net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  * Copyright 2013-2014  Intel Mobile Communications GmbH
   6  */
   7
   8 #include <linux/if.h>
   9 #include <linux/module.h>
  10 #include <linux/err.h>
  11 #include <linux/slab.h>
  12 #include <linux/list.h>
  13 #include <linux/if_ether.h>
  14 #include <linux/ieee80211.h>
  15 #include <linux/nl80211.h>
  16 #include <linux/rtnetlink.h>
  17 #include <linux/netlink.h>
  18 #include <linux/etherdevice.h>
  19 #include <net/net_namespace.h>
  20 #include <net/genetlink.h>
  21 #include <net/cfg80211.h>
  22 #include <net/sock.h>
  23 #include <net/inet_connection_sock.h>
  24 #include "core.h"
  25 #include "nl80211.h"
  26 #include "reg.h"
  27 #include "rdev-ops.h"
  28
  29 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  30                                    struct genl_info *info,
  31                                    struct cfg80211_crypto_settings *settings,
  32                                    int cipher_limit);
  33
  34 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
  35                             struct genl_info *info);
  36 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
  37                               struct genl_info *info);
  38
  39 /* the netlink family */
  40 static struct genl_family nl80211_fam = {
  41         .id = GENL_ID_GENERATE,         /* don't bother with a hardcoded ID */
  42         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
  43         .hdrsize = 0,                   /* no private header */
  44         .version = 1,                   /* no particular meaning now */
  45         .maxattr = NL80211_ATTR_MAX,
  46         .netnsok = true,
  47         .pre_doit = nl80211_pre_doit,
  48         .post_doit = nl80211_post_doit,
  49 };
  50
  51 /* multicast groups */
  52 enum nl80211_multicast_groups {
  53         NL80211_MCGRP_CONFIG,
  54         NL80211_MCGRP_SCAN,
  55         NL80211_MCGRP_REGULATORY,
  56         NL80211_MCGRP_MLME,
  57         NL80211_MCGRP_VENDOR,
  58         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  59 };
  60
  61 static const struct genl_multicast_group nl80211_mcgrps[] = {
  62         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  63         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  64         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  65         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  66         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  67 #ifdef CONFIG_NL80211_TESTMODE
  68         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  69 #endif
  70 };
  71
  72 /* returns ERR_PTR values */
  73 static struct wireless_dev *
  74 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  75 {
  76         struct cfg80211_registered_device *rdev;
  77         struct wireless_dev *result = NULL;
  78         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  79         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  80         u64 wdev_id;
  81         int wiphy_idx = -1;
  82         int ifidx = -1;
  83
  84         ASSERT_RTNL();
  85
  86         if (!have_ifidx && !have_wdev_id)
  87                 return ERR_PTR(-EINVAL);
  88
  89         if (have_ifidx)
  90                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  91         if (have_wdev_id) {
  92                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  93                 wiphy_idx = wdev_id >> 32;
  94         }
  95
  96         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  97                 struct wireless_dev *wdev;
  98
  99                 if (wiphy_net(&rdev->wiphy) != netns)
 100                         continue;
 101
 102                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
 103                         continue;
 104
 105                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
 106                         if (have_ifidx && wdev->netdev &&
 107                             wdev->netdev->ifindex == ifidx) {
 108                                 result = wdev;
 109                                 break;
 110                         }
 111                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 112                                 result = wdev;
 113                                 break;
 114                         }
 115                 }
 116
 117                 if (result)
 118                         break;
 119         }
 120
 121         if (result)
 122                 return result;
 123         return ERR_PTR(-ENODEV);
 124 }
 125
 126 static struct cfg80211_registered_device *
 127 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 128 {
 129         struct cfg80211_registered_device *rdev = NULL, *tmp;
 130         struct net_device *netdev;
 131
 132         ASSERT_RTNL();
 133
 134         if (!attrs[NL80211_ATTR_WIPHY] &&
 135             !attrs[NL80211_ATTR_IFINDEX] &&
 136             !attrs[NL80211_ATTR_WDEV])
 137                 return ERR_PTR(-EINVAL);
 138
 139         if (attrs[NL80211_ATTR_WIPHY])
 140                 rdev = cfg80211_rdev_by_wiphy_idx(
 141                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 142
 143         if (attrs[NL80211_ATTR_WDEV]) {
 144                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 145                 struct wireless_dev *wdev;
 146                 bool found = false;
 147
 148                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 149                 if (tmp) {
 150                         /* make sure wdev exists */
 151                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 152                                 if (wdev->identifier != (u32)wdev_id)
 153                                         continue;
 154                                 found = true;
 155                                 break;
 156                         }
 157
 158                         if (!found)
 159                                 tmp = NULL;
 160
 161                         if (rdev && tmp != rdev)
 162                                 return ERR_PTR(-EINVAL);
 163                         rdev = tmp;
 164                 }
 165         }
 166
 167         if (attrs[NL80211_ATTR_IFINDEX]) {
 168                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 169                 netdev = __dev_get_by_index(netns, ifindex);
 170                 if (netdev) {
 171                         if (netdev->ieee80211_ptr)
 172                                 tmp = wiphy_to_rdev(
 173                                         netdev->ieee80211_ptr->wiphy);
 174                         else
 175                                 tmp = NULL;
 176
 177                         /* not wireless device -- return error */
 178                         if (!tmp)
 179                                 return ERR_PTR(-EINVAL);
 180
 181                         /* mismatch -- return error */
 182                         if (rdev && tmp != rdev)
 183                                 return ERR_PTR(-EINVAL);
 184
 185                         rdev = tmp;
 186                 }
 187         }
 188
 189         if (!rdev)
 190                 return ERR_PTR(-ENODEV);
 191
 192         if (netns != wiphy_net(&rdev->wiphy))
 193                 return ERR_PTR(-ENODEV);
 194
 195         return rdev;
 196 }
 197
 198 /*
 199  * This function returns a pointer to the driver
 200  * that the genl_info item that is passed refers to.
 201  *
 202  * The result of this can be a PTR_ERR and hence must
 203  * be checked with IS_ERR() for errors.
 204  */
 205 static struct cfg80211_registered_device *
 206 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 207 {
 208         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 209 }
 210
 211 /* policy for the attributes */
 212 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 213         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 214         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 215                                       .len = 20-1 },
 216         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 217
 218         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 219         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 220         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 221         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 222         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 223
 224         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 225         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 226         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 227         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 228         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 229         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 230
 231         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 232         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 233         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 234
 235         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 236         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 237
 238         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 239         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 240                                     .len = WLAN_MAX_KEY_LEN },
 241         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 242         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 243         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 244         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 245         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 246
 247         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 248         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 249         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 250                                        .len = IEEE80211_MAX_DATA_LEN },
 251         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 252                                        .len = IEEE80211_MAX_DATA_LEN },
 253         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 254         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 255         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 256         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 257                                                .len = NL80211_MAX_SUPP_RATES },
 258         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 259         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 260         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 261         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 262                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 263         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 264
 265         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 266         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 267
 268         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 269         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 270         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 271         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 272                                            .len = NL80211_MAX_SUPP_RATES },
 273         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 274
 275         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 276         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 277
 278         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 279
 280         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 281         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 282                               .len = IEEE80211_MAX_DATA_LEN },
 283         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 284         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 285
 286         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 287                                 .len = IEEE80211_MAX_SSID_LEN },
 288         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 289         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 290         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 291         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 292         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 293         [NL80211_ATTR_STA_FLAGS2] = {
 294                 .len = sizeof(struct nl80211_sta_flag_update),
 295         },
 296         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 297         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 298         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 299         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 300         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 301         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 302         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 303         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 304         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 305                                  .len = WLAN_PMKID_LEN },
 306         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 307         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 308         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 309         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 310                                  .len = IEEE80211_MAX_DATA_LEN },
 311         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 312         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 313         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 314         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 315         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 316         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 317         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 318         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 319         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 320         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 321         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 322         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 323         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 324         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 325         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 326         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 327         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 328         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 329         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 330         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 331                                          .len = IEEE80211_MAX_DATA_LEN },
 332         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 333                                          .len = IEEE80211_MAX_DATA_LEN },
 334         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 335         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 336         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 337         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 338         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 339         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 340         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 341         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 342         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 343         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 344         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 345                                       .len = IEEE80211_MAX_DATA_LEN },
 346         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 347         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 348         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 349                 .len = NL80211_HT_CAPABILITY_LEN
 350         },
 351         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 352         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 353         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 354         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 355         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 356         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 357         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 358         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 359         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 360         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 361         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 362         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 363         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 364         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 365         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 366         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 367         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 368                 .len = NL80211_VHT_CAPABILITY_LEN,
 369         },
 370         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 371         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 372                                   .len = IEEE80211_MAX_DATA_LEN },
 373         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 374         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 375         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 376         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 377         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
 378         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
 379         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 380         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 381         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 382         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 383         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 384         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 385         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 386         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 387                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 388         [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
 389         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 390         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 391         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 392         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 393         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 394         [NL80211_ATTR_TSID] = { .type = NLA_U8 },
 395         [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 },
 396         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 397         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 398         [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
 399         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 400         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 401         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 402 };
 403
 404 /* policy for the key attributes */
 405 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 406         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 407         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 408         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 409         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 410         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 411         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 412         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 413         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 414 };
 415
 416 /* policy for the key default flags */
 417 static const struct nla_policy
 418 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 419         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 420         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 421 };
 422
 423 /* policy for WoWLAN attributes */
 424 static const struct nla_policy
 425 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 426         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 427         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 428         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 429         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 430         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 431         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 432         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 433         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 434         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 435         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 436 };
 437
 438 static const struct nla_policy
 439 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 440         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 441         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 442         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 443         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 444         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 445         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 446         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 447                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 448         },
 449         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 450                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 451         },
 452         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 453         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 454         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 455 };
 456
 457 /* policy for coalesce rule attributes */
 458 static const struct nla_policy
 459 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 460         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 461         [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
 462         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 463 };
 464
 465 /* policy for GTK rekey offload attributes */
 466 static const struct nla_policy
 467 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 468         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 469         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 470         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 471 };
 472
 473 static const struct nla_policy
 474 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 475         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 476                                                  .len = IEEE80211_MAX_SSID_LEN },
 477         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 478 };
 479
 480 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 481                                      struct netlink_callback *cb,
 482                                      struct cfg80211_registered_device **rdev,
 483                                      struct wireless_dev **wdev)
 484 {
 485         int err;
 486
 487         rtnl_lock();
 488
 489         if (!cb->args[0]) {
 490                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 491                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
 492                                   nl80211_policy);
 493                 if (err)
 494                         goto out_unlock;
 495
 496                 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
 497                                                    nl80211_fam.attrbuf);
 498                 if (IS_ERR(*wdev)) {
 499                         err = PTR_ERR(*wdev);
 500                         goto out_unlock;
 501                 }
