retrieved by unprivileged users */
8406                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8407                                   NL80211_FLAG_NEED_RTNL,
8408         },
8409         {
8410                 .cmd = NL80211_CMD_SET_INTERFACE,
8411                 .doit = nl80211_set_interface,
8412                 .policy = nl80211_policy,
8413                 .flags = GENL_ADMIN_PERM,
8414                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8415                                   NL80211_FLAG_NEED_RTNL,
8416         },
8417         {
8418                 .cmd = NL80211_CMD_NEW_INTERFACE,
8419                 .doit = nl80211_new_interface,
8420                 .policy = nl80211_policy,
8421                 .flags = GENL_ADMIN_PERM,
8422                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8423                                   NL80211_FLAG_NEED_RTNL,
8424         },
8425         {
8426                 .cmd = NL80211_CMD_DEL_INTERFACE,
8427                 .doit = nl80211_del_interface,
8428                 .policy = nl80211_policy,
8429                 .flags = GENL_ADMIN_PERM,
8430                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8431                                   NL80211_FLAG_NEED_RTNL,
8432         },
8433         {
8434                 .cmd = NL80211_CMD_GET_KEY,
8435                 .doit = nl80211_get_key,
8436                 .policy = nl80211_policy,
8437                 .flags = GENL_ADMIN_PERM,
8438                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8439                                   NL80211_FLAG_NEED_RTNL,
8440         },
8441         {
8442                 .cmd = NL80211_CMD_SET_KEY,
8443                 .doit = nl80211_set_key,
8444                 .policy = nl80211_policy,
8445                 .flags = GENL_ADMIN_PERM,
8446                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8447                                   NL80211_FLAG_NEED_RTNL,
8448         },
8449         {
8450                 .cmd = NL80211_CMD_NEW_KEY,
8451                 .doit = nl80211_new_key,
8452                 .policy = nl80211_policy,
8453                 .flags = GENL_ADMIN_PERM,
8454                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8455                                   NL80211_FLAG_NEED_RTNL,
8456         },
8457         {
8458                 .cmd = NL80211_CMD_DEL_KEY,
8459                 .doit = nl80211_del_key,
8460                 .policy = nl80211_policy,
8461                 .flags = GENL_ADMIN_PERM,
8462                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8463                                   NL80211_FLAG_NEED_RTNL,
8464         },
8465         {
8466                 .cmd = NL80211_CMD_SET_BEACON,
8467                 .policy = nl80211_policy,
8468                 .flags = GENL_ADMIN_PERM,
8469                 .doit = nl80211_set_beacon,
8470                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8471                                   NL80211_FLAG_NEED_RTNL,
8472         },
8473         {
8474                 .cmd = NL80211_CMD_START_AP,
8475                 .policy = nl80211_policy,
8476                 .flags = GENL_ADMIN_PERM,
8477                 .doit = nl80211_start_ap,
8478                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8479                                   NL80211_FLAG_NEED_RTNL,
8480         },
8481         {
8482                 .cmd = NL80211_CMD_STOP_AP,
8483                 .policy = nl80211_policy,
8484                 .flags = GENL_ADMIN_PERM,
8485                 .doit = nl80211_stop_ap,
8486                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8487                                   NL80211_FLAG_NEED_RTNL,
8488         },
8489         {
8490                 .cmd = NL80211_CMD_GET_STATION,
8491                 .doit = nl80211_get_station,
8492                 .dumpit = nl80211_dump_station,
8493                 .policy = nl80211_policy,
8494                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8495                                   NL80211_FLAG_NEED_RTNL,
8496         },
8497         {
8498                 .cmd = NL80211_CMD_SET_STATION,
8499                 .doit = nl80211_set_station,
8500                 .policy = nl80211_policy,
8501                 .flags = GENL_ADMIN_PERM,
8502                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8503                                   NL80211_FLAG_NEED_RTNL,
8504         },
8505         {
8506                 .cmd = NL80211_CMD_NEW_STATION,
8507                 .doit = nl80211_new_station,
8508                 .policy = nl80211_policy,
8509                 .flags = GENL_ADMIN_PERM,
8510                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8511                                   NL80211_FLAG_NEED_RTNL,
8512         },
8513         {
8514                 .cmd = NL80211_CMD_DEL_STATION,
8515                 .doit = nl80211_del_station,
8516                 .policy = nl80211_policy,
8517                 .flags = GENL_ADMIN_PERM,
8518                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8519                                   NL80211_FLAG_NEED_RTNL,
8520         },
8521         {
8522                 .cmd = NL80211_CMD_GET_MPATH,
8523                 .doit = nl80211_get_mpath,
8524                 .dumpit = nl80211_dump_mpath,
8525                 .policy = nl80211_policy,
8526                 .flags = GENL_ADMIN_PERM,
8527                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8528                                   NL80211_FLAG_NEED_RTNL,
8529         },
8530         {
8531                 .cmd = NL80211_CMD_SET_MPATH,
8532                 .doit = nl80211_set_mpath,
8533                 .policy = nl80211_policy,
8534                 .flags = GENL_ADMIN_PERM,
8535                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8536                                   NL80211_FLAG_NEED_RTNL,
8537         },
8538         {
8539                 .cmd = NL80211_CMD_NEW_MPATH,
8540                 .doit = nl80211_new_mpath,
8541                 .policy = nl80211_policy,
8542                 .flags = GENL_ADMIN_PERM,
8543                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8544                                   NL80211_FLAG_NEED_RTNL,
8545         },
8546         {
8547                 .cmd = NL80211_CMD_DEL_MPATH,
8548                 .doit = nl80211_del_mpath,
8549                 .policy = nl80211_policy,
8550                 .flags = GENL_ADMIN_PERM,
8551                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8552                                   NL80211_FLAG_NEED_RTNL,
8553         },
8554         {
8555                 .cmd = NL80211_CMD_SET_BSS,
8556                 .doit = nl80211_set_bss,
8557                 .policy = nl80211_policy,
8558                 .flags = GENL_ADMIN_PERM,
8559                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8560                                   NL80211_FLAG_NEED_RTNL,
8561         },
8562         {
8563                 .cmd = NL80211_CMD_GET_REG,
8564                 .doit = nl80211_get_reg,
8565                 .policy = nl80211_policy,
8566                 .internal_flags = NL80211_FLAG_NEED_RTNL,
8567                 /* can be retrieved by unprivileged users */
8568         },
8569         {
8570                 .cmd = NL80211_CMD_SET_REG,
8571                 .doit = nl80211_set_reg,
8572                 .policy = nl80211_policy,
8573                 .flags = GENL_ADMIN_PERM,
8574                 .internal_flags = NL80211_FLAG_NEED_RTNL,
8575         },
8576         {
8577                 .cmd = NL80211_CMD_REQ_SET_REG,
8578                 .doit = nl80211_req_set_reg,
8579                 .policy = nl80211_policy,
8580                 .flags = GENL_ADMIN_PERM,
8581         },
8582         {
8583                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
8584                 .doit = nl80211_get_mesh_config,
8585                 .policy = nl80211_policy,
8586                 /* can be retrieved by unprivileged users */
8587                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8588                                   NL80211_FLAG_NEED_RTNL,
8589         },
8590         {
8591                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
8592                 .doit = nl80211_update_mesh_config,
8593                 .policy = nl80211_policy,
8594                 .flags = GENL_ADMIN_PERM,
8595                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8596                                   NL80211_FLAG_NEED_RTNL,
8597         },
8598         {
8599                 .cmd = NL80211_CMD_TRIGGER_SCAN,
8600                 .doit = nl80211_trigger_scan,
8601                 .policy = nl80211_policy,
8602                 .flags = GENL_ADMIN_PERM,
8603                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8604                                   NL80211_FLAG_NEED_RTNL,
8605         },
8606         {
8607                 .cmd = NL80211_CMD_GET_SCAN,
8608                 .policy = nl80211_policy,
8609                 .dumpit = nl80211_dump_scan,
8610         },
8611         {
8612                 .cmd = NL80211_CMD_START_SCHED_SCAN,
8613                 .doit = nl80211_start_sched_scan,
8614                 .policy = nl80211_policy,
8615                 .flags = GENL_ADMIN_PERM,
8616                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8617                                   NL80211_FLAG_NEED_RTNL,
8618         },
8619         {
8620                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
8621                 .doit = nl80211_stop_sched_scan,
8622                 .policy = nl80211_policy,
8623                 .flags = GENL_ADMIN_PERM,
8624                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8625                                   NL80211_FLAG_NEED_RTNL,
8626         },
8627         {
8628                 .cmd = NL80211_CMD_AUTHENTICATE,
8629                 .doit = nl80211_authenticate,
8630                 .policy = nl80211_policy,
8631                 .flags = GENL_ADMIN_PERM,
8632                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8633                                   NL80211_FLAG_NEED_RTNL,
8634         },
8635         {
8636                 .cmd = NL80211_CMD_ASSOCIATE,
8637                 .doit = nl80211_associate,
8638                 .policy = nl80211_policy,
8639                 .flags = GENL_ADMIN_PERM,
8640                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8641                                   NL80211_FLAG_NEED_RTNL,
8642         },
8643         {
8644                 .cmd = NL80211_CMD_DEAUTHENTICATE,
8645                 .doit = nl80211_deauthenticate,
8646                 .policy = nl80211_policy,
8647                 .flags = GENL_ADMIN_PERM,
8648                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8649                                   NL80211_FLAG_NEED_RTNL,
8650         },
8651         {
8652                 .cmd = NL80211_CMD_DISASSOCIATE,
8653                 .doit = nl80211_disassociate,
8654                 .policy = nl80211_policy,
8655                 .flags = GENL_ADMIN_PERM,
8656                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8657                                   NL80211_FLAG_NEED_RTNL,
8658         },
8659         {
8660                 .cmd = NL80211_CMD_JOIN_IBSS,
8661                 .doit = nl80211_join_ibss,
8662                 .policy = nl80211_policy,
8663                 .flags = GENL_ADMIN_PERM,