 502                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 503                 /* 0 is the first index - add 1 to parse only once */
 504                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 505                 cb->args[1] = (*wdev)->identifier;
 506         } else {
 507                 /* subtract the 1 again here */
 508                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 509                 struct wireless_dev *tmp;
 510
 511                 if (!wiphy) {
 512                         err = -ENODEV;
 513                         goto out_unlock;
 514                 }
 515                 *rdev = wiphy_to_rdev(wiphy);
 516                 *wdev = NULL;
 517
 518                 list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
 519                         if (tmp->identifier == cb->args[1]) {
 520                                 *wdev = tmp;
 521                                 break;
 522                         }
 523                 }
 524
 525                 if (!*wdev) {
 526                         err = -ENODEV;
 527                         goto out_unlock;
 528                 }
 529         }
 530
 531         return 0;
 532  out_unlock:
 533         rtnl_unlock();
 534         return err;
 535 }
 536
 537 static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
 538 {
 539         rtnl_unlock();
 540 }
 541
 542 /* IE validation */
 543 static bool is_valid_ie_attr(const struct nlattr *attr)
 544 {
 545         const u8 *pos;
 546         int len;
 547
 548         if (!attr)
 549                 return true;
 550
 551         pos = nla_data(attr);
 552         len = nla_len(attr);
 553
 554         while (len) {
 555                 u8 elemlen;
 556
 557                 if (len < 2)
 558                         return false;
 559                 len -= 2;
 560
 561                 elemlen = pos[1];
 562                 if (elemlen > len)
 563                         return false;
 564
 565                 len -= elemlen;
 566                 pos += 2 + elemlen;
 567         }
 568
 569         return true;
 570 }
 571
 572 /* message building helper */
 573 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 574                                    int flags, u8 cmd)
 575 {
 576         /* since there is no private header just add the generic one */
 577         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 578 }
 579
 580 static int nl80211_msg_put_channel(struct sk_buff *msg,
 581                                    struct ieee80211_channel *chan,
 582                                    bool large)
 583 {
 584         /* Some channels must be completely excluded from the
 585          * list to protect old user-space tools from breaking
 586          */
 587         if (!large && chan->flags &
 588             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 589                 return 0;
 590
 591         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 592                         chan->center_freq))
 593                 goto nla_put_failure;
 594
 595         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 596             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 597                 goto nla_put_failure;
 598         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 599                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 600                         goto nla_put_failure;
 601                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 602                         goto nla_put_failure;
 603         }
 604         if (chan->flags & IEEE80211_CHAN_RADAR) {
 605                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 606                         goto nla_put_failure;
 607                 if (large) {
 608                         u32 time;
 609
 610                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 611
 612                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 613                                         chan->dfs_state))
 614                                 goto nla_put_failure;
 615                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 616                                         time))
 617                                 goto nla_put_failure;
 618                         if (nla_put_u32(msg,
 619                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 620                                         chan->dfs_cac_ms))
 621                                 goto nla_put_failure;
 622                 }
 623         }
 624
 625         if (large) {
 626                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 627                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 628                         goto nla_put_failure;
 629                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 630                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 631                         goto nla_put_failure;
 632                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 633                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 634                         goto nla_put_failure;
 635                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 636                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 637                         goto nla_put_failure;
 638                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 639                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 640                         goto nla_put_failure;
 641                 if ((chan->flags & IEEE80211_CHAN_GO_CONCURRENT) &&
 642                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_GO_CONCURRENT))
 643                         goto nla_put_failure;
 644                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 645                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 646                         goto nla_put_failure;
 647                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 648                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 649                         goto nla_put_failure;
 650         }
 651
 652         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 653                         DBM_TO_MBM(chan->max_power)))
 654                 goto nla_put_failure;
 655
 656         return 0;
 657
 658  nla_put_failure:
 659         return -ENOBUFS;
 660 }
 661
 662 /* netlink command implementations */
 663
 664 struct key_parse {
 665         struct key_params p;
 666         int idx;
 667         int type;
 668         bool def, defmgmt;
 669         bool def_uni, def_multi;
 670 };
 671
 672 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 673 {
 674         struct nlattr *tb[NL80211_KEY_MAX + 1];
 675         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 676                                    nl80211_key_policy);
 677         if (err)
 678                 return err;
 679
 680         k->def = !!tb[NL80211_KEY_DEFAULT];
 681         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 682
 683         if (k->def) {
 684                 k->def_uni = true;
 685                 k->def_multi = true;
 686         }
 687         if (k->defmgmt)
 688                 k->def_multi = true;
 689
 690         if (tb[NL80211_KEY_IDX])
 691                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 692
 693         if (tb[NL80211_KEY_DATA]) {
 694                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 695                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 696         }
 697
 698         if (tb[NL80211_KEY_SEQ]) {
 699                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 700                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 701         }
 702
 703         if (tb[NL80211_KEY_CIPHER])
 704                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 705
 706         if (tb[NL80211_KEY_TYPE]) {
 707                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 708                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 709                         return -EINVAL;
 710         }
 711
 712         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 713                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 714                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 715                                        tb[NL80211_KEY_DEFAULT_TYPES],
 716                                        nl80211_key_default_policy);
 717                 if (err)
 718                         return err;
 719
 720                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 721                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 722         }
 723
 724         return 0;
 725 }
 726
 727 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 728 {
 729         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 730                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 731                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 732         }
 733
 734         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 735                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 736                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 737         }
 738
 739         if (info->attrs[NL80211_ATTR_KEY_IDX])
 740                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 741
 742         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 743                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 744
 745         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 746         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 747
 748         if (k->def) {
 749                 k->def_uni = true;
 750                 k->def_multi = true;
 751         }
 752         if (k->defmgmt)
 753                 k->def_multi = true;
 754
 755         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 756                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 757                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 758                         return -EINVAL;
 759         }
 760
 761         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 762                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 763                 int err = nla_parse_nested(
 764                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 765                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 766                                 nl80211_key_default_policy);
 767                 if (err)
 768                         return err;
 769
 770                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 771                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 772         }
 773
 774         return 0;
 775 }
 776
 777 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 778 {
 779         int err;
 780
 781         memset(k, 0, sizeof(*k));
 782         k->idx = -1;
 783         k->type = -1;
 784
 785         if (info->attrs[NL80211_ATTR_KEY])
 786                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 787         else
 788                 err = nl80211_parse_key_old(info, k);
 789
 790         if (err)
 791                 return err;
 792
 793         if (k->def && k->defmgmt)
 794                 return -EINVAL;
 795
 796         if (k->defmgmt) {
 797                 if (k->def_uni || !k->def_multi)
 798                         return -EINVAL;
 799         }
 800
 801         if (k->idx != -1) {
 802                 if (k->defmgmt) {
 803                         if (k->idx < 4 || k->idx > 5)
 804                                 return -EINVAL;
 805                 } else if (k->def) {
 806                         if (k->idx < 0 || k->idx > 3)
 807                                 return -EINVAL;
 808                 } else {
 809                         if (k->idx < 0 || k->idx > 5)
 810                                 return -EINVAL;
 811                 }
 812         }
 813
 814         return 0;
 815 }
 816
 817 static struct cfg80211_cached_keys *
 818 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 819                        struct nlattr *keys, bool *no_ht)
 820 {
 821         struct key_parse parse;
 822         struct nlattr *key;
 823         struct cfg80211_cached_keys *result;
 824         int rem, err, def = 0;
 825
 826         result = kzalloc(sizeof(*result), GFP_KERNEL);
 827         if (!result)
 828                 return ERR_PTR(-ENOMEM);
 829
 830         result->def = -1;
 831         result->defmgmt = -1;
 832
 833         nla_for_each_nested(key, keys, rem) {
 834                 memset(&parse, 0, sizeof(parse));
 835                 parse.idx = -1;
 836
 837                 err = nl80211_parse_key_new(key, &parse);
 838                 if (err)
 839                         goto error;
 840                 err = -EINVAL;
 841                 if (!parse.p.key)
 842                         goto error;
 843                 if (parse.idx < 0 || parse.idx > 4)
 844                         goto error;
 845                 if (parse.def) {
 846                         if (def)
 847                                 goto error;
 848                         def = 1;
 849                         result->def = parse.idx;
 850                         if (!parse.def_uni || !parse.def_multi)
 851                                 goto error;
 852                 } else if (parse.defmgmt)
 853                         goto error;
 854                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 855                                                      parse.idx, false, NULL);
 856                 if (err)
 857                         goto error;
 858                 result->params[parse.idx].cipher = parse.p.cipher;
 859                 result->params[parse.idx].key_len = parse.p.key_len;
 860                 result->params[parse.idx].key = result->data[parse.idx];
 861                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 862
 863                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 864                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 865                         if (no_ht)
 866                                 *no_ht = true;
 867                 }
 868         }
 869
 870         return result;
 871  error:
 872         kfree(result);
 873         return ERR_PTR(err);
 874 }
 875
 876 static int nl80211_key_allowed(struct wireless_dev *wdev)
 877 {
 878         ASSERT_WDEV_LOCK(wdev);
 879
 880         switch (wdev->iftype) {
 881         case NL80211_IFTYPE_AP:
 882         case NL80211_IFTYPE_AP_VLAN:
 883         case NL80211_IFTYPE_P2P_GO:
 884         case NL80211_IFTYPE_MESH_POINT:
 885                 break;
 886         case NL80211_IFTYPE_ADHOC:
 887         case NL80211_IFTYPE_STATION:
 888         case NL80211_IFTYPE_P2P_CLIENT:
 889                 if (!wdev->current_bss)
 890                         return -ENOLINK;
 891                 break;
 892         case NL80211_IFTYPE_UNSPECIFIED:
 893         case NL80211_IFTYPE_OCB:
 894         case NL80211_IFTYPE_MONITOR:
 895         case NL80211_IFTYPE_P2P_DEVICE:
 896         case NL80211_IFTYPE_WDS:
 897         case NUM_NL80211_IFTYPES:
 898                 return -EINVAL;
 899         }
 900
 901         return 0;
 902 }
 903
 904 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
 905                                                         struct nlattr *tb)
 906 {
 907         struct ieee80211_channel *chan;
 908
 909         if (tb == NULL)
 910                 return NULL;
 911         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
 912         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 913                 return NULL;
 914         return chan;
 915 }
 916
 917 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 918 {
 919         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 920         int i;
 921
 922         if (!nl_modes)
 923                 goto nla_put_failure;
 924
 925         i = 0;
 926         while (ifmodes) {
 927                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 928                         goto nla_put_failure;
 929                 ifmodes >>= 1;
 930                 i++;
 931         }
 932
 933         nla_nest_end(msg, nl_modes);
 934         return 0;
 935
 936 nla_put_failure:
 937         return -ENOBUFS;
 938 }
 939
 940 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 941                                           struct sk_buff *msg,
 942                                           bool large)
 943 {
 944         struct nlattr *nl_combis;
 945         int i, j;
 946
 947         nl_combis = nla_nest_start(msg,
 948                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 949         if (!nl_combis)
 950                 goto nla_put_failure;
 951
 952         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 953                 const struct ieee80211_iface_combination *c;
 954                 struct nlattr *nl_combi, *nl_limits;
 955
 956                 c = &wiphy->iface_combinations[i];
 957
 958                 nl_combi = nla_nest_start(msg, i + 1);
 959                 if (!nl_combi)
 960                         goto nla_put_failure;
 961
 962                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 963                 if (!nl_limits)
 964                         goto nla_put_failure;
 965
 966                 for (j = 0; j < c->n_limits; j++) {
 967                         struct nlattr *nl_limit;
 968
 969                         nl_limit = nla_nest_start(msg, j + 1);
 970                         if (!nl_limit)
 971                                 goto nla_put_failure;
 972                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 973                                         c->limits[j].max))
 974                                 goto nla_put_failure;
 975                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 976                                                 c->limits[j].types))
 977                                 goto nla_put_failure;
 978                         nla_nest_end(msg, nl_limit);
 979                 }
 980
 981                 nla_nest_end(msg, nl_limits);
 982
 983                 if (c->beacon_int_infra_match &&
 984                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 985                         goto nla_put_failure;
 986                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 987                                 c->num_different_channels) ||
 988                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 989                                 c->max_interfaces))
 990                         goto nla_put_failure;
 991                 if (large &&
 992                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
 993                                 c->radar_detect_widths) ||
 994                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
 995                                 c->radar_detect_regions)))
 996                         goto nla_put_failure;
 997
 998                 nla_nest_end(msg, nl_combi);
 999         }
1000
1001         nla_nest_end(msg, nl_combis);
1002
1003         return 0;
1004 nla_put_failure:
1005         return -ENOBUFS;
1006 }
1007
1008 #ifdef CONFIG_PM
1009 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1010                                         struct sk_buff *msg)
1011 {
1012         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1013         struct nlattr *nl_tcp;
1014
1015         if (!tcp)
1016                 return 0;
1017
1018         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1019         if (!nl_tcp)
1020                 return -ENOBUFS;
1021
1022         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1023                         tcp->data_payload_max))
1024                 return -ENOBUFS;
1025
1026         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1027                         tcp->data_payload_max))
1028                 return -ENOBUFS;
1029
1030         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1031                 return -ENOBUFS;
1032
1033         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1034                                 sizeof(*tcp->tok), tcp->tok))
1035                 return -ENOBUFS;
1036
1037         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1038                         tcp->data_interval_max))
1039                 return -ENOBUFS;
1040
1041         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1042                         tcp->wake_payload_max))
1043                 return -ENOBUFS;
1044
1045         nla_nest_end(msg, nl_tcp);
1046         return 0;
1047 }
1048
1049 static int nl80211_send_wowlan(struct sk_buff *msg,
1050                                struct cfg80211_registered_device *rdev,
1051                                bool large)
1052 {
1053         struct nlattr *nl_wowlan;
1054
1055         if (!rdev->wiphy.wowlan)
1056                 return 0;
1057
1058         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1059         if (!nl_wowlan)
1060                 return -ENOBUFS;
1061
1062         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1063              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1064             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1065              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1066             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1067              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1068             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1069              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1070             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1071              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1072             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1073              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1074             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1075              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1076             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1077              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1078                 return -ENOBUFS;
1079
1080         if (rdev->wiphy.wowlan->n_patterns) {
1081                 struct nl80211_pattern_support pat = {
1082                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1083                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1084                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1085                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1086                 };
1087
1088                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1089                             sizeof(pat), &pat))
1090                         return -ENOBUFS;
1091         }
1092
1093         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1094             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1095                         rdev->wiphy.wowlan->max_nd_match_sets))
1096                 return -ENOBUFS;
1097
1098         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1099                 return -ENOBUFS;
1100
1101         /* TODO: send wowlan net detect */
1102
1103         nla_nest_end(msg, nl_wowlan);
1104
1105         return 0;
1106 }
1107 #endif
1108
1109 static int nl80211_send_coalesce(struct sk_buff *msg,
1110                                  struct cfg80211_registered_device *rdev)
1111 {
1112         struct nl80211_coalesce_rule_support rule;
1113
1114         if (!rdev->wiphy.coalesce)
1115                 return 0;
1116
1117         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1118         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1119         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1120         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1121         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1122         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1123
1124         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1125                 return -ENOBUFS;
1126
1127         return 0;
1128 }
1129
1130 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1131                                       struct ieee80211_supported_band *sband)
1132 {
1133         struct nlattr *nl_rates, *nl_rate;
1134         struct ieee80211_rate *rate;
1135         int i;
1136
1137         /* add HT info */
1138         if (sband->ht_cap.ht_supported &&
1139             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1140                      sizeof(sband->ht_cap.mcs),
1141                      &sband->ht_cap.mcs) ||
1142              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1143                          sband->ht_cap.cap) ||
1144              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1145                         sband->ht_cap.ampdu_factor) ||
1146              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1147                         sband->ht_cap.ampdu_density)))
1148                 return -ENOBUFS;
1149
1150         /* add VHT info */
1151         if (sband->vht_cap.vht_supported &&
1152             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1153                      sizeof(sband->vht_cap.vht_mcs),
1154                      &sband->vht_cap.vht_mcs) ||
1155              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1156                          sband->vht_cap.cap)))
1157                 return -ENOBUFS;
1158
1159         /* add bitrates */
1160         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1161         if (!nl_rates)
1162                 return -ENOBUFS;
1163
1164         for (i = 0; i < sband->n_bitrates; i++) {
1165                 nl_rate = nla_nest_start(msg, i);
1166                 if (!nl_rate)
1167                         return -ENOBUFS;
1168
1169                 rate = &sband->bitrates[i];
1170                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1171                                 rate->bitrate))
1172                         return -ENOBUFS;
1173                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1174                     nla_put_flag(msg,
1175                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1176                         return -ENOBUFS;
1177
1178                 nla_nest_end(msg, nl_rate);
1179         }
1180
1181         nla_nest_end(msg, nl_rates);
1182
1183         return 0;
1184 }
1185
1186 static int
1187 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1188                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1189 {
1190         u16 stypes;
1191         struct nlattr *nl_ftypes, *nl_ifs;
1192         enum nl80211_iftype ift;
1193         int i;
1194
1195         if (!mgmt_stypes)
1196                 return 0;
1197
1198         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1199         if (!nl_ifs)
1200                 return -ENOBUFS;
1201
1202         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1203                 nl_ftypes = nla_nest_start(msg, ift);
1204                 if (!nl_ftypes)
1205                         return -ENOBUFS;
1206                 i = 0;
1207                 stypes = mgmt_stypes[ift].tx;
1208                 while (stypes) {
1209                         if ((stypes & 1) &&
1210                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1211                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1212                                 return -ENOBUFS;
1213                         stypes >>= 1;
1214                         i++;
1215                 }
1216                 nla_nest_end(msg, nl_ftypes);
1217         }
1218
1219         nla_nest_end(msg, nl_ifs);
1220
1221         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1222         if (!nl_ifs)
1223                 return -ENOBUFS;
1224
1225         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1226                 nl_ftypes = nla_nest_start(msg, ift);
1227                 if (!nl_ftypes)
1228                         return -ENOBUFS;
1229                 i = 0;
1230                 stypes = mgmt_stypes[ift].rx;
1231                 while (stypes) {
1232                         if ((stypes & 1) &&
1233                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1234                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1235                                 return -ENOBUFS;
1236                         stypes >>= 1;
1237                         i++;
1238                 }
1239                 nla_nest_end(msg, nl_ftypes);
1240         }
1241         nla_nest_end(msg, nl_ifs);
1242
1243         return 0;
1244 }
1245
1246 struct nl80211_dump_wiphy_state {
1247         s64 filter_wiphy;
1248         long start;
1249         long split_start, band_start, chan_start;
1250         bool split;
1251 };
1252
1253 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1254                               enum nl80211_commands cmd,
1255                               struct sk_buff *msg, u32 portid, u32 seq,
1256                               int flags, struct nl80211_dump_wiphy_state *state)
1257 {
1258         void *hdr;
1259         struct nlattr *nl_bands, *nl_band;
1260         struct nlattr *nl_freqs, *nl_freq;
1261         struct nlattr *nl_cmds;
1262         enum ieee80211_band band;
1263         struct ieee80211_channel *chan;
1264         int i;
1265         const struct ieee80211_txrx_stypes *mgmt_stypes =
1266                                 rdev->wiphy.mgmt_stypes;
1267         u32 features;
1268
1269         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1270         if (!hdr)
1271                 return -ENOBUFS;
1272
1273         if (WARN_ON(!state))
1274                 return -EINVAL;
1275
1276         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1277             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1278                            wiphy_name(&rdev->wiphy)) ||
1279             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1280                         cfg80211_rdev_list_generation))
1281                 goto nla_put_failure;
1282
1283         if (cmd != NL80211_CMD_NEW_WIPHY)
1284                 goto finish;
1285
1286         switch (state->split_start) {
1287         case 0:
1288                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1289                                rdev->wiphy.retry_short) ||
1290                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1291                                rdev->wiphy.retry_long) ||
1292                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1293                                 rdev->wiphy.frag_threshold) ||
1294                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1295                                 rdev->wiphy.rts_threshold) ||
1296                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1297                                rdev->wiphy.coverage_class) ||
1298                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1299                                rdev->wiphy.max_scan_ssids) ||
1300                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1301                                rdev->wiphy.max_sched_scan_ssids) ||
1302                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1303                                 rdev->wiphy.max_scan_ie_len) ||
1304                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1305                                 rdev->wiphy.max_sched_scan_ie_len) ||
1306                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1307                                rdev->wiphy.max_match_sets))
1308                         goto nla_put_failure;
1309
1310                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1311                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1312                         goto nla_put_failure;
1313                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1314                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1315                         goto nla_put_failure;
1316                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1317                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1318                         goto nla_put_failure;
1319                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1320                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1321                         goto nla_put_failure;
1322                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1323                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1324                         goto nla_put_failure;
1325                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1326                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1327                         goto nla_put_failure;
1328                 state->split_start++;
1329                 if (state->split)
1330                         break;
1331         case 1:
1332                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1333                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1334                             rdev->wiphy.cipher_suites))
1335                         goto nla_put_failure;
1336
1337                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1338                                rdev->wiphy.max_num_pmkids))
1339                         goto nla_put_failure;
1340
1341                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1342                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1343                         goto nla_put_failure;
1344
1345                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1346                                 rdev->wiphy.available_antennas_tx) ||
1347                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1348                                 rdev->wiphy.available_antennas_rx))
1349                         goto nla_put_failure;
1350
1351                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1352                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1353                                 rdev->wiphy.probe_resp_offload))
1354                         goto nla_put_failure;
1355
1356                 if ((rdev->wiphy.available_antennas_tx ||
1357                      rdev->wiphy.available_antennas_rx) &&
1358                     rdev->ops->get_antenna) {
1359                         u32 tx_ant = 0, rx_ant = 0;
1360                         int res;
1361                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1362                         if (!res) {
1363                                 if (nla_put_u32(msg,
1364                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1365                                                 tx_ant) ||
1366                                     nla_put_u32(msg,
1367                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1368                                                 rx_ant))
1369                                         goto nla_put_failure;
1370                         }
1371                 }
1372
1373                 state->split_start++;
1374                 if (state->split)
1375                         break;
1376         case 2:
1377                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1378                                         rdev->wiphy.interface_modes))
1379                                 goto nla_put_failure;
1380                 state->split_start++;
1381                 if (state->split)
1382                         break;
1383         case 3:
1384                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1385                 if (!nl_bands)
1386                         goto nla_put_failure;
1387
1388                 for (band = state->band_start;
1389                      band < IEEE80211_NUM_BANDS; band++) {
1390                         struct ieee80211_supported_band *sband;
1391
1392                         sband = rdev->wiphy.bands[band];
1393
1394                         if (!sband)
1395                                 continue;
1396
1397                         nl_band = nla_nest_start(msg, band);
1398                         if (!nl_band)
1399                                 goto nla_put_failure;
1400
1401                         switch (state->chan_start) {
1402                         case 0:
1403                                 if (nl80211_send_band_rateinfo(msg, sband))
1404                                         goto nla_put_failure;
1405                                 state->chan_start++;
1406                                 if (state->split)
1407                                         break;
1408                         default:
1409                                 /* add frequencies */
1410                                 nl_freqs = nla_nest_start(
1411                                         msg, NL80211_BAND_ATTR_FREQS);
1412                                 if (!nl_freqs)
1413                                         goto nla_put_failure;
1414
1415                                 for (i = state->chan_start - 1;
1416                                      i < sband->n_channels;
1417                                      i++) {
1418                                         nl_freq = nla_nest_start(msg, i);
1419                                         if (!nl_freq)
1420                                                 goto nla_put_failure;
1421
1422                                         chan = &sband->channels[i];
1423
1424                                         if (nl80211_msg_put_channel(
1425                                                         msg, chan,
1426                                                         state->split))
1427                                                 goto nla_put_failure;
1428
1429                                         nla_nest_end(msg, nl_freq);
1430                                         if (state->split)
1431                                                 break;
1432                                 }
1433                                 if (i < sband->n_channels)
1434                                         state->chan_start = i + 2;
1435                                 else
1436                                         state->chan_start = 0;
1437                                 nla_nest_end(msg, nl_freqs);
1438                         }
1439
1440                         nla_nest_end(msg, nl_band);
1441
1442                         if (state->split) {
1443                                 /* start again here */
1444                                 if (state->chan_start)
1445                                         band--;
1446                                 break;
1447                         }
1448                 }
1449                 nla_nest_end(msg, nl_bands);
1450
1451                 if (band < IEEE80211_NUM_BANDS)
1452                         state->band_start = band + 1;
1453                 else
1454                         state->band_start = 0;
1455
1456                 /* if bands & channels are done, continue outside */
1457                 if (state->band_start == 0 && state->chan_start == 0)
1458                         state->split_start++;
1459                 if (state->split)
1460                         break;
1461         case 4:
1462                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1463                 if (!nl_cmds)
1464                         goto nla_put_failure;
1465
1466                 i = 0;
1467 #define CMD(op, n)                                                      \
1468                  do {                                                   \
1469                         if (rdev->ops->op) {                            \
1470                                 i++;                                    \
1471                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1472                                         goto nla_put_failure;           \
1473                         }                                               \
1474                 } while (0)
1475
1476                 CMD(add_virtual_intf, NEW_INTERFACE);
1477                 CMD(change_virtual_intf, SET_INTERFACE);
1478                 CMD(add_key, NEW_KEY);
1479                 CMD(start_ap, START_AP);
1480                 CMD(add_station, NEW_STATION);
1481                 CMD(add_mpath, NEW_MPATH);
1482                 CMD(update_mesh_config, SET_MESH_CONFIG);
1483                 CMD(change_bss, SET_BSS);
1484                 CMD(auth, AUTHENTICATE);
1485                 CMD(assoc, ASSOCIATE);
1486                 CMD(deauth, DEAUTHENTICATE);
1487                 CMD(disassoc, DISASSOCIATE);
1488                 CMD(join_ibss, JOIN_IBSS);
1489                 CMD(join_mesh, JOIN_MESH);
1490                 CMD(set_pmksa, SET_PMKSA);
1491                 CMD(del_pmksa, DEL_PMKSA);
1492                 CMD(flush_pmksa, FLUSH_PMKSA);
1493                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1494                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1495                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1496                 CMD(mgmt_tx, FRAME);
1497                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1498                 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1499                         i++;
1500                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1501                                 goto nla_put_failure;
1502                 }
1503                 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1504                     rdev->ops->join_mesh) {
1505                         i++;
1506                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1507                                 goto nla_put_failure;
1508                 }
1509                 CMD(set_wds_peer, SET_WDS_PEER);
1510                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1511                         CMD(tdls_mgmt, TDLS_MGMT);
1512                         CMD(tdls_oper, TDLS_OPER);
1513                 }
1514                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1515                         CMD(sched_scan_start, START_SCHED_SCAN);
1516                 CMD(probe_client, PROBE_CLIENT);
1517                 CMD(set_noack_map, SET_NOACK_MAP);
1518                 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1519                         i++;
1520                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1521                                 goto nla_put_failure;
1522                 }
1523                 CMD(start_p2p_device, START_P2P_DEVICE);
1524                 CMD(set_mcast_rate, SET_MCAST_RATE);
1525 #ifdef CONFIG_NL80211_TESTMODE
1526                 CMD(testmode_cmd, TESTMODE);
1527 #endif
1528                 if (state->split) {
1529                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1530                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1531                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1532                                 CMD(channel_switch, CHANNEL_SWITCH);
1533                         CMD(set_qos_map, SET_QOS_MAP);
1534                         if (rdev->wiphy.features &
1535                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
1536                                 CMD(add_tx_ts, ADD_TX_TS);
1537                 }
1538                 /* add into the if now */
1539 #undef CMD
1540
1541                 if (rdev->ops->connect || rdev->ops->auth) {
1542                         i++;
1543                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1544                                 goto nla_put_failure;
1545                 }
1546
1547                 if (rdev->ops->disconnect || rdev->ops->deauth) {
1548                         i++;
1549                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1550                                 goto nla_put_failure;
1551                 }
1552
1553                 nla_nest_end(msg, nl_cmds);
1554                 state->split_start++;
1555                 if (state->split)
1556                         break;
1557         case 5:
1558                 if (rdev->ops->remain_on_channel &&
1559                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1560                     nla_put_u32(msg,
1561                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1562                                 rdev->wiphy.max_remain_on_channel_duration))
1563                         goto nla_put_failure;
1564
1565                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1566                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1567                         goto nla_put_failure;
1568
1569                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1570                         goto nla_put_failure;
1571                 state->split_start++;
1572                 if (state->split)
1573                         break;
1574         case 6:
1575 #ifdef CONFIG_PM
1576                 if (nl80211_send_wowlan(msg, rdev, state->split))
1577                         goto nla_put_failure;
1578                 state->split_start++;
1579                 if (state->split)
1580                         break;
1581 #else
1582                 state->split_start++;
1583 #endif
1584         case 7:
1585                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1586                                         rdev->wiphy.software_iftypes))
1587                         goto nla_put_failure;
1588
1589                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1590                                                    state->split))
1591                         goto nla_put_failure;
1592
1593                 state->split_start++;
1594                 if (state->split)
1595                         break;
1596         case 8:
1597                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1598                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1599                                 rdev->wiphy.ap_sme_capa))
1600                         goto nla_put_failure;
1601
1602                 features = rdev->wiphy.features;
1603                 /*
1604                  * We can only add the per-channel limit information if the
1605                  * dump is split, otherwise it makes it too big. Therefore
1606                  * only advertise it in that case.
1607                  */
1608                 if (state->split)
1609                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1610                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1611                         goto nla_put_failure;
1612
1613                 if (rdev->wiphy.ht_capa_mod_mask &&
1614                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1615                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
1616                             rdev->wiphy.ht_capa_mod_mask))
1617                         goto nla_put_failure;
1618
1619                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1620                     rdev->wiphy.max_acl_mac_addrs &&
1621                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1622                                 rdev->wiphy.max_acl_mac_addrs))
1623                         goto nla_put_failure;
1624
1625                 /*
1626                  * Any information below this point is only available to
1627                  * applications that can deal with it being split. This
1628                  * helps ensure that newly added capabilities don't break
1629                  * older tools by overrunning their buffers.
1630                  *
1631                  * We still increment split_start so that in the split
1632                  * case we'll continue with more data in the next round,
1633                  * but break unconditionally so unsplit data stops here.