8664                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8665                                   NL80211_FLAG_NEED_RTNL,
8666         },
8667         {
8668                 .cmd = NL80211_CMD_LEAVE_IBSS,
8669                 .doit = nl80211_leave_ibss,
8670                 .policy = nl80211_policy,
8671                 .flags = GENL_ADMIN_PERM,
8672                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8673                                   NL80211_FLAG_NEED_RTNL,
8674         },
8675 #ifdef CONFIG_NL80211_TESTMODE
8676         {
8677                 .cmd = NL80211_CMD_TESTMODE,
8678                 .doit = nl80211_testmode_do,
8679                 .dumpit = nl80211_testmode_dump,
8680                 .policy = nl80211_policy,
8681                 .flags = GENL_ADMIN_PERM,
8682                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8683                                   NL80211_FLAG_NEED_RTNL,
8684         },
8685 #endif
8686         {
8687                 .cmd = NL80211_CMD_CONNECT,
8688                 .doit = nl80211_connect,
8689                 .policy = nl80211_policy,
8690                 .flags = GENL_ADMIN_PERM,
8691                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8692                                   NL80211_FLAG_NEED_RTNL,
8693         },
8694         {
8695                 .cmd = NL80211_CMD_DISCONNECT,
8696                 .doit = nl80211_disconnect,
8697                 .policy = nl80211_policy,
8698                 .flags = GENL_ADMIN_PERM,
8699                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8700                                   NL80211_FLAG_NEED_RTNL,
8701         },
8702         {
8703                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
8704                 .doit = nl80211_wiphy_netns,
8705                 .policy = nl80211_policy,
8706                 .flags = GENL_ADMIN_PERM,
8707                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8708                                   NL80211_FLAG_NEED_RTNL,
8709         },
8710         {
8711                 .cmd = NL80211_CMD_GET_SURVEY,
8712                 .policy = nl80211_policy,
8713                 .dumpit = nl80211_dump_survey,
8714         },
8715         {
8716                 .cmd = NL80211_CMD_SET_PMKSA,
8717                 .doit = nl80211_setdel_pmksa,
8718                 .policy = nl80211_policy,
8719                 .flags = GENL_ADMIN_PERM,
8720                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8721                                   NL80211_FLAG_NEED_RTNL,
8722         },
8723         {
8724                 .cmd = NL80211_CMD_DEL_PMKSA,
8725                 .doit = nl80211_setdel_pmksa,
8726                 .policy = nl80211_policy,
8727                 .flags = GENL_ADMIN_PERM,
8728                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8729                                   NL80211_FLAG_NEED_RTNL,
8730         },
8731         {
8732                 .cmd = NL80211_CMD_FLUSH_PMKSA,
8733                 .doit = nl80211_flush_pmksa,
8734                 .policy = nl80211_policy,
8735                 .flags = GENL_ADMIN_PERM,
8736                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8737                                   NL80211_FLAG_NEED_RTNL,
8738         },
8739         {
8740                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
8741                 .doit = nl80211_remain_on_channel,
8742                 .policy = nl80211_policy,
8743                 .flags = GENL_ADMIN_PERM,
8744                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8745                                   NL80211_FLAG_NEED_RTNL,
8746         },
8747         {
8748                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
8749                 .doit = nl80211_cancel_remain_on_channel,
8750                 .policy = nl80211_policy,
8751                 .flags = GENL_ADMIN_PERM,
8752                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8753                                   NL80211_FLAG_NEED_RTNL,
8754         },
8755         {
8756                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
8757                 .doit = nl80211_set_tx_bitrate_mask,
8758                 .policy = nl80211_policy,
8759                 .flags = GENL_ADMIN_PERM,
8760                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8761                                   NL80211_FLAG_NEED_RTNL,
8762         },
8763         {
8764                 .cmd = NL80211_CMD_REGISTER_FRAME,
8765                 .doit = nl80211_register_mgmt,
8766                 .policy = nl80211_policy,
8767                 .flags = GENL_ADMIN_PERM,
8768                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8769                                   NL80211_FLAG_NEED_RTNL,
8770         },
8771         {
8772                 .cmd = NL80211_CMD_FRAME,
8773                 .doit = nl80211_tx_mgmt,
8774                 .policy = nl80211_policy,
8775                 .flags = GENL_ADMIN_PERM,
8776                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8777                                   NL80211_FLAG_NEED_RTNL,
8778         },
8779         {
8780                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
8781                 .doit = nl80211_tx_mgmt_cancel_wait,
8782                 .policy = nl80211_policy,
8783                 .flags = GENL_ADMIN_PERM,
8784                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8785                                   NL80211_FLAG_NEED_RTNL,
8786         },
8787         {
8788                 .cmd = NL80211_CMD_SET_POWER_SAVE,
8789                 .doit = nl80211_set_power_save,
8790                 .policy = nl80211_policy,
8791                 .flags = GENL_ADMIN_PERM,
8792                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8793                                   NL80211_FLAG_NEED_RTNL,
8794         },
8795         {
8796                 .cmd = NL80211_CMD_GET_POWER_SAVE,
8797                 .doit = nl80211_get_power_save,
8798                 .policy = nl80211_policy,
8799                 /* can be retrieved by unprivileged users */
8800                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8801                                   NL80211_FLAG_NEED_RTNL,
8802         },
8803         {
8804                 .cmd = NL80211_CMD_SET_CQM,
8805                 .doit = nl80211_set_cqm,
8806                 .policy = nl80211_policy,
8807                 .flags = GENL_ADMIN_PERM,
8808                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8809                                   NL80211_FLAG_NEED_RTNL,
8810         },
8811         {
8812                 .cmd = NL80211_CMD_SET_CHANNEL,
8813                 .doit = nl80211_set_channel,
8814                 .policy = nl80211_policy,
8815                 .flags = GENL_ADMIN_PERM,
8816                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8817                                   NL80211_FLAG_NEED_RTNL,
8818         },
8819         {
8820                 .cmd = NL80211_CMD_SET_WDS_PEER,
8821                 .doit = nl80211_set_wds_peer,
8822                 .policy = nl80211_policy,
8823                 .flags = GENL_ADMIN_PERM,
8824                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8825                                   NL80211_FLAG_NEED_RTNL,
8826         },
8827         {
8828                 .cmd = NL80211_CMD_JOIN_MESH,
8829                 .doit = nl80211_join_mesh,
8830                 .policy = nl80211_policy,
8831                 .flags = GENL_ADMIN_PERM,
8832                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8833                                   NL80211_FLAG_NEED_RTNL,
8834         },
8835         {
8836                 .cmd = NL80211_CMD_LEAVE_MESH,
8837                 .doit = nl80211_leave_mesh,
8838                 .policy = nl80211_policy,
8839                 .flags = GENL_ADMIN_PERM,
8840                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8841                                   NL80211_FLAG_NEED_RTNL,
8842         },
8843 #ifdef CONFIG_PM
8844         {
8845                 .cmd = NL80211_CMD_GET_WOWLAN,
8846                 .doit = nl80211_get_wowlan,
8847                 .policy = nl80211_policy,
8848                 /* can be retrieved by unprivileged users */
8849                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8850                                   NL80211_FLAG_NEED_RTNL,
8851         },
8852         {
8853                 .cmd = NL80211_CMD_SET_WOWLAN,
8854                 .doit = nl80211_set_wowlan,
8855                 .policy = nl80211_policy,
8856                 .flags = GENL_ADMIN_PERM,
8857                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8858                                   NL80211_FLAG_NEED_RTNL,
8859         },
8860 #endif
8861         {
8862                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
8863                 .doit = nl80211_set_rekey_data,
8864                 .policy = nl80211_policy,
8865                 .flags = GENL_ADMIN_PERM,
8866                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8867                                   NL80211_FLAG_NEED_RTNL,
8868         },
8869         {
8870                 .cmd = NL80211_CMD_TDLS_MGMT,
8871                 .doit = nl80211_tdls_mgmt,
8872                 .policy = nl80211_policy,
8873                 .flags = GENL_ADMIN_PERM,
8874                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8875                                   NL80211_FLAG_NEED_RTNL,
8876         },
8877         {
8878                 .cmd = NL80211_CMD_TDLS_OPER,
8879                 .doit = nl80211_tdls_oper,
8880                 .policy = nl80211_policy,
8881                 .flags = GENL_ADMIN_PERM,
8882                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8883                                   NL80211_FLAG_NEED_RTNL,
8884         },
8885         {
8886                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
8887                 .doit = nl80211_register_unexpected_frame,
8888                 .policy = nl80211_policy,
8889                 .flags = GENL_ADMIN_PERM,
8890                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8891                                   NL80211_FLAG_NEED_RTNL,
8892         },
8893         {
8894                 .cmd = NL80211_CMD_PROBE_CLIENT,
8895                 .doit = nl80211_probe_client,
8896                 .policy = nl80211_policy,
8897                 .flags = GENL_ADMIN_PERM,
8898                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8899                                   NL80211_FLAG_NEED_RTNL,
8900         },
8901         {
8902                 .cmd = NL80211_CMD_REGISTER_BEACONS,
8903                 .doit = nl80211_register_beacons,
8904                 .policy = nl80211_policy,
8905                 .flags = GENL_ADMIN_PERM,
8906                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8907                                   NL80211_FLAG_NEED_RTNL,
8908         },
8909         {
8910                 .cmd = NL80211_CMD_SET_NOACK_MAP,
8911                 .doit = nl80211_set_noack_map,
8912                 .policy = nl80211_policy,
8913                 .flags = GENL_ADMIN_PERM,
8914                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8915                                   NL80211_FLAG_NEED_RTNL,
8916         },
8917         {
8918                 .cmd = NL80211_CMD_START_P2P_DEVICE,
8919                 .doit = nl80211_start_p2p_device,