1634                  */
1635                 state->split_start++;
1636                 break;
1637         case 9:
1638                 if (rdev->wiphy.extended_capabilities &&
1639                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1640                              rdev->wiphy.extended_capabilities_len,
1641                              rdev->wiphy.extended_capabilities) ||
1642                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1643                              rdev->wiphy.extended_capabilities_len,
1644                              rdev->wiphy.extended_capabilities_mask)))
1645                         goto nla_put_failure;
1646
1647                 if (rdev->wiphy.vht_capa_mod_mask &&
1648                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1649                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
1650                             rdev->wiphy.vht_capa_mod_mask))
1651                         goto nla_put_failure;
1652
1653                 state->split_start++;
1654                 break;
1655         case 10:
1656                 if (nl80211_send_coalesce(msg, rdev))
1657                         goto nla_put_failure;
1658
1659                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1660                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1661                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1662                         goto nla_put_failure;
1663
1664                 if (rdev->wiphy.max_ap_assoc_sta &&
1665                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1666                                 rdev->wiphy.max_ap_assoc_sta))
1667                         goto nla_put_failure;
1668
1669                 state->split_start++;
1670                 break;
1671         case 11:
1672                 if (rdev->wiphy.n_vendor_commands) {
1673                         const struct nl80211_vendor_cmd_info *info;
1674                         struct nlattr *nested;
1675
1676                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1677                         if (!nested)
1678                                 goto nla_put_failure;
1679
1680                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1681                                 info = &rdev->wiphy.vendor_commands[i].info;
1682                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1683                                         goto nla_put_failure;
1684                         }
1685                         nla_nest_end(msg, nested);
1686                 }
1687
1688                 if (rdev->wiphy.n_vendor_events) {
1689                         const struct nl80211_vendor_cmd_info *info;
1690                         struct nlattr *nested;
1691
1692                         nested = nla_nest_start(msg,
1693                                                 NL80211_ATTR_VENDOR_EVENTS);
1694                         if (!nested)
1695                                 goto nla_put_failure;
1696
1697                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
1698                                 info = &rdev->wiphy.vendor_events[i];
1699                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1700                                         goto nla_put_failure;
1701                         }
1702                         nla_nest_end(msg, nested);
1703                 }
1704                 state->split_start++;
1705                 break;
1706         case 12:
1707                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
1708                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
1709                                rdev->wiphy.max_num_csa_counters))
1710                         goto nla_put_failure;
1711
1712                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
1713                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
1714                         goto nla_put_failure;
1715
1716                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
1717                             sizeof(rdev->wiphy.ext_features),
1718                             rdev->wiphy.ext_features))
1719                         goto nla_put_failure;
1720
1721                 /* done */
1722                 state->split_start = 0;
1723                 break;
1724         }
1725  finish:
1726         genlmsg_end(msg, hdr);
1727         return 0;
1728
1729  nla_put_failure:
1730         genlmsg_cancel(msg, hdr);
1731         return -EMSGSIZE;
1732 }
1733
1734 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1735                                     struct netlink_callback *cb,
1736                                     struct nl80211_dump_wiphy_state *state)
1737 {
1738         struct nlattr **tb = nl80211_fam.attrbuf;
1739         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1740                               tb, nl80211_fam.maxattr, nl80211_policy);
1741         /* ignore parse errors for backward compatibility */
1742         if (ret)
1743                 return 0;
1744
1745         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1746         if (tb[NL80211_ATTR_WIPHY])
1747                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1748         if (tb[NL80211_ATTR_WDEV])
1749                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1750         if (tb[NL80211_ATTR_IFINDEX]) {
1751                 struct net_device *netdev;
1752                 struct cfg80211_registered_device *rdev;
1753                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1754
1755                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1756                 if (!netdev)
1757                         return -ENODEV;
1758                 if (netdev->ieee80211_ptr) {
1759                         rdev = wiphy_to_rdev(
1760                                 netdev->ieee80211_ptr->wiphy);
1761                         state->filter_wiphy = rdev->wiphy_idx;
1762                 }
1763         }
1764
1765         return 0;
1766 }
1767
1768 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1769 {
1770         int idx = 0, ret;
1771         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1772         struct cfg80211_registered_device *rdev;
1773
1774         rtnl_lock();
1775         if (!state) {
1776                 state = kzalloc(sizeof(*state), GFP_KERNEL);
1777                 if (!state) {
1778                         rtnl_unlock();
1779                         return -ENOMEM;
1780                 }
1781                 state->filter_wiphy = -1;
1782                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1783                 if (ret) {
1784                         kfree(state);
1785                         rtnl_unlock();
1786                         return ret;
1787                 }
1788                 cb->args[0] = (long)state;
1789         }
1790
1791         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1792                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1793                         continue;
1794                 if (++idx <= state->start)
1795                         continue;
1796                 if (state->filter_wiphy != -1 &&
1797                     state->filter_wiphy != rdev->wiphy_idx)
1798                         continue;
1799                 /* attempt to fit multiple wiphy data chunks into the skb */
1800                 do {
1801                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
1802                                                  skb,
1803                                                  NETLINK_CB(cb->skb).portid,
1804                                                  cb->nlh->nlmsg_seq,
1805                                                  NLM_F_MULTI, state);
1806                         if (ret < 0) {
1807                                 /*
1808                                  * If sending the wiphy data didn't fit (ENOBUFS
1809                                  * or EMSGSIZE returned), this SKB is still
1810                                  * empty (so it's not too big because another
1811                                  * wiphy dataset is already in the skb) and
1812                                  * we've not tried to adjust the dump allocation
1813                                  * yet ... then adjust the alloc size to be
1814                                  * bigger, and return 1 but with the empty skb.
1815                                  * This results in an empty message being RX'ed
1816                                  * in userspace, but that is ignored.
1817                                  *
1818                                  * We can then retry with the larger buffer.
1819                                  */
1820                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1821                                     !skb->len && !state->split &&
1822                                     cb->min_dump_alloc < 4096) {
1823                                         cb->min_dump_alloc = 4096;
1824                                         state->split_start = 0;
1825                                         rtnl_unlock();
1826                                         return 1;
1827                                 }
1828                                 idx--;
1829                                 break;
1830                         }
1831                 } while (state->split_start > 0);
1832                 break;
1833         }
1834         rtnl_unlock();
1835
1836         state->start = idx;
1837
1838         return skb->len;
1839 }
1840
1841 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
1842 {
1843         kfree((void *)cb->args[0]);
1844         return 0;
1845 }
1846
1847 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1848 {
1849         struct sk_buff *msg;
1850         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1851         struct nl80211_dump_wiphy_state state = {};
1852
1853         msg = nlmsg_new(4096, GFP_KERNEL);
1854         if (!msg)
1855                 return -ENOMEM;
1856
1857         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
1858                                info->snd_portid, info->snd_seq, 0,
1859                                &state) < 0) {
1860                 nlmsg_free(msg);
1861                 return -ENOBUFS;
1862         }
1863
1864         return genlmsg_reply(msg, info);
1865 }
1866
1867 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1868         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1869         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1870         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1871         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1872         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1873 };
1874
1875 static int parse_txq_params(struct nlattr *tb[],
1876                             struct ieee80211_txq_params *txq_params)
1877 {
1878         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1879             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1880             !tb[NL80211_TXQ_ATTR_AIFS])
1881                 return -EINVAL;
1882
1883         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1884         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1885         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1886         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1887         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1888
1889         if (txq_params->ac >= NL80211_NUM_ACS)
1890                 return -EINVAL;
1891
1892         return 0;
1893 }
1894
1895 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1896 {
1897         /*
1898          * You can only set the channel explicitly for WDS interfaces,
1899          * all others have their channel managed via their respective
1900          * "establish a connection" command (connect, join, ...)
1901          *
1902          * For AP/GO and mesh mode, the channel can be set with the
1903          * channel userspace API, but is only stored and passed to the
1904          * low-level driver when the AP starts or the mesh is joined.
1905          * This is for backward compatibility, userspace can also give
1906          * the channel in the start-ap or join-mesh commands instead.
1907          *
1908          * Monitors are special as they are normally slaved to
1909          * whatever else is going on, so they have their own special
1910          * operation to set the monitor channel if possible.
1911          */
1912         return !wdev ||
1913                 wdev->iftype == NL80211_IFTYPE_AP ||
1914                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1915                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1916                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1917 }
1918
1919 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1920                                  struct genl_info *info,
1921                                  struct cfg80211_chan_def *chandef)
1922 {
1923         u32 control_freq;
1924
1925         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1926                 return -EINVAL;
1927
1928         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1929
1930         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1931         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1932         chandef->center_freq1 = control_freq;
1933         chandef->center_freq2 = 0;
1934
1935         /* Primary channel not allowed */
1936         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1937                 return -EINVAL;
1938
1939         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1940                 enum nl80211_channel_type chantype;
1941
1942                 chantype = nla_get_u32(
1943                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1944
1945                 switch (chantype) {
1946                 case NL80211_CHAN_NO_HT:
1947                 case NL80211_CHAN_HT20:
1948                 case NL80211_CHAN_HT40PLUS:
1949                 case NL80211_CHAN_HT40MINUS:
1950                         cfg80211_chandef_create(chandef, chandef->chan,
1951                                                 chantype);
1952                         break;
1953                 default:
1954                         return -EINVAL;
1955                 }
1956         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1957                 chandef->width =
1958                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1959                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1960                         chandef->center_freq1 =
1961                                 nla_get_u32(
1962                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1963                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1964                         chandef->center_freq2 =
1965                                 nla_get_u32(
1966                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1967         }
1968
1969         if (!cfg80211_chandef_valid(chandef))
1970                 return -EINVAL;
1971
1972         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1973                                      IEEE80211_CHAN_DISABLED))
1974                 return -EINVAL;
1975
1976         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
1977              chandef->width == NL80211_CHAN_WIDTH_10) &&
1978             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
1979                 return -EINVAL;
1980
1981         return 0;
1982 }
1983
1984 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1985                                  struct net_device *dev,
1986                                  struct genl_info *info)
1987 {
1988         struct cfg80211_chan_def chandef;
1989         int result;
1990         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1991         struct wireless_dev *wdev = NULL;
1992
1993         if (dev)
1994                 wdev = dev->ieee80211_ptr;
1995         if (!nl80211_can_set_dev_channel(wdev))
1996                 return -EOPNOTSUPP;
1997         if (wdev)
1998                 iftype = wdev->iftype;
1999
2000         result = nl80211_parse_chandef(rdev, info, &chandef);
2001         if (result)
2002                 return result;
2003
2004         switch (iftype) {
2005         case NL80211_IFTYPE_AP:
2006         case NL80211_IFTYPE_P2P_GO:
2007                 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef, iftype)) {
2008                         result = -EINVAL;
2009                         break;
2010                 }
2011                 if (wdev->beacon_interval) {
2012                         if (!dev || !rdev->ops->set_ap_chanwidth ||
2013                             !(rdev->wiphy.features &
2014                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2015                                 result = -EBUSY;
2016                                 break;
2017                         }
2018
2019                         /* Only allow dynamic channel width changes */
2020                         if (chandef.chan != wdev->preset_chandef.chan) {
2021                                 result = -EBUSY;
2022                                 break;
2023                         }
2024                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2025                         if (result)
2026                                 break;
2027                 }
2028                 wdev->preset_chandef = chandef;
2029                 result = 0;
2030                 break;
2031         case NL80211_IFTYPE_MESH_POINT:
2032                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2033                 break;
2034         case NL80211_IFTYPE_MONITOR:
2035                 result = cfg80211_set_monitor_channel(rdev, &chandef);
2036                 break;
2037         default:
2038                 result = -EINVAL;
2039         }
2040
2041         return result;
2042 }
2043
2044 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2045 {
2046         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2047         struct net_device *netdev = info->user_ptr[1];
2048
2049         return __nl80211_set_channel(rdev, netdev, info);
2050 }
2051
2052 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2053 {
2054         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2055         struct net_device *dev = info->user_ptr[1];
2056         struct wireless_dev *wdev = dev->ieee80211_ptr;
2057         const u8 *bssid;
2058
2059         if (!info->attrs[NL80211_ATTR_MAC])
2060                 return -EINVAL;
2061
2062         if (netif_running(dev))
2063                 return -EBUSY;
2064
2065         if (!rdev->ops->set_wds_peer)
2066                 return -EOPNOTSUPP;
2067
2068         if (wdev->iftype != NL80211_IFTYPE_WDS)
2069                 return -EOPNOTSUPP;
2070
2071         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2072         return rdev_set_wds_peer(rdev, dev, bssid);
2073 }
2074
2075
2076 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2077 {
2078         struct cfg80211_registered_device *rdev;
2079         struct net_device *netdev = NULL;
2080         struct wireless_dev *wdev;
2081         int result = 0, rem_txq_params = 0;
2082         struct nlattr *nl_txq_params;
2083         u32 changed;
2084         u8 retry_short = 0, retry_long = 0;
2085         u32 frag_threshold = 0, rts_threshold = 0;
2086         u8 coverage_class = 0;
2087
2088         ASSERT_RTNL();
2089
2090         /*
2091          * Try to find the wiphy and netdev. Normally this
2092          * function shouldn't need the netdev, but this is
2093          * done for backward compatibility -- previously
2094          * setting the channel was done per wiphy, but now
2095          * it is per netdev. Previous userland like hostapd
2096          * also passed a netdev to set_wiphy, so that it is
2097          * possible to let that go to the right netdev!
2098          */
2099
2100         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2101                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2102
2103                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2104                 if (netdev && netdev->ieee80211_ptr)
2105                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2106                 else
2107                         netdev = NULL;
2108         }
2109
2110         if (!netdev) {
2111                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2112                                                   info->attrs);
2113                 if (IS_ERR(rdev))
2114                         return PTR_ERR(rdev);
2115                 wdev = NULL;
2116                 netdev = NULL;
2117                 result = 0;
2118         } else
2119                 wdev = netdev->ieee80211_ptr;
2120
2121         /*
2122          * end workaround code, by now the rdev is available
2123          * and locked, and wdev may or may not be NULL.