8920                 .policy = nl80211_policy,
8921                 .flags = GENL_ADMIN_PERM,
8922                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8923                                   NL80211_FLAG_NEED_RTNL,
8924         },
8925         {
8926                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
8927                 .doit = nl80211_stop_p2p_device,
8928                 .policy = nl80211_policy,
8929                 .flags = GENL_ADMIN_PERM,
8930                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8931                                   NL80211_FLAG_NEED_RTNL,
8932         },
8933         {
8934                 .cmd = NL80211_CMD_SET_MCAST_RATE,
8935                 .doit = nl80211_set_mcast_rate,
8936                 .policy = nl80211_policy,
8937                 .flags = GENL_ADMIN_PERM,
8938                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8939                                   NL80211_FLAG_NEED_RTNL,
8940         },
8941         {
8942                 .cmd = NL80211_CMD_SET_MAC_ACL,
8943                 .doit = nl80211_set_mac_acl,
8944                 .policy = nl80211_policy,
8945                 .flags = GENL_ADMIN_PERM,
8946                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8947                                   NL80211_FLAG_NEED_RTNL,
8948         },
8949         {
8950                 .cmd = NL80211_CMD_RADAR_DETECT,
8951                 .doit = nl80211_start_radar_detection,
8952                 .policy = nl80211_policy,
8953                 .flags = GENL_ADMIN_PERM,
8954                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8955                                   NL80211_FLAG_NEED_RTNL,
8956         },
8957         {
8958                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
8959                 .doit = nl80211_get_protocol_features,
8960                 .policy = nl80211_policy,
8961         },
8962         {
8963                 .cmd = NL80211_CMD_UPDATE_FT_IES,
8964                 .doit = nl80211_update_ft_ies,
8965                 .policy = nl80211_policy,
8966                 .flags = GENL_ADMIN_PERM,
8967                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8968                                   NL80211_FLAG_NEED_RTNL,
8969         },
8970         {
8971                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
8972                 .doit = nl80211_crit_protocol_start,
8973                 .policy = nl80211_policy,
8974                 .flags = GENL_ADMIN_PERM,
8975                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8976                                   NL80211_FLAG_NEED_RTNL,
8977         },
8978         {
8979                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
8980                 .doit = nl80211_crit_protocol_stop,
8981                 .policy = nl80211_policy,
8982                 .flags = GENL_ADMIN_PERM,
8983                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8984                                   NL80211_FLAG_NEED_RTNL,
8985         }
8986 };
8987
8988 static struct genl_multicast_group nl80211_mlme_mcgrp = {
8989         .name = "mlme",
8990 };
8991
8992 /* multicast groups */
8993 static struct genl_multicast_group nl80211_config_mcgrp = {
8994         .name = "config",
8995 };
8996 static struct genl_multicast_group nl80211_scan_mcgrp = {
8997         .name = "scan",
8998 };
8999 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
9000         .name = "regulatory",
9001 };
9002
9003 /* notification functions */
9004
9005 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
9006 {
9007         struct sk_buff *msg;
9008
9009         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9010         if (!msg)
9011                 return;
9012
9013         if (nl80211_send_wiphy(rdev, msg, 0, 0, 0,
9014                                false, NULL, NULL, NULL) < 0) {
9015                 nlmsg_free(msg);
9016                 return;
9017         }
9018
9019         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9020                                 nl80211_config_mcgrp.id, GFP_KERNEL);
9021 }
9022
9023 static int nl80211_add_scan_req(struct sk_buff *msg,
9024                                 struct cfg80211_registered_device *rdev)
9025 {
9026         struct cfg80211_scan_request *req = rdev->scan_req;
9027         struct nlattr *nest;
9028         int i;
9029
9030         if (WARN_ON(!req))
9031                 return 0;
9032
9033         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
9034         if (!nest)
9035                 goto nla_put_failure;
9036         for (i = 0; i < req->n_ssids; i++) {
9037                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
9038                         goto nla_put_failure;
9039         }
9040         nla_nest_end(msg, nest);
9041
9042         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
9043         if (!nest)
9044                 goto nla_put_failure;
9045         for (i = 0; i < req->n_channels; i++) {
9046                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
9047                         goto nla_put_failure;
9048         }
9049         nla_nest_end(msg, nest);
9050
9051         if (req->ie &&
9052             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
9053                 goto nla_put_failure;
9054
9055         if (req->flags)
9056                 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags);
9057
9058         return 0;
9059  nla_put_failure:
9060         return -ENOBUFS;
9061 }
9062
9063 static int nl80211_send_scan_msg(struct sk_buff *msg,
9064                                  struct cfg80211_registered_device *rdev,
9065                                  struct wireless_dev *wdev,
9066                                  u32 portid, u32 seq, int flags,
9067                                  u32 cmd)
9068 {
9069         void *hdr;
9070
9071         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
9072         if (!hdr)
9073                 return -1;
9074
9075         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9076             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9077                                          wdev->netdev->ifindex)) ||
9078             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
9079                 goto nla_put_failure;
9080
9081         /* ignore errors and send incomplete event anyway */
9082         nl80211_add_scan_req(msg, rdev);
9083
9084         return genlmsg_end(msg, hdr);
9085
9086  nla_put_failure:
9087         genlmsg_cancel(msg, hdr);
9088         return -EMSGSIZE;
9089 }
9090
9091 static int
9092 nl80211_send_sched_scan_msg(struct sk_buff *msg,
9093                             struct cfg80211_registered_device *rdev,
9094                             struct net_device *netdev,
9095                             u32 portid, u32 seq, int flags, u32 cmd)
9096 {
9097         void *hdr;
9098
9099         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
9100         if (!hdr)
9101                 return -1;
9102
9103         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9104             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
9105                 goto nla_put_failure;
9106
9107         return genlmsg_end(msg, hdr);
9108
9109  nla_put_failure:
9110         genlmsg_cancel(msg, hdr);
9111         return -EMSGSIZE;
9112 }
9113
9114 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
9115                              struct wireless_dev *wdev)
9116 {
9117         struct sk_buff *msg;
9118
9119         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9120         if (!msg)
9121                 return;
9122
9123         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9124                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
9125                 nlmsg_free(msg);
9126                 return;
9127         }
9128
9129         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9130                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9131 }
9132
9133 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
9134                             struct wireless_dev *wdev)
9135 {
9136         struct sk_buff *msg;
9137
9138         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9139         if (!msg)
9140                 return;
9141
9142         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9143                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
9144                 nlmsg_free(msg);
9145                 return;
9146         }
9147
9148         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9149                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9150 }
9151
9152 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
9153                                struct wireless_dev *wdev)
9154 {
9155         struct sk_buff *msg;
9156
9157         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9158         if (!msg)
9159                 return;
9160
9161         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9162                                   NL80211_CMD_SCAN_ABORTED) < 0) {
9163                 nlmsg_free(msg);
9164                 return;
9165         }
9166
9167         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9168                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9169 }
9170
9171 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
9172                                      struct net_device *netdev)
9173 {
9174         struct sk_buff *msg;
9175
9176         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9177         if (!msg)
9178                 return;
9179
9180         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
9181                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
9182                 nlmsg_free(msg);
9183                 return;
9184         }
9185
9186         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9187                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9188 }
9189
9190 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
9191                              struct net_device *netdev, u32 cmd)
9192 {
9193         struct sk_buff *msg;
9194
9195         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9196         if (!msg)
9197                 return;
9198
9199         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
9200                 nlmsg_free(msg);
9201                 return;
9202         }
9203
9204         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9205                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9206 }
9207
9208 /*
9209  * This can happen on global regulatory changes or device specific settings
9210  * based on custom world regulatory domains.
9211  */
9212 void nl80211_send_reg_change_event(struct regulatory_request *request)
9213 {
9214         struct sk_buff *msg;
9215         void *hdr;
9216
9217         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9218         if (!msg)
9219                 return;
9220
9221         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
9222         if (!hdr) {
9223                 nlmsg_free(msg);
9224                 return;
9225         }
9226
9227         /* Userspace can always count this one always being set */
9228         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
9229                 goto nla_put_failure;
9230
9231         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
9232                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9233                                NL80211_REGDOM_TYPE_WORLD))
9234                         goto nla_put_failure;
9235         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
9236                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9237                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
9238                         goto nla_put_failure;
9239         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
9240                    request->intersect) {
9241                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9242                                NL80211_REGDOM_TYPE_INTERSECTION))
9243                         goto nla_put_failure;
9244         } else {
9245                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9246                                NL80211_REGDOM_TYPE_COUNTRY) ||
9247                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
9248                                    request->alpha2))
9249                         goto nla_put_failure;
9250         }
9251
9252         if (request->wiphy_idx != WIPHY_IDX_INVALID &&
9253             nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
9254                 goto nla_put_failure;
9255
9256         genlmsg_end(msg, hdr);
9257
9258         rcu_read_lock();
9259         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
9260                                 GFP_ATOMIC);
9261         rcu_read_unlock();
9262
9263         return;
9264
9265 nla_put_failure:
9266         genlmsg_cancel(msg, hdr);
9267         nlmsg_free(msg);
9268 }
9269
9270 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
9271                                     struct net_device *netdev,
9272                                     const u8 *buf, size_t len,
9273                                     enum nl80211_commands cmd, gfp_t gfp)
9274 {
9275         struct sk_buff *msg;
9276         void *hdr;
9277
9278         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9279         if (!msg)
9280                 return;
9281
9282         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9283         if (!hdr) {
9284                 nlmsg_free(msg);
9285                 return;
9286         }
9287
9288         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9289             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9290             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
9291                 goto nla_put_failure;
9292
9293         genlmsg_end(msg, hdr);
9294
9295         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9296                                 nl80211_mlme_mcgrp.id, gfp);
9297         return;
9298
9299  nla_put_failure:
9300         genlmsg_cancel(msg, hdr);
9301         nlmsg_free(msg);
9302 }
9303
9304 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
9305                           struct net_device *netdev, const u8 *buf,
9306                           size_t len, gfp_t gfp)
9307 {
9308         nl80211_send_mlme_event(rdev, netdev, buf, len,
9309                                 NL80211_CMD_AUTHENTICATE, gfp);
9310 }
9311
9312 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
9313                            struct net_device *netdev, const u8 *buf,
9314                            size_t len, gfp_t gfp)
9315 {
9316         nl80211_send_mlme_event(rdev, netdev, buf, len,
9317                                 NL80211_CMD_ASSOCIATE, gfp);
9318 }
9319
9320 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
9321                          struct net_device *netdev, const u8 *buf,
9322                          size_t len, gfp_t gfp)
9323 {
9324         nl80211_send_mlme_event(rdev, netdev, buf, len,
9325                                 NL80211_CMD_DEAUTHENTICATE, gfp);
9326 }
9327
9328 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
9329                            struct net_device *netdev, const u8 *buf,
9330                            size_t len, gfp_t gfp)
9331 {
9332         nl80211_send_mlme_event(rdev, netdev, buf, len,
9333                                 NL80211_CMD_DISASSOCIATE, gfp);
9334 }
9335
9336 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
9337                                   size_t len)
9338 {
9339         struct wireless_dev *wdev = dev->ieee80211_ptr;
9340         struct wiphy *wiphy = wdev->wiphy;
9341         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9342         const struct ieee80211_mgmt *mgmt = (void *)buf;
9343         u32 cmd;
9344
9345         if (WARN_ON(len < 2))
9346                 return;
9347
9348         if (ieee80211_is_deauth(mgmt->frame_control))
9349                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
9350         else
9351                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
9352
9353         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
9354         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC);
9355 }
9356 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
9357
9358 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
9359                                       struct net_device *netdev, int cmd,
9360                                       const u8 *addr, gfp_t gfp)
9361 {
9362         struct sk_buff *msg;
9363         void *hdr;
9364
9365         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9366         if (!msg)
9367                 return;
9368
9369         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9370         if (!hdr) {
9371                 nlmsg_free(msg);
9372                 return;
9373         }
9374
9375         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9376             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9377             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
9378             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
9379                 goto nla_put_failure;
9380
9381         genlmsg_end(msg, hdr);
9382
9383         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9384                                 nl80211_mlme_mcgrp.id, gfp);
9385         return;
9386
9387  nla_put_failure:
9388         genlmsg_cancel(msg, hdr);
9389         nlmsg_free(msg);
9390 }
9391
9392 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
9393                                struct net_device *netdev, const u8 *addr,
9394                                gfp_t gfp)
9395 {
9396         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
9397                                   addr, gfp);
9398 }
9399
9400 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
9401                                 struct net_device *netdev, const u8 *addr,
9402                                 gfp_t gfp)
9403 {
9404         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
9405                                   addr, gfp);
9406 }
9407
9408 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
9409                                  struct net_device *netdev, const u8 *bssid,
9410                                  const u8 *req_ie, size_t req_ie_len,
9411                                  const u8 *resp_ie, size_t resp_ie_len,
9412                                  u16 status, gfp_t gfp)
9413 {
9414         struct sk_buff *msg;
9415         void *hdr;
9416
9417         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9418         if (!msg)
9419                 return;
9420
9421         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
9422         if (!hdr) {
9423                 nlmsg_free(msg);
9424                 return;
9425         }
9426
9427         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9428             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9429             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
9430             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
9431             (req_ie &&
9432              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
9433             (resp_ie &&
9434              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
9435                 goto nla_put_failure;
9436
9437         genlmsg_end(msg, hdr);
9438
9439         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9440                                 nl80211_mlme_mcgrp.id, gfp);
9441         return;
9442
9443  nla_put_failure:
9444         genlmsg_cancel(msg, hdr);
9445         nlmsg_free(msg);
9446
9447 }
9448
9449 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
9450                          struct net_device *netdev, const u8 *bssid,
9451                          const u8 *req_ie, size_t req_ie_len,
9452                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
9453 {
9454         struct sk_buff *msg;
9455         void *hdr;
9456
9457         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9458         if (!msg)
9459                 return;
9460
9461         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
9462         if (!hdr) {
9463                 nlmsg_free(msg);
9464                 return;
9465         }
9466
9467         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9468             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9469             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
9470             (req_ie &&
9471              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
9472             (resp_ie &&
9473              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
9474                 goto nla_put_failure;
9475
9476         genlmsg_end(msg, hdr);
9477
9478         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9479                                 nl80211_mlme_mcgrp.id, gfp);
9480         return;
9481
9482  nla_put_failure:
9483         genlmsg_cancel(msg, hdr);
9484         nlmsg_free(msg);
9485
9486 }
9487
9488 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
9489                                struct net_device *netdev, u16 reason,
9490                                const u8 *ie, size_t ie_len, bool from_ap)
9491 {
9492         struct sk_buff *msg;
9493         void *hdr;
9494
9495         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9496         if (!msg)
9497                 return;
9498
9499         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
9500         if (!hdr) {
9501                 nlmsg_free(msg);
9502                 return;
9503         }
9504
9505         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9506             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9507             (from_ap && reason &&
9508              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
9509             (from_ap &&
9510              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
9511             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
9512                 goto nla_put_failure;
9513
9514         genlmsg_end(msg, hdr);
9515
9516         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9517                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
9518         return;
9519
9520  nla_put_failure:
9521         genlmsg_cancel(msg, hdr);
9522         nlmsg_free(msg);
9523
9524 }
9525
9526 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
9527                              struct net_device *netdev, const u8 *bssid,
9528                              gfp_t gfp)
9529 {
9530         struct sk_buff *msg;
9531         void *hdr;
9532
9533         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9534         if (!msg)
9535                 return;
9536
9537         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
9538         if (!hdr) {
9539                 nlmsg_free(msg);
9540                 return;
9541         }