2124          */
2125
2126         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2127                 result = cfg80211_dev_rename(
2128                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2129
2130         if (result)
2131                 return result;
2132
2133         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2134                 struct ieee80211_txq_params txq_params;
2135                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2136
2137                 if (!rdev->ops->set_txq_params)
2138                         return -EOPNOTSUPP;
2139
2140                 if (!netdev)
2141                         return -EINVAL;
2142
2143                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2144                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2145                         return -EINVAL;
2146
2147                 if (!netif_running(netdev))
2148                         return -ENETDOWN;
2149
2150                 nla_for_each_nested(nl_txq_params,
2151                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2152                                     rem_txq_params) {
2153                         result = nla_parse(tb, NL80211_TXQ_ATTR_MAX,
2154                                            nla_data(nl_txq_params),
2155                                            nla_len(nl_txq_params),
2156                                            txq_params_policy);
2157                         if (result)
2158                                 return result;
2159                         result = parse_txq_params(tb, &txq_params);
2160                         if (result)
2161                                 return result;
2162
2163                         result = rdev_set_txq_params(rdev, netdev,
2164                                                      &txq_params);
2165                         if (result)
2166                                 return result;
2167                 }
2168         }
2169
2170         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2171                 result = __nl80211_set_channel(
2172                         rdev,
2173                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2174                         info);
2175                 if (result)
2176                         return result;
2177         }
2178
2179         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2180                 struct wireless_dev *txp_wdev = wdev;
2181                 enum nl80211_tx_power_setting type;
2182                 int idx, mbm = 0;
2183
2184                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2185                         txp_wdev = NULL;
2186
2187                 if (!rdev->ops->set_tx_power)
2188                         return -EOPNOTSUPP;
2189
2190                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2191                 type = nla_get_u32(info->attrs[idx]);
2192
2193                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2194                     (type != NL80211_TX_POWER_AUTOMATIC))
2195                         return -EINVAL;
2196
2197                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2198                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2199                         mbm = nla_get_u32(info->attrs[idx]);
2200                 }
2201
2202                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2203                 if (result)
2204                         return result;
2205         }
2206
2207         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2208             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2209                 u32 tx_ant, rx_ant;
2210                 if ((!rdev->wiphy.available_antennas_tx &&
2211                      !rdev->wiphy.available_antennas_rx) ||
2212                     !rdev->ops->set_antenna)
2213                         return -EOPNOTSUPP;
2214
2215                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2216                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2217
2218                 /* reject antenna configurations which don't match the
2219                  * available antenna masks, except for the "all" mask */
2220                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2221                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2222                         return -EINVAL;
2223
2224                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2225                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2226
2227                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2228                 if (result)
2229                         return result;
2230         }
2231
2232         changed = 0;
2233
2234         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2235                 retry_short = nla_get_u8(
2236                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2237                 if (retry_short == 0)
2238                         return -EINVAL;
2239
2240                 changed |= WIPHY_PARAM_RETRY_SHORT;
2241         }
2242
2243         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2244                 retry_long = nla_get_u8(
2245                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2246                 if (retry_long == 0)
2247                         return -EINVAL;
2248
2249                 changed |= WIPHY_PARAM_RETRY_LONG;
2250         }
2251
2252         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2253                 frag_threshold = nla_get_u32(
2254                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2255                 if (frag_threshold < 256)
2256                         return -EINVAL;
2257
2258                 if (frag_threshold != (u32) -1) {
2259                         /*
2260                          * Fragments (apart from the last one) are required to
2261                          * have even length. Make the fragmentation code
2262                          * simpler by stripping LSB should someone try to use
2263                          * odd threshold value.
2264                          */
2265                         frag_threshold &= ~0x1;
2266                 }
2267                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2268         }
2269
2270         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2271                 rts_threshold = nla_get_u32(
2272                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2273                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2274         }
2275
2276         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2277                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2278                         return -EINVAL;
2279
2280                 coverage_class = nla_get_u8(
2281                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2282                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2283         }
2284
2285         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2286                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2287                         return -EOPNOTSUPP;
2288
2289                 changed |= WIPHY_PARAM_DYN_ACK;
2290         }
2291
2292         if (changed) {
2293                 u8 old_retry_short, old_retry_long;
2294                 u32 old_frag_threshold, old_rts_threshold;
2295                 u8 old_coverage_class;
2296
2297                 if (!rdev->ops->set_wiphy_params)
2298                         return -EOPNOTSUPP;
2299
2300                 old_retry_short = rdev->wiphy.retry_short;
2301                 old_retry_long = rdev->wiphy.retry_long;
2302                 old_frag_threshold = rdev->wiphy.frag_threshold;
2303                 old_rts_threshold = rdev->wiphy.rts_threshold;
2304                 old_coverage_class = rdev->wiphy.coverage_class;
2305
2306                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2307                         rdev->wiphy.retry_short = retry_short;
2308                 if (changed & WIPHY_PARAM_RETRY_LONG)
2309                         rdev->wiphy.retry_long = retry_long;
2310                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2311                         rdev->wiphy.frag_threshold = frag_threshold;
2312                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2313                         rdev->wiphy.rts_threshold = rts_threshold;
2314                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2315                         rdev->wiphy.coverage_class = coverage_class;
2316
2317                 result = rdev_set_wiphy_params(rdev, changed);
2318                 if (result) {
2319                         rdev->wiphy.retry_short = old_retry_short;
2320                         rdev->wiphy.retry_long = old_retry_long;
2321                         rdev->wiphy.frag_threshold = old_frag_threshold;
2322                         rdev->wiphy.rts_threshold = old_rts_threshold;
2323                         rdev->wiphy.coverage_class = old_coverage_class;
2324                 }
2325         }
2326         return 0;
2327 }
2328
2329 static inline u64 wdev_id(struct wireless_dev *wdev)
2330 {
2331         return (u64)wdev->identifier |
2332                ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2333 }
2334
2335 static int nl80211_send_chandef(struct sk_buff *msg,
2336                                 const struct cfg80211_chan_def *chandef)
2337 {
2338         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
2339                 return -EINVAL;
2340
2341         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2342                         chandef->chan->center_freq))
2343                 return -ENOBUFS;
2344         switch (chandef->width) {
2345         case NL80211_CHAN_WIDTH_20_NOHT:
2346         case NL80211_CHAN_WIDTH_20:
2347         case NL80211_CHAN_WIDTH_40:
2348                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2349                                 cfg80211_get_chandef_type(chandef)))
2350                         return -ENOBUFS;
2351                 break;
2352         default:
2353                 break;
2354         }
2355         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2356                 return -ENOBUFS;
2357         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2358                 return -ENOBUFS;
2359         if (chandef->center_freq2 &&
2360             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2361                 return -ENOBUFS;
2362         return 0;
2363 }
2364
2365 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2366                               struct cfg80211_registered_device *rdev,
2367                               struct wireless_dev *wdev, bool removal)
2368 {
2369         struct net_device *dev = wdev->netdev;
2370         u8 cmd = NL80211_CMD_NEW_INTERFACE;
2371         void *hdr;
2372
2373         if (removal)
2374                 cmd = NL80211_CMD_DEL_INTERFACE;
2375
2376         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2377         if (!hdr)
2378                 return -1;
2379
2380         if (dev &&
2381             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2382              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2383                 goto nla_put_failure;
2384
2385         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2386             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2387             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2388             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2389             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2390                         rdev->devlist_generation ^
2391                         (cfg80211_rdev_list_generation << 2)))
2392                 goto nla_put_failure;
2393
2394         if (rdev->ops->get_channel) {
2395                 int ret;
2396                 struct cfg80211_chan_def chandef;
2397
2398                 ret = rdev_get_channel(rdev, wdev, &chandef);
2399                 if (ret == 0) {
2400                         if (nl80211_send_chandef(msg, &chandef))
2401                                 goto nla_put_failure;
2402                 }
2403         }
2404
2405         if (wdev->ssid_len) {
2406                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2407                         goto nla_put_failure;
2408         }
2409
2410         genlmsg_end(msg, hdr);
2411         return 0;
2412
2413  nla_put_failure:
2414         genlmsg_cancel(msg, hdr);
2415         return -EMSGSIZE;
2416 }
2417
2418 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2419 {
2420         int wp_idx = 0;
2421         int if_idx = 0;
2422         int wp_start = cb->args[0];
2423         int if_start = cb->args[1];
2424         struct cfg80211_registered_device *rdev;
2425         struct wireless_dev *wdev;
2426
2427         rtnl_lock();
2428         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2429                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2430                         continue;
2431                 if (wp_idx < wp_start) {
2432                         wp_idx++;
2433                         continue;
2434                 }
2435                 if_idx = 0;
2436
2437                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
2438                         if (if_idx < if_start) {
2439                                 if_idx++;
2440                                 continue;
2441                         }
2442                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2443                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2444                                                rdev, wdev, false) < 0) {
2445                                 goto out;
2446                         }
2447                         if_idx++;
2448                 }
2449
2450                 wp_idx++;
2451         }
2452  out:
2453         rtnl_unlock();
2454
2455         cb->args[0] = wp_idx;
2456         cb->args[1] = if_idx;
2457
2458         return skb->len;
2459 }
2460
2461 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2462 {
2463         struct sk_buff *msg;
2464         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2465         struct wireless_dev *wdev = info->user_ptr[1];
2466
2467         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2468         if (!msg)
2469                 return -ENOMEM;
2470
2471         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2472                                rdev, wdev, false) < 0) {
2473                 nlmsg_free(msg);
2474                 return -ENOBUFS;
2475         }
2476
2477         return genlmsg_reply(msg, info);
2478 }
2479
2480 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2481         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2482         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2483         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2484         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2485         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2486         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2487 };
2488
2489 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2490 {
2491         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2492         int flag;
2493
2494         *mntrflags = 0;
2495
2496         if (!nla)
2497                 return -EINVAL;
2498
2499         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2500                              nla, mntr_flags_policy))
2501                 return -EINVAL;
2502
2503         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2504                 if (flags[flag])
2505                         *mntrflags |= (1<<flag);
2506
2507         return 0;
2508 }
2509
2510 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2511                                struct net_device *netdev, u8 use_4addr,
2512                                enum nl80211_iftype iftype)
2513 {
2514         if (!use_4addr) {
2515                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2516                         return -EBUSY;
2517                 return 0;
2518         }
2519
2520         switch (iftype) {
2521         case NL80211_IFTYPE_AP_VLAN:
2522                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2523                         return 0;
2524                 break;
2525         case NL80211_IFTYPE_STATION:
2526                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2527                         return 0;
2528                 break;
2529         default:
2530                 break;
2531         }
2532
2533         return -EOPNOTSUPP;
2534 }
2535
2536 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2537 {
2538         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2539         struct vif_params params;
2540         int err;
2541         enum nl80211_iftype otype, ntype;
2542         struct net_device *dev = info->user_ptr[1];
2543         u32 _flags, *flags = NULL;
2544         bool change = false;
2545
2546         memset(&params, 0, sizeof(params));
2547
2548         otype = ntype = dev->ieee80211_ptr->iftype;
2549
2550         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2551                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2552                 if (otype != ntype)
2553                         change = true;
2554                 if (ntype > NL80211_IFTYPE_MAX)
2555                         return -EINVAL;
2556         }
2557
2558         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2559                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2560
2561                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2562                         return -EINVAL;
2563                 if (netif_running(dev))
2564                         return -EBUSY;
2565
2566                 wdev_lock(wdev);
2567                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2568                              IEEE80211_MAX_MESH_ID_LEN);
2569                 wdev->mesh_id_up_len =
2570                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2571                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2572                        wdev->mesh_id_up_len);
2573                 wdev_unlock(wdev);
2574         }
2575
2576         if (info->attrs[NL80211_ATTR_4ADDR]) {
2577                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2578                 change = true;
2579                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2580                 if (err)
2581                         return err;
2582         } else {
2583                 params.use_4addr = -1;
2584         }
2585
2586         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2587                 if (ntype != NL80211_IFTYPE_MONITOR)
2588                         return -EINVAL;
2589                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2590                                           &_flags);
2591                 if (err)
2592                         return err;
2593
2594                 flags = &_flags;
2595                 change = true;
2596         }
2597
2598         if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
2599             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2600                 return -EOPNOTSUPP;
2601
2602         if (change)
2603                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2604         else
2605                 err = 0;
2606
2607         if (!err && params.use_4addr != -1)
2608                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2609
2610         return err;
2611 }
2612
2613 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2614 {
2615         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2616         struct vif_params params;
2617         struct wireless_dev *wdev;
2618         struct sk_buff *msg, *event;
2619         int err;
2620         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2621         u32 flags;
2622
2623         /* to avoid failing a new interface creation due to pending removal */
2624         cfg80211_destroy_ifaces(rdev);
2625
2626         memset(&params, 0, sizeof(params));
2627
2628         if (!info->attrs[NL80211_ATTR_IFNAME])
2629                 return -EINVAL;
2630
2631         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2632                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2633                 if (type > NL80211_IFTYPE_MAX)
2634                         return -EINVAL;
2635         }
2636
2637         if (!rdev->ops->add_virtual_intf ||
2638             !(rdev->wiphy.interface_modes & (1 << type)))
2639                 return -EOPNOTSUPP;
2640
2641         if ((type == NL80211_IFTYPE_P2P_DEVICE ||
2642              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
2643             info->attrs[NL80211_ATTR_MAC]) {
2644                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2645                            ETH_ALEN);
2646                 if (!is_valid_ether_addr(params.macaddr))
2647                         return -EADDRNOTAVAIL;
2648         }
2649
2650         if (info->attrs[NL80211_ATTR_4ADDR]) {
2651                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2652                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2653                 if (err)
2654                         return err;
2655         }
2656
2657         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2658         if (!msg)
2659                 return -ENOMEM;
2660
2661         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2662                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2663                                   &flags);
2664
2665         if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
2666             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2667                 return -EOPNOTSUPP;
2668
2669         wdev = rdev_add_virtual_intf(rdev,
2670                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2671                                 type, err ? NULL : &flags, &params);
2672         if (WARN_ON(!wdev)) {
2673                 nlmsg_free(msg);
2674                 return -EPROTO;
2675         } else if (IS_ERR(wdev)) {
2676                 nlmsg_free(msg);
2677                 return PTR_ERR(wdev);
2678         }
2679
2680         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
2681                 wdev->owner_nlportid = info->snd_portid;
2682
2683         switch (type) {
2684         case NL80211_IFTYPE_MESH_POINT:
2685                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2686                         break;
2687                 wdev_lock(wdev);
2688                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2689                              IEEE80211_MAX_MESH_ID_LEN);
2690                 wdev->mesh_id_up_len =
2691                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2692                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2693                        wdev->mesh_id_up_len);
2694                 wdev_unlock(wdev);
2695                 break;
2696         case NL80211_IFTYPE_P2P_DEVICE:
2697                 /*
2698                  * P2P Device doesn't have a netdev, so doesn't go
2699                  * through the netdev notifier and must be added here
2700                  */
2701                 mutex_init(&wdev->mtx);
2702                 INIT_LIST_HEAD(&wdev->event_list);
2703                 spin_lock_init(&wdev->event_lock);
2704                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2705                 spin_lock_init(&wdev->mgmt_registrations_lock);
2706
2707                 wdev->identifier = ++rdev->wdev_id;
2708                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2709                 rdev->devlist_generation++;
2710                 break;
2711         default:
2712                 break;
2713         }
2714
2715         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2716                                rdev, wdev, false) < 0) {
2717                 nlmsg_free(msg);
2718                 return -ENOBUFS;
2719         }
2720
2721         event = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2722         if (event) {
2723                 if (nl80211_send_iface(event, 0, 0, 0,
2724                                        rdev, wdev, false) < 0) {
2725                         nlmsg_free(event);
2726                         goto out;
2727                 }
2728
2729                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
2730                                         event, 0, NL80211_MCGRP_CONFIG,
2731                                         GFP_KERNEL);
2732         }
2733
2734 out:
2735         return genlmsg_reply(msg, info);
2736 }
2737
2738 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2739 {
2740         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2741         struct wireless_dev *wdev = info->user_ptr[1];
2742         struct sk_buff *msg;
2743         int status;
2744
2745         if (!rdev->ops->del_virtual_intf)
2746                 return -EOPNOTSUPP;
2747
2748         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2749         if (msg && nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, true) < 0) {
2750                 nlmsg_free(msg);
2751                 msg = NULL;
2752         }
2753
2754         /*
2755          * If we remove a wireless device without a netdev then clear
2756          * user_ptr[1] so that nl80211_post_doit won't dereference it
2757          * to check if it needs to do dev_put(). Otherwise it crashes
2758          * since the wdev has been freed, unlike with a netdev where
2759          * we need the dev_put() for the netdev to really be freed.