9542
9543         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9544             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9545             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
9546                 goto nla_put_failure;
9547
9548         genlmsg_end(msg, hdr);
9549
9550         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9551                                 nl80211_mlme_mcgrp.id, gfp);
9552         return;
9553
9554  nla_put_failure:
9555         genlmsg_cancel(msg, hdr);
9556         nlmsg_free(msg);
9557 }
9558
9559 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
9560                                         const u8* ie, u8 ie_len, gfp_t gfp)
9561 {
9562         struct wireless_dev *wdev = dev->ieee80211_ptr;
9563         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9564         struct sk_buff *msg;
9565         void *hdr;
9566
9567         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
9568                 return;
9569
9570         trace_cfg80211_notify_new_peer_candidate(dev, addr);
9571
9572         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9573         if (!msg)
9574                 return;
9575
9576         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
9577         if (!hdr) {
9578                 nlmsg_free(msg);
9579                 return;
9580         }
9581
9582         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9583             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9584             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
9585             (ie_len && ie &&
9586              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
9587                 goto nla_put_failure;
9588
9589         genlmsg_end(msg, hdr);
9590
9591         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9592                                 nl80211_mlme_mcgrp.id, gfp);
9593         return;
9594
9595  nla_put_failure:
9596         genlmsg_cancel(msg, hdr);
9597         nlmsg_free(msg);
9598 }
9599 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
9600
9601 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
9602                                  struct net_device *netdev, const u8 *addr,
9603                                  enum nl80211_key_type key_type, int key_id,
9604                                  const u8 *tsc, gfp_t gfp)
9605 {
9606         struct sk_buff *msg;
9607         void *hdr;
9608
9609         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9610         if (!msg)
9611                 return;
9612
9613         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
9614         if (!hdr) {
9615                 nlmsg_free(msg);
9616                 return;
9617         }
9618
9619         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9620             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9621             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
9622             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
9623             (key_id != -1 &&
9624              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
9625             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
9626                 goto nla_put_failure;
9627
9628         genlmsg_end(msg, hdr);
9629
9630         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9631                                 nl80211_mlme_mcgrp.id, gfp);
9632         return;
9633
9634  nla_put_failure:
9635         genlmsg_cancel(msg, hdr);
9636         nlmsg_free(msg);
9637 }
9638
9639 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
9640                                     struct ieee80211_channel *channel_before,
9641                                     struct ieee80211_channel *channel_after)
9642 {
9643         struct sk_buff *msg;
9644         void *hdr;
9645         struct nlattr *nl_freq;
9646
9647         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
9648         if (!msg)
9649                 return;
9650
9651         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
9652         if (!hdr) {
9653                 nlmsg_free(msg);
9654                 return;
9655         }
9656
9657         /*
9658          * Since we are applying the beacon hint to a wiphy we know its
9659          * wiphy_idx is valid
9660          */
9661         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
9662                 goto nla_put_failure;
9663
9664         /* Before */
9665         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
9666         if (!nl_freq)
9667                 goto nla_put_failure;
9668         if (nl80211_msg_put_channel(msg, channel_before, false))
9669                 goto nla_put_failure;
9670         nla_nest_end(msg, nl_freq);
9671
9672         /* After */
9673         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
9674         if (!nl_freq)
9675                 goto nla_put_failure;
9676         if (nl80211_msg_put_channel(msg, channel_after, false))
9677                 goto nla_put_failure;
9678         nla_nest_end(msg, nl_freq);
9679
9680         genlmsg_end(msg, hdr);
9681
9682         rcu_read_lock();
9683         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
9684                                 GFP_ATOMIC);
9685         rcu_read_unlock();
9686
9687         return;
9688
9689 nla_put_failure:
9690         genlmsg_cancel(msg, hdr);
9691         nlmsg_free(msg);
9692 }
9693
9694 static void nl80211_send_remain_on_chan_event(
9695         int cmd, struct cfg80211_registered_device *rdev,
9696         struct wireless_dev *wdev, u64 cookie,
9697         struct ieee80211_channel *chan,
9698         unsigned int duration, gfp_t gfp)
9699 {
9700         struct sk_buff *msg;
9701         void *hdr;
9702
9703         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9704         if (!msg)
9705                 return;
9706
9707         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9708         if (!hdr) {
9709                 nlmsg_free(msg);
9710                 return;
9711         }
9712
9713         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9714             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9715                                          wdev->netdev->ifindex)) ||
9716             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
9717             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
9718             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
9719                         NL80211_CHAN_NO_HT) ||
9720             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
9721                 goto nla_put_failure;
9722
9723         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
9724             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
9725                 goto nla_put_failure;
9726
9727         genlmsg_end(msg, hdr);
9728
9729         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9730                                 nl80211_mlme_mcgrp.id, gfp);
9731         return;
9732
9733  nla_put_failure:
9734         genlmsg_cancel(msg, hdr);
9735         nlmsg_free(msg);
9736 }
9737
9738 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
9739                                struct ieee80211_channel *chan,
9740                                unsigned int duration, gfp_t gfp)
9741 {
9742         struct wiphy *wiphy = wdev->wiphy;
9743         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9744
9745         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
9746         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
9747                                           rdev, wdev, cookie, chan,
9748                                           duration, gfp);
9749 }
9750 EXPORT_SYMBOL(cfg80211_ready_on_channel);
9751
9752 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
9753                                         struct ieee80211_channel *chan,
9754                                         gfp_t gfp)
9755 {
9756         struct wiphy *wiphy = wdev->wiphy;
9757         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9758
9759         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
9760         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
9761                                           rdev, wdev, cookie, chan, 0, gfp);
9762 }
9763 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
9764
9765 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
9766                       struct station_info *sinfo, gfp_t gfp)
9767 {
9768         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
9769         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9770         struct sk_buff *msg;
9771
9772         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
9773
9774         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9775         if (!msg)
9776                 return;
9777
9778         if (nl80211_send_station(msg, 0, 0, 0,
9779                                  rdev, dev, mac_addr, sinfo) < 0) {
9780                 nlmsg_free(msg);
9781                 return;
9782         }
9783
9784         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9785                                 nl80211_mlme_mcgrp.id, gfp);
9786 }
9787 EXPORT_SYMBOL(cfg80211_new_sta);
9788
9789 void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
9790 {
9791         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
9792         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9793         struct sk_buff *msg;
9794         void *hdr;
9795
9796         trace_cfg80211_del_sta(dev, mac_addr);
9797
9798         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9799         if (!msg)
9800                 return;
9801
9802         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
9803         if (!hdr) {
9804                 nlmsg_free(msg);
9805                 return;
9806         }
9807
9808         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9809             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
9810                 goto nla_put_failure;
9811
9812         genlmsg_end(msg, hdr);
9813
9814         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9815                                 nl80211_mlme_mcgrp.id, gfp);
9816         return;
9817
9818  nla_put_failure:
9819         genlmsg_cancel(msg, hdr);
9820         nlmsg_free(msg);
9821 }
9822 EXPORT_SYMBOL(cfg80211_del_sta);
9823
9824 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
9825                           enum nl80211_connect_failed_reason reason,
9826                           gfp_t gfp)
9827 {
9828         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
9829         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9830         struct sk_buff *msg;
9831         void *hdr;
9832
9833         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
9834         if (!msg)
9835                 return;
9836
9837         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
9838         if (!hdr) {
9839                 nlmsg_free(msg);
9840                 return;
9841         }
9842
9843         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9844             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
9845             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
9846                 goto nla_put_failure;
9847
9848         genlmsg_end(msg, hdr);
9849
9850         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9851                                 nl80211_mlme_mcgrp.id, gfp);
9852         return;
9853
9854  nla_put_failure:
9855         genlmsg_cancel(msg, hdr);
9856         nlmsg_free(msg);
9857 }