2760          */
2761         if (!wdev->netdev)
2762                 info->user_ptr[1] = NULL;
2763
2764         status = rdev_del_virtual_intf(rdev, wdev);
2765         if (status >= 0 && msg)
2766                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
2767                                         msg, 0, NL80211_MCGRP_CONFIG,
2768                                         GFP_KERNEL);
2769         else
2770                 nlmsg_free(msg);
2771
2772         return status;
2773 }
2774
2775 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2776 {
2777         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2778         struct net_device *dev = info->user_ptr[1];
2779         u16 noack_map;
2780
2781         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2782                 return -EINVAL;
2783
2784         if (!rdev->ops->set_noack_map)
2785                 return -EOPNOTSUPP;
2786
2787         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2788
2789         return rdev_set_noack_map(rdev, dev, noack_map);
2790 }
2791
2792 struct get_key_cookie {
2793         struct sk_buff *msg;
2794         int error;
2795         int idx;
2796 };
2797
2798 static void get_key_callback(void *c, struct key_params *params)
2799 {
2800         struct nlattr *key;
2801         struct get_key_cookie *cookie = c;
2802
2803         if ((params->key &&
2804              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2805                      params->key_len, params->key)) ||
2806             (params->seq &&
2807              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2808                      params->seq_len, params->seq)) ||
2809             (params->cipher &&
2810              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2811                          params->cipher)))
2812                 goto nla_put_failure;
2813
2814         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2815         if (!key)
2816                 goto nla_put_failure;
2817
2818         if ((params->key &&
2819              nla_put(cookie->msg, NL80211_KEY_DATA,
2820                      params->key_len, params->key)) ||
2821             (params->seq &&
2822              nla_put(cookie->msg, NL80211_KEY_SEQ,
2823                      params->seq_len, params->seq)) ||
2824             (params->cipher &&
2825              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2826                          params->cipher)))
2827                 goto nla_put_failure;
2828
2829         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2830                 goto nla_put_failure;
2831
2832         nla_nest_end(cookie->msg, key);
2833
2834         return;
2835  nla_put_failure:
2836         cookie->error = 1;
2837 }
2838
2839 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2840 {
2841         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2842         int err;
2843         struct net_device *dev = info->user_ptr[1];
2844         u8 key_idx = 0;
2845         const u8 *mac_addr = NULL;
2846         bool pairwise;
2847         struct get_key_cookie cookie = {
2848                 .error = 0,
2849         };
2850         void *hdr;
2851         struct sk_buff *msg;
2852
2853         if (info->attrs[NL80211_ATTR_KEY_IDX])
2854                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2855
2856         if (key_idx > 5)
2857                 return -EINVAL;
2858
2859         if (info->attrs[NL80211_ATTR_MAC])
2860                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2861
2862         pairwise = !!mac_addr;
2863         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2864                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2865                 if (kt >= NUM_NL80211_KEYTYPES)
2866                         return -EINVAL;
2867                 if (kt != NL80211_KEYTYPE_GROUP &&
2868                     kt != NL80211_KEYTYPE_PAIRWISE)
2869                         return -EINVAL;
2870                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2871         }
2872
2873         if (!rdev->ops->get_key)
2874                 return -EOPNOTSUPP;
2875
2876         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2877                 return -ENOENT;
2878
2879         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2880         if (!msg)
2881                 return -ENOMEM;
2882
2883         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2884                              NL80211_CMD_NEW_KEY);
2885         if (!hdr)
2886                 goto nla_put_failure;
2887
2888         cookie.msg = msg;
2889         cookie.idx = key_idx;
2890
2891         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2892             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2893                 goto nla_put_failure;
2894         if (mac_addr &&
2895             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2896                 goto nla_put_failure;
2897
2898         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2899                            get_key_callback);
2900
2901         if (err)
2902                 goto free_msg;
2903
2904         if (cookie.error)
2905                 goto nla_put_failure;
2906
2907         genlmsg_end(msg, hdr);
2908         return genlmsg_reply(msg, info);
2909
2910  nla_put_failure:
2911         err = -ENOBUFS;
2912  free_msg:
2913         nlmsg_free(msg);
2914         return err;
2915 }
2916
2917 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2918 {
2919         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2920         struct key_parse key;
2921         int err;
2922         struct net_device *dev = info->user_ptr[1];
2923
2924         err = nl80211_parse_key(info, &key);
2925         if (err)
2926                 return err;
2927
2928         if (key.idx < 0)
2929                 return -EINVAL;
2930
2931         /* only support setting default key */
2932         if (!key.def && !key.defmgmt)
2933                 return -EINVAL;
2934
2935         wdev_lock(dev->ieee80211_ptr);
2936
2937         if (key.def) {
2938                 if (!rdev->ops->set_default_key) {
2939                         err = -EOPNOTSUPP;
2940                         goto out;
2941                 }
2942
2943                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2944                 if (err)
2945                         goto out;
2946
2947                 err = rdev_set_default_key(rdev, dev, key.idx,
2948                                                  key.def_uni, key.def_multi);
2949
2950                 if (err)
2951                         goto out;
2952
2953 #ifdef CONFIG_CFG80211_WEXT
2954                 dev->ieee80211_ptr->wext.default_key = key.idx;
2955 #endif
2956         } else {
2957                 if (key.def_uni || !key.def_multi) {
2958                         err = -EINVAL;
2959                         goto out;
2960                 }
2961
2962                 if (!rdev->ops->set_default_mgmt_key) {
2963                         err = -EOPNOTSUPP;
2964                         goto out;
2965                 }
2966
2967                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2968                 if (err)
2969                         goto out;
2970
2971                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2972                 if (err)
2973                         goto out;
2974
2975 #ifdef CONFIG_CFG80211_WEXT
2976                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2977 #endif
2978         }
2979
2980  out:
2981         wdev_unlock(dev->ieee80211_ptr);
2982
2983         return err;
2984 }
2985
2986 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2987 {
2988         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2989         int err;
2990         struct net_device *dev = info->user_ptr[1];
2991         struct key_parse key;
2992         const u8 *mac_addr = NULL;
2993
2994         err = nl80211_parse_key(info, &key);
2995         if (err)
2996                 return err;
2997
2998         if (!key.p.key)
2999                 return -EINVAL;
3000
3001         if (info->attrs[NL80211_ATTR_MAC])
3002                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3003
3004         if (key.type == -1) {
3005                 if (mac_addr)
3006                         key.type = NL80211_KEYTYPE_PAIRWISE;
3007                 else
3008                         key.type = NL80211_KEYTYPE_GROUP;
3009         }
3010
3011         /* for now */
3012         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3013             key.type != NL80211_KEYTYPE_GROUP)
3014                 return -EINVAL;
3015
3016         if (!rdev->ops->add_key)
3017                 return -EOPNOTSUPP;
3018
3019         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3020                                            key.type == NL80211_KEYTYPE_PAIRWISE,
3021                                            mac_addr))
3022                 return -EINVAL;
3023
3024         wdev_lock(dev->ieee80211_ptr);
3025         err = nl80211_key_allowed(dev->ieee80211_ptr);
3026         if (!err)
3027                 err = rdev_add_key(rdev, dev, key.idx,
3028                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3029                                     mac_addr, &key.p);
3030         wdev_unlock(dev->ieee80211_ptr);
3031
3032         return err;
3033 }
3034
3035 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3036 {
3037         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3038         int err;
3039         struct net_device *dev = info->user_ptr[1];
3040         u8 *mac_addr = NULL;
3041         struct key_parse key;
3042
3043         err = nl80211_parse_key(info, &key);
3044         if (err)
3045                 return err;
3046
3047         if (info->attrs[NL80211_ATTR_MAC])
3048                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3049
3050         if (key.type == -1) {
3051                 if (mac_addr)
3052                         key.type = NL80211_KEYTYPE_PAIRWISE;
3053                 else
3054                         key.type = NL80211_KEYTYPE_GROUP;
3055         }
3056
3057         /* for now */
3058         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3059             key.type != NL80211_KEYTYPE_GROUP)
3060                 return -EINVAL;
3061
3062         if (!rdev->ops->del_key)
3063                 return -EOPNOTSUPP;
3064
3065         wdev_lock(dev->ieee80211_ptr);
3066         err = nl80211_key_allowed(dev->ieee80211_ptr);
3067
3068         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
3069             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3070                 err = -ENOENT;
3071
3072         if (!err)
3073                 err = rdev_del_key(rdev, dev, key.idx,
3074                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3075                                    mac_addr);
3076
3077 #ifdef CONFIG_CFG80211_WEXT
3078         if (!err) {
3079                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
3080                         dev->ieee80211_ptr->wext.default_key = -1;
3081                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3082                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3083         }
3084 #endif
3085         wdev_unlock(dev->ieee80211_ptr);
3086
3087         return err;
3088 }
3089
3090 /* This function returns an error or the number of nested attributes */
3091 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3092 {
3093         struct nlattr *attr;
3094         int n_entries = 0, tmp;
3095
3096         nla_for_each_nested(attr, nl_attr, tmp) {
3097                 if (nla_len(attr) != ETH_ALEN)
3098                         return -EINVAL;
3099
3100                 n_entries++;
3101         }
3102
3103         return n_entries;
3104 }
3105
3106 /*
3107  * This function parses ACL information and allocates memory for ACL data.
3108  * On successful return, the calling function is responsible to free the
3109  * ACL buffer returned by this function.
3110  */
3111 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3112                                                 struct genl_info *info)
3113 {
3114         enum nl80211_acl_policy acl_policy;
3115         struct nlattr *attr;
3116         struct cfg80211_acl_data *acl;
3117         int i = 0, n_entries, tmp;
3118
3119         if (!wiphy->max_acl_mac_addrs)
3120                 return ERR_PTR(-EOPNOTSUPP);
3121
3122         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3123                 return ERR_PTR(-EINVAL);
3124
3125         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3126         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3127             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3128                 return ERR_PTR(-EINVAL);
3129
3130         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3131                 return ERR_PTR(-EINVAL);
3132
3133         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3134         if (n_entries < 0)
3135                 return ERR_PTR(n_entries);
3136
3137         if (n_entries > wiphy->max_acl_mac_addrs)
3138                 return ERR_PTR(-ENOTSUPP);
3139
3140         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3141                       GFP_KERNEL);
3142         if (!acl)
3143                 return ERR_PTR(-ENOMEM);
3144
3145         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3146                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3147                 i++;
3148         }
3149
3150         acl->n_acl_entries = n_entries;
3151         acl->acl_policy = acl_policy;
3152
3153         return acl;
3154 }
3155
3156 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3157 {
3158         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3159         struct net_device *dev = info->user_ptr[1];
3160         struct cfg80211_acl_data *acl;
3161         int err;
3162
3163         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3164             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3165                 return -EOPNOTSUPP;
3166
3167         if (!dev->ieee80211_ptr->beacon_interval)
3168                 return -EINVAL;
3169
3170         acl = parse_acl_data(&rdev->wiphy, info);
3171         if (IS_ERR(acl))
3172                 return PTR_ERR(acl);
3173
3174         err = rdev_set_mac_acl(rdev, dev, acl);
3175
3176         kfree(acl);
3177
3178         return err;
3179 }
3180
3181 static int nl80211_parse_beacon(struct nlattr *attrs[],
3182                                 struct cfg80211_beacon_data *bcn)
3183 {
3184         bool haveinfo = false;
3185
3186         if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
3187             !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
3188             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
3189             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
3190                 return -EINVAL;
3191
3192         memset(bcn, 0, sizeof(*bcn));
3193
3194         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
3195                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
3196                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
3197                 if (!bcn->head_len)
3198                         return -EINVAL;
3199                 haveinfo = true;
3200         }
3201
3202         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
3203                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
3204                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
3205                 haveinfo = true;
3206         }
3207
3208         if (!haveinfo)
3209                 return -EINVAL;
3210
3211         if (attrs[NL80211_ATTR_IE]) {
3212                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
3213                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3214         }
3215
3216         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3217                 bcn->proberesp_ies =
3218                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3219                 bcn->proberesp_ies_len =
3220                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3221         }
3222
3223         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3224                 bcn->assocresp_ies =
3225                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3226                 bcn->assocresp_ies_len =
3227                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3228         }
3229
3230         if (attrs[NL80211_ATTR_PROBE_RESP]) {
3231                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
3232                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3233         }
3234
3235         return 0;
3236 }
3237
3238 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
3239                                    struct cfg80211_ap_settings *params)
3240 {
3241         struct wireless_dev *wdev;
3242         bool ret = false;
3243
3244         list_for_each_entry(wdev, &rdev->wdev_list, list) {
3245                 if (wdev->iftype != NL80211_IFTYPE_AP &&
3246                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
3247                         continue;
3248
3249                 if (!wdev->preset_chandef.chan)
3250                         continue;
3251
3252                 params->chandef = wdev->preset_chandef;
3253                 ret = true;
3254                 break;
3255         }
3256
3257         return ret;
3258 }
3259
3260 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3261                                     enum nl80211_auth_type auth_type,
3262                                     enum nl80211_commands cmd)
3263 {
3264         if (auth_type > NL80211_AUTHTYPE_MAX)
3265                 return false;
3266
3267         switch (cmd) {
3268         case NL80211_CMD_AUTHENTICATE:
3269                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3270                     auth_type == NL80211_AUTHTYPE_SAE)
3271                         return false;
3272                 return true;
3273         case NL80211_CMD_CONNECT:
3274         case NL80211_CMD_START_AP:
3275                 /* SAE not supported yet */
3276                 if (auth_type == NL80211_AUTHTYPE_SAE)
3277                         return false;
3278                 return true;
3279         default:
3280                 return false;
3281         }
3282 }
3283
3284 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3285 {
3286         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3287         struct net_device *dev = info->user_ptr[1];
3288         struct wireless_dev *wdev = dev->ieee80211_ptr;
3289         struct cfg80211_ap_settings params;
3290         int err;
3291
3292         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3293             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3294                 return -EOPNOTSUPP;
3295
3296         if (!rdev->ops->start_ap)
3297                 return -EOPNOTSUPP;
3298
3299         if (wdev->beacon_interval)
3300                 return -EALREADY;
3301
3302         memset(&params, 0, sizeof(params));
3303
3304         /* these are required for START_AP */
3305         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3306             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3307             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3308                 return -EINVAL;
3309
3310         err = nl80211_parse_beacon(info->attrs, &params.beacon);
3311         if (err)
3312                 return err;
3313
3314         params.beacon_interval =
3315                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3316         params.dtim_period =
3317                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3318
3319         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
3320         if (err)
3321                 return err;
3322
3323         /*
3324          * In theory, some of these attributes should be required here
3325          * but since they were not used when the command was originally
3326          * added, keep them optional for old user space programs to let
3327          * them continue to work with drivers that do not need the
3328          * additional information -- drivers must check!
3329          */
3330         if (info->attrs[NL80211_ATTR_SSID]) {
3331                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3332                 params.ssid_len =
3333                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3334                 if (params.ssid_len == 0 ||
3335                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3336                         return -EINVAL;
3337         }
3338
3339         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3340                 params.hidden_ssid = nla_get_u32(
3341                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3342                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3343                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3344                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3345                         return -EINVAL;
3346         }
3347
3348         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3349
3350         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3351                 params.auth_type = nla_get_u32(
3352                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3353                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3354                                              NL80211_CMD_START_AP))
3355                         return -EINVAL;
3356         } else
3357                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3358
3359         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3360                                       NL80211_MAX_NR_CIPHER_SUITES);
3361         if (err)
3362                 return err;
3363
3364         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3365                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3366                         return -EOPNOTSUPP;
3367                 params.inactivity_timeout = nla_get_u16(
3368                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3369         }
3370
3371         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3372                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3373                         return -EINVAL;
3374                 params.p2p_ctwindow =
3375                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3376                 if (params.p2p_ctwindow > 127)
3377                         return -EINVAL;
3378                 if (params.p2p_ctwindow != 0 &&
3379                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3380                         return -EINVAL;
3381         }
3382
3383         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3384                 u8 tmp;
3385
3386                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3387                         return -EINVAL;
3388                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3389                 if (tmp > 1)
3390                         return -EINVAL;
3391                 params.p2p_opp_ps = tmp;
3392                 if (params.p2p_opp_ps != 0 &&
3393                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3394                         return -EINVAL;
3395         }
3396
3397         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3398                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
3399                 if (err)
3400                         return err;
3401         } else if (wdev->preset_chandef.chan) {
3402                 params.chandef = wdev->preset_chandef;
3403         } else if (!nl80211_get_ap_channel(rdev, &params))
3404                 return -EINVAL;
3405
3406         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef,
3407                                      wdev->iftype))
3408                 return -EINVAL;
3409
3410         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3411                 params.acl = parse_acl_data(&rdev->wiphy, info);
3412                 if (IS_ERR(params.acl))
3413                         return PTR_ERR(params.acl);
3414         }
3415
3416         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
3417                 params.smps_mode =
3418                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
3419                 switch (params.smps_mode) {
3420                 case NL80211_SMPS_OFF:
3421                         break;
3422                 case NL80211_SMPS_STATIC:
3423                         if (!(rdev->wiphy.features &
3424                               NL80211_FEATURE_STATIC_SMPS))
3425                                 return -EINVAL;
3426                         break;
3427                 case NL80211_SMPS_DYNAMIC:
3428                         if (!(rdev->wiphy.features &
3429                               NL80211_FEATURE_DYNAMIC_SMPS))
3430                                 return -EINVAL;
3431                         break;
3432                 default:
3433                         return -EINVAL;
3434                 }
3435         } else {
3436                 params.smps_mode = NL80211_SMPS_OFF;
3437         }
3438
3439         wdev_lock(wdev);
3440         err = rdev_start_ap(rdev, dev, &params);
3441         if (!err) {
3442                 wdev->preset_chandef = params.chandef;
3443                 wdev->beacon_interval = params.beacon_interval;
3444                 wdev->chandef = params.chandef;
3445                 wdev->ssid_len = params.ssid_len;
3446                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3447         }
3448         wdev_unlock(wdev);
3449
3450         kfree(params.acl);
3451
3452         return err;
3453 }
3454
3455 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3456 {
3457         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3458         struct net_device *dev = info->user_ptr[1];
3459         struct wireless_dev *wdev = dev->ieee80211_ptr;
3460         struct cfg80211_beacon_data params;
3461         int err;
3462
3463         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3464             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3465                 return -EOPNOTSUPP;
3466
3467         if (!rdev->ops->change_beacon)
3468                 return -EOPNOTSUPP;
3469
3470         if (!wdev->beacon_interval)
3471                 return -EINVAL;
3472
3473         err = nl80211_parse_beacon(info->attrs, &params);
3474         if (err)
3475                 return err;
3476
3477         wdev_lock(wdev);
3478         err = rdev_change_beacon(rdev, dev, &params);
3479         wdev_unlock(wdev);
3480
3481         return err;
3482 }
3483
3484 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3485 {
3486         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3487         struct net_device *dev = info->user_ptr[1];
3488
3489         return cfg80211_stop_ap(rdev, dev, false);
3490 }
3491
3492 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3493         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3494         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3495         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3496         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3497         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3498         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3499 };
3500
3501 static int parse_station_flags(struct genl_info *info,
3502                                enum nl80211_iftype iftype,
3503                                struct station_parameters *params)
3504 {
3505         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3506         struct nlattr *nla;
3507         int flag;
3508
3509         /*
3510          * Try parsing the new attribute first so userspace
3511          * can specify both for older kernels.
3512          */
3513         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3514         if (nla) {
3515                 struct nl80211_sta_flag_update *sta_flags;
3516
3517                 sta_flags = nla_data(nla);
3518                 params->sta_flags_mask = sta_flags->mask;
3519                 params->sta_flags_set = sta_flags->set;
3520                 params->sta_flags_set &= params->sta_flags_mask;
3521                 if ((params->sta_flags_mask |
3522                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3523                         return -EINVAL;
3524                 return 0;
3525         }
3526
3527         /* if present, parse the old attribute */
3528
3529         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3530         if (!nla)
3531                 return 0;
3532
3533         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3534                              nla, sta_flags_policy))
3535                 return -EINVAL;
3536
3537         /*
3538          * Only allow certain flags for interface types so that
3539          * other attributes are silently ignored. Remember that
3540          * this is backward compatibility code with old userspace
3541          * and shouldn't be hit in other cases anyway.
3542          */
3543         switch (iftype) {
3544         case NL80211_IFTYPE_AP:
3545         case NL80211_IFTYPE_AP_VLAN:
3546         case NL80211_IFTYPE_P2P_GO:
3547                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3548                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3549                                          BIT(NL80211_STA_FLAG_WME) |
3550                                          BIT(NL80211_STA_FLAG_MFP);
3551                 break;
3552         case NL80211_IFTYPE_P2P_CLIENT:
3553         case NL80211_IFTYPE_STATION:
3554                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3555                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3556                 break;
3557         case NL80211_IFTYPE_MESH_POINT:
3558                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3559                                          BIT(NL80211_STA_FLAG_MFP) |
3560                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3561         default:
3562                 return -EINVAL;
3563         }
3564
3565         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3566                 if (flags[flag]) {
3567                         params->sta_flags_set |= (1<<flag);
3568
3569                         /* no longer support new API additions in old API */
3570                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3571                                 return -EINVAL;
3572                 }
3573         }
3574
3575         return 0;
3576 }
3577
3578 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3579                                  int attr)
3580 {
3581         struct nlattr *rate;
3582         u32 bitrate;
3583         u16 bitrate_compat;
3584         enum nl80211_attrs rate_flg;
3585
3586         rate = nla_nest_start(msg, attr);
3587         if (!rate)
3588                 return false;
3589
3590         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3591         bitrate = cfg80211_calculate_bitrate(info);
3592         /* report 16-bit bitrate only if we can */
3593         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3594         if (bitrate > 0 &&
3595             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3596                 return false;
3597         if (bitrate_compat > 0 &&
3598             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3599                 return false;
3600
3601         switch (info->bw) {
3602         case RATE_INFO_BW_5:
3603                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
3604                 break;
3605         case RATE_INFO_BW_10:
3606                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
3607                 break;
3608         default:
3609                 WARN_ON(1);
3610                 /* fall through */
3611         case RATE_INFO_BW_20:
3612                 rate_flg = 0;
3613                 break;
3614         case RATE_INFO_BW_40:
3615                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
3616                 break;
3617         case RATE_INFO_BW_80:
3618                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
3619                 break;
3620         case RATE_INFO_BW_160:
3621                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
3622                 break;
3623         }
3624
3625         if (rate_flg && nla_put_flag(msg, rate_flg))
3626                 return false;
3627
3628         if (info->flags & RATE_INFO_FLAGS_MCS) {
3629                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3630                         return false;
3631                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3632                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3633                         return false;
3634         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3635                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3636                         return false;
3637                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3638                         return false;
3639                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3640                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3641                         return false;
3642         }
3643
3644         nla_nest_end(msg, rate);
3645         return true;
3646 }
3647
3648 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
3649                                int id)
3650 {
3651         void *attr;
3652         int i = 0;
3653
3654         if (!mask)
3655                 return true;
3656
3657         attr = nla_nest_start(msg, id);
3658         if (!attr)
3659                 return false;
3660
3661         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
3662                 if (!(mask & BIT(i)))
3663                         continue;
3664
3665                 if (nla_put_u8(msg, i, signal[i]))
3666                         return false;
3667         }
3668
3669         nla_nest_end(msg, attr);
3670
3671         return true;
3672 }
3673
3674 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
3675                                 u32 seq, int flags,
3676                                 struct cfg80211_registered_device *rdev,