9858 EXPORT_SYMBOL(cfg80211_conn_failed);
9859
9860 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
9861                                        const u8 *addr, gfp_t gfp)
9862 {
9863         struct wireless_dev *wdev = dev->ieee80211_ptr;
9864         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9865         struct sk_buff *msg;
9866         void *hdr;
9867         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
9868
9869         if (!nlportid)
9870                 return false;
9871
9872         msg = nlmsg_new(100, gfp);
9873         if (!msg)
9874                 return true;
9875
9876         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9877         if (!hdr) {
9878                 nlmsg_free(msg);
9879                 return true;
9880         }
9881
9882         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9883             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9884             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
9885                 goto nla_put_failure;
9886
9887         genlmsg_end(msg, hdr);
9888         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
9889         return true;
9890
9891  nla_put_failure:
9892         genlmsg_cancel(msg, hdr);
9893         nlmsg_free(msg);
9894         return true;
9895 }
9896
9897 bool cfg80211_rx_spurious_frame(struct net_device *dev,
9898                                 const u8 *addr, gfp_t gfp)
9899 {
9900         struct wireless_dev *wdev = dev->ieee80211_ptr;
9901         bool ret;
9902
9903         trace_cfg80211_rx_spurious_frame(dev, addr);
9904
9905         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
9906                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
9907                 trace_cfg80211_return_bool(false);
9908                 return false;
9909         }
9910         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
9911                                          addr, gfp);
9912         trace_cfg80211_return_bool(ret);
9913         return ret;
9914 }
9915 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
9916
9917 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
9918                                         const u8 *addr, gfp_t gfp)
9919 {
9920         struct wireless_dev *wdev = dev->ieee80211_ptr;
9921         bool ret;
9922
9923         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
9924
9925         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
9926                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
9927                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
9928                 trace_cfg80211_return_bool(false);
9929                 return false;
9930         }
9931         ret = __nl80211_unexpected_frame(dev,
9932                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
9933                                          addr, gfp);
9934         trace_cfg80211_return_bool(ret);
9935         return ret;
9936 }
9937 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
9938
9939 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
9940                       struct wireless_dev *wdev, u32 nlportid,
9941                       int freq, int sig_dbm,
9942                       const u8 *buf, size_t len, gfp_t gfp)
9943 {
9944         struct net_device *netdev = wdev->netdev;
9945         struct sk_buff *msg;
9946         void *hdr;
9947
9948         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9949         if (!msg)
9950                 return -ENOMEM;
9951
9952         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
9953         if (!hdr) {
9954                 nlmsg_free(msg);
9955                 return -ENOMEM;
9956         }
9957
9958         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9959             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9960                                         netdev->ifindex)) ||
9961             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
9962             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
9963             (sig_dbm &&
9964              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
9965             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
9966                 goto nla_put_failure;
9967
9968         genlmsg_end(msg, hdr);
9969
9970         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
9971
9972  nla_put_failure:
9973         genlmsg_cancel(msg, hdr);
9974         nlmsg_free(msg);
9975         return -ENOBUFS;
9976 }
9977
9978 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
9979                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
9980 {
9981         struct wiphy *wiphy = wdev->wiphy;
9982         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9983         struct net_device *netdev = wdev->netdev;
9984         struct sk_buff *msg;
9985         void *hdr;
9986
9987         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
9988
9989         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9990         if (!msg)
9991                 return;
9992
9993         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
9994         if (!hdr) {
9995                 nlmsg_free(msg);
9996                 return;
9997         }
9998
9999         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10000             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10001                                    netdev->ifindex)) ||
10002             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10003             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
10004             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
10005             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
10006                 goto nla_put_failure;
10007
10008         genlmsg_end(msg, hdr);
10009
10010         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
10011         return;
10012
10013  nla_put_failure:
10014         genlmsg_cancel(msg, hdr);
10015         nlmsg_free(msg);
10016 }
10017 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
10018
10019 void cfg80211_cqm_rssi_notify(struct net_device *dev,
10020                               enum nl80211_cqm_rssi_threshold_event rssi_event,
10021                               gfp_t gfp)
10022 {
10023         struct wireless_dev *wdev = dev->ieee80211_ptr;
10024         struct wiphy *wiphy = wdev->wiphy;
10025         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10026         struct sk_buff *msg;
10027         struct nlattr *pinfoattr;
10028         void *hdr;
10029
10030         trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
10031
10032         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10033         if (!msg)
10034                 return;
10035
10036         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10037         if (!hdr) {
10038                 nlmsg_free(msg);
10039                 return;
10040         }
10041
10042         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10043             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
10044                 goto nla_put_failure;
10045
10046         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10047         if (!pinfoattr)
10048                 goto nla_put_failure;
10049
10050         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
10051                         rssi_event))
10052                 goto nla_put_failure;
10053
10054         nla_nest_end(msg, pinfoattr);
10055
10056         genlmsg_end(msg, hdr);
10057
10058         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10059                                 nl80211_mlme_mcgrp.id, gfp);
10060         return;
10061
10062  nla_put_failure:
10063         genlmsg_cancel(msg, hdr);
10064         nlmsg_free(msg);
10065 }
10066 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
10067
10068 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
10069                                      struct net_device *netdev, const u8 *bssid,
10070                                      const u8 *replay_ctr, gfp_t gfp)
10071 {
10072         struct sk_buff *msg;
10073         struct nlattr *rekey_attr;
10074         void *hdr;
10075
10076         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10077         if (!msg)
10078                 return;
10079
10080         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
10081         if (!hdr) {
10082                 nlmsg_free(msg);
10083                 return;
10084         }
10085
10086         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10087             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10088             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
10089                 goto nla_put_failure;
10090
10091         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
10092         if (!rekey_attr)
10093                 goto nla_put_failure;
10094
10095         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
10096                     NL80211_REPLAY_CTR_LEN, replay_ctr))
10097                 goto nla_put_failure;
10098
10099         nla_nest_end(msg, rekey_attr);
10100
10101         genlmsg_end(msg, hdr);
10102
10103         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10104                                 nl80211_mlme_mcgrp.id, gfp);
10105         return;
10106
10107  nla_put_failure:
10108         genlmsg_cancel(msg, hdr);
10109         nlmsg_free(msg);
10110 }
10111
10112 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
10113                                const u8 *replay_ctr, gfp_t gfp)
10114 {
10115         struct wireless_dev *wdev = dev->ieee80211_ptr;
10116         struct wiphy *wiphy = wdev->wiphy;
10117         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10118
10119         trace_cfg80211_gtk_rekey_notify(dev, bssid);
10120         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
10121 }
10122 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
10123
10124 static void
10125 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
10126                                struct net_device *netdev, int index,
10127                                const u8 *bssid, bool preauth, gfp_t gfp)
10128 {
10129         struct sk_buff *msg;
10130         struct nlattr *attr;
10131         void *hdr;
10132
10133         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10134         if (!msg)
10135                 return;
10136
10137         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
10138         if (!hdr) {
10139                 nlmsg_free(msg);
10140                 return;
10141         }
10142
10143         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10144             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
10145                 goto nla_put_failure;
10146
10147         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
10148         if (!attr)
10149                 goto nla_put_failure;
10150
10151         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
10152             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
10153             (preauth &&
10154              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
10155                 goto nla_put_failure;
10156
10157         nla_nest_end(msg, attr);
10158
10159         genlmsg_end(msg, hdr);
10160
10161         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10162                                 nl80211_mlme_mcgrp.id, gfp);
10163         return;
10164
10165  nla_put_failure:
10166         genlmsg_cancel(msg, hdr);
10167         nlmsg_free(msg);
10168 }
10169
10170 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
10171                                      const u8 *bssid, bool preauth, gfp_t gfp)
10172 {
10173         struct wireless_dev *wdev = dev->ieee80211_ptr;
10174         struct wiphy *wiphy = wdev->wiphy;
10175         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10176
10177         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
10178         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
10179 }
10180 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
10181
10182 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
10183                                      struct net_device *netdev,
10184                                      struct cfg80211_chan_def *chandef,
10185                                      gfp_t gfp)
10186 {
10187         struct sk_buff *msg;
10188         void *hdr;
10189
10190         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10191         if (!msg)
10192                 return;
10193
10194         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
10195         if (!hdr) {
10196                 nlmsg_free(msg);
10197                 return;
10198         }
10199
10200         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
10201                 goto nla_put_failure;
10202
10203         if (nl80211_send_chandef(msg, chandef))
10204                 goto nla_put_failure;
10205
10206         genlmsg_end(msg, hdr);
10207
10208         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10209                                 nl80211_mlme_mcgrp.id, gfp);
10210         return;
10211
10212  nla_put_failure:
10213         genlmsg_cancel(msg, hdr);
10214         nlmsg_free(msg);
10215 }
10216
10217 void cfg80211_ch_switch_notify(struct net_device *dev,
10218                                struct cfg80211_chan_def *chandef)
10219 {
10220         struct wireless_dev *wdev = dev->ieee80211_ptr;
10221         struct wiphy *wiphy = wdev->wiphy;
10222         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10223
10224         trace_cfg80211_ch_switch_notify(dev, chandef);
10225
10226         wdev_lock(wdev);
10227
10228         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
10229                     wdev->iftype != NL80211_IFTYPE_P2P_GO))
10230                 goto out;
10231
10232         wdev->channel = chandef->chan;
10233         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL);
10234 out:
10235         wdev_unlock(wdev);
10236         return;
10237 }
10238 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
10239
10240 void cfg80211_cqm_txe_notify(struct net_device *dev,
10241                              const u8 *peer, u32 num_packets,
10242                              u32 rate, u32 intvl, gfp_t gfp)
10243 {
10244         struct wireless_dev *wdev = dev->ieee80211_ptr;
10245         struct wiphy *wiphy = wdev->wiphy;
10246         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10247         struct sk_buff *msg;
10248         struct nlattr *pinfoattr;
10249         void *hdr;
10250
10251         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
10252         if (!msg)
10253                 return;
10254
10255         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10256         if (!hdr) {
10257                 nlmsg_free(msg);
10258                 return;
10259         }
10260
10261         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10262             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10263             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
10264                 goto nla_put_failure;
10265
10266         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10267         if (!pinfoattr)
10268                 goto nla_put_failure;
10269
10270         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
10271                 goto nla_put_failure;
10272
10273         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
10274                 goto nla_put_failure;
10275
10276         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
10277                 goto nla_put_failure;
10278
10279         nla_nest_end(msg, pinfoattr);
10280
10281         genlmsg_end(msg, hdr);
10282
10283         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10284                                 nl80211_mlme_mcgrp.id, gfp);
10285         return;
10286
10287  nla_put_failure:
10288         genlmsg_cancel(msg, hdr);
10289         nlmsg_free(msg);
10290 }
10291 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
10292
10293 void
10294 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
10295                      struct cfg80211_chan_def *chandef,
10296                      enum nl80211_radar_event event,
10297                      struct net_device *netdev, gfp_t gfp)
10298 {
10299         struct sk_buff *msg;
10300         void *hdr;
10301
10302         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10303         if (!msg)
10304                 return;
10305
10306         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
10307         if (!hdr) {
10308                 nlmsg_free(msg);
10309                 return;
10310         }
10311
10312         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
10313                 goto nla_put_failure;
10314
10315         /* NOP and radar events don't need a netdev parameter */
10316         if (netdev) {
10317                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
10318
10319                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10320                     nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10321                         goto nla_put_failure;
10322         }
10323
10324         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
10325                 goto nla_put_failure;
10326
10327         if (nl80211_send_chandef(msg, chandef))
10328                 goto nla_put_failure;
10329
10330         genlmsg_end(msg, hdr);
10331
10332         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10333                                 nl80211_mlme_mcgrp.id, gfp);
10334         return;
10335
10336  nla_put_failure:
10337         genlmsg_cancel(msg, hdr);
10338         nlmsg_free(msg);
10339 }
10340
10341 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
10342                                  const u8 *peer, u32 num_packets, gfp_t gfp)
10343 {
10344         struct wireless_dev *wdev = dev->ieee80211_ptr;
10345         struct wiphy *wiphy = wdev->wiphy;
10346         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10347         struct sk_buff *msg;
10348         struct nlattr *pinfoattr;
10349         void *hdr;
10350
10351         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
10352
10353         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10354         if (!msg)
10355                 return;
10356
10357         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10358         if (!hdr) {
10359                 nlmsg_free(msg);
10360                 return;
10361         }
10362
10363         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10364             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10365             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
10366                 goto nla_put_failure;
10367
10368         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10369         if (!pinfoattr)
10370                 goto nla_put_failure;
10371
10372         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
10373                 goto nla_put_failure;
10374
10375         nla_nest_end(msg, pinfoattr);
10376
10377         genlmsg_end(msg, hdr);
10378
10379         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10380                                 nl80211_mlme_mcgrp.id, gfp);
10381         return;
10382
10383  nla_put_failure:
10384         genlmsg_cancel(msg, hdr);
10385         nlmsg_free(msg);
10386 }
10387 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
10388
10389 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
10390                            u64 cookie, bool acked, gfp_t gfp)
10391 {
10392         struct wireless_dev *wdev = dev->ieee80211_ptr;
10393         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10394         struct sk_buff *msg;
10395         void *hdr;
10396
10397         trace_cfg80211_probe_status(dev, addr, cookie, acked);
10398
10399         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10400
10401         if (!msg)
10402                 return;
10403
10404         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
10405         if (!hdr) {
10406                 nlmsg_free(msg);
10407                 return;
10408         }
10409
10410         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10411             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10412             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
10413             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
10414             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
10415                 goto nla_put_failure;
10416
10417         genlmsg_end(msg, hdr);
10418
10419         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10420                                 nl80211_mlme_mcgrp.id, gfp);
10421         return;
10422
10423  nla_put_failure:
10424         genlmsg_cancel(msg, hdr);
10425         nlmsg_free(msg);
10426 }
10427 EXPORT_SYMBOL(cfg80211_probe_status);
10428
10429 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
10430                                  const u8 *frame, size_t len,
10431                                  int freq, int sig_dbm)
10432 {
10433         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10434         struct sk_buff *msg;
10435         void *hdr;
10436         struct cfg80211_beacon_registration *reg;
10437
10438         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
10439
10440         spin_lock_bh(&rdev->beacon_registrations_lock);
10441         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
10442                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
10443                 if (!msg) {
10444                         spin_unlock_bh(&rdev->beacon_registrations_lock);
10445                         return;
10446                 }
10447
10448                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
10449                 if (!hdr)
10450                         goto nla_put_failure;
10451
10452                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10453                     (freq &&
10454                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
10455                     (sig_dbm &&
10456                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
10457                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
10458                         goto nla_put_failure;
10459
10460                 genlmsg_end(msg, hdr);
10461
10462                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
10463         }
10464         spin_unlock_bh(&rdev->beacon_registrations_lock);
10465         return;
10466
10467  nla_put_failure:
10468         spin_unlock_bh(&rdev->beacon_registrations_lock);
10469         if (hdr)
10470                 genlmsg_cancel(msg, hdr);
10471         nlmsg_free(msg);
10472 }
10473 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
10474
10475 #ifdef CONFIG_PM
10476 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
10477                                    struct cfg80211_wowlan_wakeup *wakeup,
10478                                    gfp_t gfp)
10479 {
10480         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10481         struct sk_buff *msg;
10482         void *hdr;
10483         int size = 200;
10484
10485         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
10486
10487         if (wakeup)
10488                 size += wakeup->packet_present_len;
10489
10490         msg = nlmsg_new(size, gfp);
10491         if (!msg)
10492                 return;
10493
10494         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
10495         if (!hdr)
10496                 goto free_msg;
10497
10498         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10499             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10500                 goto free_msg;
10501
10502         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10503                                         wdev->netdev->ifindex))
10504                 goto free_msg;
10505
10506         if (wakeup) {
10507                 struct nlattr *reasons;
10508
10509                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
10510
10511                 if (wakeup->disconnect &&
10512                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
10513                         goto free_msg;
10514                 if (wakeup->magic_pkt &&
10515                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
10516                         goto free_msg;
10517                 if (wakeup->gtk_rekey_failure &&
10518                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
10519                         goto free_msg;
10520                 if (wakeup->eap_identity_req &&
10521                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
10522                         goto free_msg;
10523                 if (wakeup->four_way_handshake &&
10524                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
10525                         goto free_msg;
10526                 if (wakeup->rfkill_release &&
10527                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
10528                         goto free_msg;
10529
10530                 if (wakeup->pattern_idx >= 0 &&
10531                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
10532                                 wakeup->pattern_idx))
10533                         goto free_msg;
10534
10535                 if (wakeup->tcp_match)
10536                         nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH);
10537
10538                 if (wakeup->tcp_connlost)
10539                         nla_put_flag(msg,
10540                                      NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST);
10541
10542                 if (wakeup->tcp_nomoretokens)
10543                         nla_put_flag(msg,
10544                                 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS);
10545
10546                 if (wakeup->packet) {
10547                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
10548                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
10549
10550                         if (!wakeup->packet_80211) {
10551                                 pkt_attr =
10552                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
10553                                 len_attr =
10554                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
10555                         }
10556
10557                         if (wakeup->packet_len &&
10558                             nla_put_u32(msg, len_attr, wakeup->packet_len))
10559                                 goto free_msg;
10560
10561                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
10562                                     wakeup->packet))
10563                                 goto free_msg;
10564                 }
10565
10566                 nla_nest_end(msg, reasons);
10567         }
10568
10569         genlmsg_end(msg, hdr);
10570
10571         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10572                                 nl80211_mlme_mcgrp.id, gfp);
10573         return;
10574
10575  free_msg:
10576         nlmsg_free(msg);
10577 }
10578 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
10579 #endif
10580
10581 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
10582                                 enum nl80211_tdls_operation oper,
10583                                 u16 reason_code, gfp_t gfp)
10584 {
10585         struct wireless_dev *wdev = dev->ieee80211_ptr;
10586         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10587         struct sk_buff *msg;
10588         void *hdr;
10589
10590         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
10591                                          reason_code);
10592
10593         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10594         if (!msg)
10595                 return;
10596
10597         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
10598         if (!hdr) {
10599                 nlmsg_free(msg);
10600                 return;
10601         }
10602
10603         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10604             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10605             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
10606             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
10607             (reason_code > 0 &&
10608              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
10609                 goto nla_put_failure;
10610
10611         genlmsg_end(msg, hdr);
10612
10613         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10614                                 nl80211_mlme_mcgrp.id, gfp);
10615         return;
10616
10617  nla_put_failure:
10618         genlmsg_cancel(msg, hdr);
10619         nlmsg_free(msg);
10620 }
10621 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
10622
10623 static int nl80211_netlink_notify(struct notifier_block * nb,
10624                                   unsigned long state,
10625                                   void *_notify)
10626 {
10627         struct netlink_notify *notify = _notify;
10628         struct cfg80211_registered_device *rdev;
10629         struct wireless_dev *wdev;
10630         struct cfg80211_beacon_registration *reg, *tmp;
10631
10632         if (state != NETLINK_URELEASE)
10633                 return NOTIFY_DONE;
10634
10635         rcu_read_lock();
10636
10637         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
10638                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list)
10639                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
10640
10641                 spin_lock_bh(&rdev->beacon_registrations_lock);
10642                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
10643                                          list) {
10644                         if (reg->nlportid == notify->portid) {
10645                                 list_del(&reg->list);
10646                                 kfree(reg);
10647                                 break;
10648                         }
10649                 }
10650                 spin_unlock_bh(&rdev->beacon_registrations_lock);
10651         }
10652
10653         rcu_read_unlock();
10654
10655         return NOTIFY_DONE;
10656 }
10657
10658 static struct notifier_block nl80211_netlink_notifier = {
10659         .notifier_call = nl80211_netlink_notify,
10660 };
10661
10662 void cfg80211_ft_event(struct net_device *netdev,
10663                        struct cfg80211_ft_event_params *ft_event)
10664 {
10665         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
10666         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10667         struct sk_buff *msg;
10668         void *hdr;
10669
10670         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
10671
10672         if (!ft_event->target_ap)
10673                 return;
10674
10675         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10676         if (!msg)
10677                 return;
10678
10679         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
10680         if (!hdr) {
10681                 nlmsg_free(msg);
10682                 return;
10683         }
10684
10685         nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
10686         nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
10687         nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap);
10688         if (ft_event->ies)
10689                 nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies);
10690         if (ft_event->ric_ies)
10691                 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
10692                         ft_event->ric_ies);
10693
10694         genlmsg_end(msg, hdr);
10695
10696         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10697                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
10698 }
10699 EXPORT_SYMBOL(cfg80211_ft_event);
10700
10701 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
10702 {
10703         struct cfg80211_registered_device *rdev;
10704         struct sk_buff *msg;
10705         void *hdr;
10706         u32 nlportid;
10707
10708         rdev = wiphy_to_dev(wdev->wiphy);
10709         if (!rdev->crit_proto_nlportid)
10710                 return;
10711
10712         nlportid = rdev->crit_proto_nlportid;
10713         rdev->crit_proto_nlportid = 0;
10714
10715         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10716         if (!msg)
10717                 return;
10718
10719         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
10720         if (!hdr)
10721                 goto nla_put_failure;
10722
10723         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10724             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10725                 goto nla_put_failure;
10726
10727         genlmsg_end(msg, hdr);
10728
10729         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
10730         return;
10731
10732  nla_put_failure:
10733         if (hdr)
10734                 genlmsg_cancel(msg, hdr);
10735         nlmsg_free(msg);
10736
10737 }
10738 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
10739
10740 /* initialisation/exit functions */
10741
10742 int nl80211_init(void)
10743 {
10744         int err;
10745
10746         err = genl_register_family_with_ops(&nl80211_fam,
10747                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
10748         if (err)
10749                 return err;
10750
10751         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
10752         if (err)
10753                 goto err_out;
10754
10755         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
10756         if (err)
10757                 goto err_out;
10758
10759         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
10760         if (err)
10761                 goto err_out;
10762
10763         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
10764         if (err)
10765                 goto err_out;
10766
10767 #ifdef CONFIG_NL80211_TESTMODE
10768         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
10769         if (err)
10770                 goto err_out;
10771 #endif
10772
10773         err = netlink_register_notifier(&nl80211_netlink_notifier);
10774         if (err)
10775                 goto err_out;
10776
10777         return 0;
10778  err_out:
10779         genl_unregister_family(&nl80211_fam);
10780         return err;
10781 }
10782
10783 void nl80211_exit(void)
10784 {
10785         netlink_unregister_notifier(&nl80211_netlink_notifier);
10786         genl_unregister_family(&nl80211_fam);
10787 }