3677                                 struct net_device *dev,
3678                                 const u8 *mac_addr, struct station_info *sinfo)
3679 {
3680         void *hdr;
3681         struct nlattr *sinfoattr, *bss_param;
3682
3683         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
3684         if (!hdr)
3685                 return -1;
3686
3687         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3688             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3689             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3690                 goto nla_put_failure;
3691
3692         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3693         if (!sinfoattr)
3694                 goto nla_put_failure;
3695
3696 #define PUT_SINFO(attr, memb, type) do {                                \
3697         if (sinfo->filled & BIT(NL80211_STA_INFO_ ## attr) &&           \
3698             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
3699                              sinfo->memb))                              \
3700                 goto nla_put_failure;                                   \
3701         } while (0)
3702
3703         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
3704         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
3705
3706         if (sinfo->filled & (BIT(NL80211_STA_INFO_RX_BYTES) |
3707                              BIT(NL80211_STA_INFO_RX_BYTES64)) &&
3708             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3709                         (u32)sinfo->rx_bytes))
3710                 goto nla_put_failure;
3711
3712         if (sinfo->filled & (BIT(NL80211_STA_INFO_TX_BYTES) |
3713                              BIT(NL80211_STA_INFO_TX_BYTES64)) &&
3714             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3715                         (u32)sinfo->tx_bytes))
3716                 goto nla_put_failure;
3717
3718         PUT_SINFO(RX_BYTES64, rx_bytes, u64);
3719         PUT_SINFO(TX_BYTES64, tx_bytes, u64);
3720         PUT_SINFO(LLID, llid, u16);
3721         PUT_SINFO(PLID, plid, u16);
3722         PUT_SINFO(PLINK_STATE, plink_state, u8);
3723
3724         switch (rdev->wiphy.signal_type) {
3725         case CFG80211_SIGNAL_TYPE_MBM:
3726                 PUT_SINFO(SIGNAL, signal, u8);
3727                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
3728                 break;
3729         default:
3730                 break;
3731         }
3732         if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL)) {
3733                 if (!nl80211_put_signal(msg, sinfo->chains,
3734                                         sinfo->chain_signal,
3735                                         NL80211_STA_INFO_CHAIN_SIGNAL))
3736                         goto nla_put_failure;
3737         }
3738         if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
3739                 if (!nl80211_put_signal(msg, sinfo->chains,
3740                                         sinfo->chain_signal_avg,
3741                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
3742                         goto nla_put_failure;
3743         }
3744         if (sinfo->filled & BIT(NL80211_STA_INFO_TX_BITRATE)) {
3745                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3746                                           NL80211_STA_INFO_TX_BITRATE))
3747                         goto nla_put_failure;
3748         }
3749         if (sinfo->filled & BIT(NL80211_STA_INFO_RX_BITRATE)) {
3750                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3751                                           NL80211_STA_INFO_RX_BITRATE))
3752                         goto nla_put_failure;
3753         }
3754
3755         PUT_SINFO(RX_PACKETS, rx_packets, u32);
3756         PUT_SINFO(TX_PACKETS, tx_packets, u32);
3757         PUT_SINFO(TX_RETRIES, tx_retries, u32);
3758         PUT_SINFO(TX_FAILED, tx_failed, u32);
3759         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
3760         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
3761         PUT_SINFO(LOCAL_PM, local_pm, u32);
3762         PUT_SINFO(PEER_PM, peer_pm, u32);
3763         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
3764
3765         if (sinfo->filled & BIT(NL80211_STA_INFO_BSS_PARAM)) {
3766                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3767                 if (!bss_param)
3768                         goto nla_put_failure;
3769
3770                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3771                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3772                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3773                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3774                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3775                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3776                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3777                                sinfo->bss_param.dtim_period) ||
3778                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3779                                 sinfo->bss_param.beacon_interval))
3780                         goto nla_put_failure;
3781
3782                 nla_nest_end(msg, bss_param);
3783         }
3784         if ((sinfo->filled & BIT(NL80211_STA_INFO_STA_FLAGS)) &&
3785             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3786                     sizeof(struct nl80211_sta_flag_update),
3787                     &sinfo->sta_flags))
3788                 goto nla_put_failure;
3789
3790         PUT_SINFO(T_OFFSET, t_offset, u64);
3791         PUT_SINFO(RX_DROP_MISC, rx_dropped_misc, u64);
3792         PUT_SINFO(BEACON_RX, rx_beacon, u64);
3793         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
3794
3795 #undef PUT_SINFO
3796
3797         if (sinfo->filled & BIT(NL80211_STA_INFO_TID_STATS)) {
3798                 struct nlattr *tidsattr;
3799                 int tid;
3800
3801                 tidsattr = nla_nest_start(msg, NL80211_STA_INFO_TID_STATS);
3802                 if (!tidsattr)
3803                         goto nla_put_failure;
3804
3805                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
3806                         struct cfg80211_tid_stats *tidstats;
3807                         struct nlattr *tidattr;
3808
3809                         tidstats = &sinfo->pertid[tid];
3810
3811                         if (!tidstats->filled)
3812                                 continue;
3813
3814                         tidattr = nla_nest_start(msg, tid + 1);
3815                         if (!tidattr)
3816                                 goto nla_put_failure;
3817
3818 #define PUT_TIDVAL(attr, memb, type) do {                               \
3819         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
3820             nla_put_ ## type(msg, NL80211_TID_STATS_ ## attr,           \
3821                              tidstats->memb))                           \
3822                 goto nla_put_failure;                                   \
3823         } while (0)
3824
3825                         PUT_TIDVAL(RX_MSDU, rx_msdu, u64);
3826                         PUT_TIDVAL(TX_MSDU, tx_msdu, u64);
3827                         PUT_TIDVAL(TX_MSDU_RETRIES, tx_msdu_retries, u64);
3828                         PUT_TIDVAL(TX_MSDU_FAILED, tx_msdu_failed, u64);
3829
3830 #undef PUT_TIDVAL
3831                         nla_nest_end(msg, tidattr);
3832                 }
3833
3834                 nla_nest_end(msg, tidsattr);
3835         }
3836
3837         nla_nest_end(msg, sinfoattr);
3838
3839         if (sinfo->assoc_req_ies_len &&
3840             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3841                     sinfo->assoc_req_ies))
3842                 goto nla_put_failure;
3843
3844         genlmsg_end(msg, hdr);
3845         return 0;
3846
3847  nla_put_failure:
3848         genlmsg_cancel(msg, hdr);
3849         return -EMSGSIZE;
3850 }
3851
3852 static int nl80211_dump_station(struct sk_buff *skb,
3853                                 struct netlink_callback *cb)
3854 {
3855         struct station_info sinfo;
3856         struct cfg80211_registered_device *rdev;
3857         struct wireless_dev *wdev;
3858         u8 mac_addr[ETH_ALEN];
3859         int sta_idx = cb->args[2];
3860         int err;
3861
3862         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
3863         if (err)
3864                 return err;
3865
3866         if (!wdev->netdev) {
3867                 err = -EINVAL;
3868                 goto out_err;
3869         }
3870
3871         if (!rdev->ops->dump_station) {
3872                 err = -EOPNOTSUPP;
3873                 goto out_err;
3874         }
3875
3876         while (1) {
3877                 memset(&sinfo, 0, sizeof(sinfo));
3878                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
3879                                         mac_addr, &sinfo);
3880                 if (err == -ENOENT)
3881                         break;
3882                 if (err)
3883                         goto out_err;
3884
3885                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
3886                                 NETLINK_CB(cb->skb).portid,
3887                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3888                                 rdev, wdev->netdev, mac_addr,
3889                                 &sinfo) < 0)
3890                         goto out;
3891
3892                 sta_idx++;
3893         }
3894
3895
3896  out:
3897         cb->args[2] = sta_idx;
3898         err = skb->len;
3899  out_err:
3900         nl80211_finish_wdev_dump(rdev);
3901
3902         return err;
3903 }
3904
3905 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3906 {
3907         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3908         struct net_device *dev = info->user_ptr[1];
3909         struct station_info sinfo;
3910         struct sk_buff *msg;
3911         u8 *mac_addr = NULL;
3912         int err;
3913
3914         memset(&sinfo, 0, sizeof(sinfo));
3915
3916         if (!info->attrs[NL80211_ATTR_MAC])
3917                 return -EINVAL;
3918
3919         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3920
3921         if (!rdev->ops->get_station)
3922                 return -EOPNOTSUPP;
3923
3924         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3925         if (err)
3926                 return err;
3927
3928         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3929         if (!msg)
3930                 return -ENOMEM;
3931
3932         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
3933                                  info->snd_portid, info->snd_seq, 0,
3934                                  rdev, dev, mac_addr, &sinfo) < 0) {
3935                 nlmsg_free(msg);
3936                 return -ENOBUFS;
3937         }
3938
3939         return genlmsg_reply(msg, info);
3940 }
3941
3942 int cfg80211_check_station_change(struct wiphy *wiphy,
3943                                   struct station_parameters *params,
3944                                   enum cfg80211_station_type statype)
3945 {
3946         if (params->listen_interval != -1)
3947                 return -EINVAL;
3948         if (params->aid &&
3949             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3950                 return -EINVAL;
3951
3952         /* When you run into this, adjust the code below for the new flag */
3953         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
3954
3955         switch (statype) {
3956         case CFG80211_STA_MESH_PEER_KERNEL:
3957         case CFG80211_STA_MESH_PEER_USER:
3958                 /*
3959                  * No ignoring the TDLS flag here -- the userspace mesh
3960                  * code doesn't have the bug of including TDLS in the
3961                  * mask everywhere.
3962                  */
3963                 if (params->sta_flags_mask &
3964                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3965                                   BIT(NL80211_STA_FLAG_MFP) |
3966                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3967                         return -EINVAL;
3968                 break;
3969         case CFG80211_STA_TDLS_PEER_SETUP:
3970         case CFG80211_STA_TDLS_PEER_ACTIVE:
3971                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3972                         return -EINVAL;
3973                 /* ignore since it can't change */
3974                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3975                 break;
3976         default:
3977                 /* disallow mesh-specific things */
3978                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3979                         return -EINVAL;
3980                 if (params->local_pm)
3981                         return -EINVAL;
3982                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3983                         return -EINVAL;
3984         }
3985
3986         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
3987             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
3988                 /* TDLS can't be set, ... */
3989                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3990                         return -EINVAL;
3991                 /*
3992                  * ... but don't bother the driver with it. This works around
3993                  * a hostapd/wpa_supplicant issue -- it always includes the
3994                  * TLDS_PEER flag in the mask even for AP mode.
3995                  */
3996                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3997         }
3998
3999         if (statype != CFG80211_STA_TDLS_PEER_SETUP) {
4000                 /* reject other things that can't change */
4001                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
4002                         return -EINVAL;
4003                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
4004                         return -EINVAL;
4005                 if (params->supported_rates)
4006                         return -EINVAL;
4007                 if (params->ext_capab || params->ht_capa || params->vht_capa)
4008                         return -EINVAL;
4009         }
4010
4011         if (statype != CFG80211_STA_AP_CLIENT) {
4012                 if (params->vlan)
4013                         return -EINVAL;
4014         }
4015
4016         switch (statype) {
4017         case CFG80211_STA_AP_MLME_CLIENT:
4018                 /* Use this only for authorizing/unauthorizing a station */
4019                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
4020                         return -EOPNOTSUPP;
4021                 break;
4022         case CFG80211_STA_AP_CLIENT:
4023                 /* accept only the listed bits */
4024                 if (params->sta_flags_mask &
4025                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4026                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4027                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
4028                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4029                                   BIT(NL80211_STA_FLAG_WME) |
4030                                   BIT(NL80211_STA_FLAG_MFP)))
4031                         return -EINVAL;
4032
4033                 /* but authenticated/associated only if driver handles it */
4034                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4035                     params->sta_flags_mask &
4036                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4037                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4038                         return -EINVAL;
4039                 break;
4040         case CFG80211_STA_IBSS:
4041         case CFG80211_STA_AP_STA:
4042                 /* reject any changes other than AUTHORIZED */
4043                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
4044                         return -EINVAL;
4045                 break;
4046         case CFG80211_STA_TDLS_PEER_SETUP:
4047                 /* reject any changes other than AUTHORIZED or WME */
4048                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4049                                                BIT(NL80211_STA_FLAG_WME)))
4050                         return -EINVAL;
4051                 /* force (at least) rates when authorizing */
4052                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
4053                     !params->supported_rates)
4054                         return -EINVAL;
4055                 break;
4056         case CFG80211_STA_TDLS_PEER_ACTIVE:
4057                 /* reject any changes */
4058                 return -EINVAL;
4059         case CFG80211_STA_MESH_PEER_KERNEL:
4060                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4061                         return -EINVAL;
4062                 break;
4063         case CFG80211_STA_MESH_PEER_USER:
4064                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
4065                         return -EINVAL;
4066                 break;
4067         }
4068
4069         return 0;
4070 }
4071 EXPORT_SYMBOL(cfg80211_check_station_change);
4072
4073 /*
4074  * Get vlan interface making sure it is running and on the right wiphy.
4075  */
4076 static struct net_device *get_vlan(struct genl_info *info,
4077                                    struct cfg80211_registered_device *rdev)
4078 {
4079         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
4080         struct net_device *v;
4081         int ret;
4082
4083         if (!vlanattr)
4084                 return NULL;
4085
4086         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
4087         if (!v)
4088                 return ERR_PTR(-ENODEV);
4089
4090         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
4091                 ret = -EINVAL;
4092                 goto error;
4093         }
4094
4095         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4096             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4097             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
4098                 ret = -EINVAL;
4099                 goto error;
4100         }
4101
4102         if (!netif_running(v)) {
4103                 ret = -ENETDOWN;
4104                 goto error;
4105         }
4106
4107         return v;
4108  error:
4109         dev_put(v);
4110         return ERR_PTR(ret);
4111 }
4112
4113 static const struct nla_policy
4114 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
4115         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
4116         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
4117 };
4118
4119 static int nl80211_parse_sta_wme(struct genl_info *info,
4120                                  struct station_parameters *params)
4121 {
4122         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
4123         struct nlattr *nla;
4124         int err;
4125
4126         /* parse WME attributes if present */
4127         if (!info->attrs[NL80211_ATTR_STA_WME])
4128                 return 0;
4129
4130         nla = info->attrs[NL80211_ATTR_STA_WME];
4131         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
4132                                nl80211_sta_wme_policy);
4133         if (err)
4134                 return err;
4135
4136         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
4137                 params->uapsd_queues = nla_get_u8(
4138                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
4139         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
4140                 return -EINVAL;
4141
4142         if (tb[NL80211_STA_WME_MAX_SP])
4143                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
4144
4145         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
4146                 return -EINVAL;
4147
4148         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
4149
4150         return 0;
4151 }
4152
4153 static int nl80211_parse_sta_channel_info(struct genl_info *info,
4154                                       struct station_parameters *params)
4155 {
4156         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
4157                 params->supported_channels =
4158                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4159                 params->supported_channels_len =
4160                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4161                 /*
4162                  * Need to include at least one (first channel, number of
4163                  * channels) tuple for each subband, and must have proper
4164                  * tuples for the rest of the data as well.
4165                  */
4166                 if (params->supported_channels_len < 2)
4167                         return -EINVAL;
4168                 if (params->supported_channels_len % 2)
4169                         return -EINVAL;
4170         }
4171
4172         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
4173                 params->supported_oper_classes =
4174                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4175                 params->supported_oper_classes_len =
4176                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4177                 /*
4178                  * The value of the Length field of the Supported Operating
4179                  * Classes element is between 2 and 253.
4180                  */
4181                 if (params->supported_oper_classes_len < 2 ||
4182                     params->supported_oper_classes_len > 253)
4183                         return -EINVAL;
4184         }
4185         return 0;
4186 }
4187
4188 static int nl80211_set_station_tdls(struct genl_info *info,
4189                                     struct station_parameters *params)
4190 {
4191         int err;
4192         /* Dummy STA entry gets updated once the peer capabilities are known */
4193         if (info->attrs[NL80211_ATTR_PEER_AID])
4194                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4195         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4196                 params->ht_capa =
4197                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4198         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4199                 params->vht_capa =
4200                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4201
4202         err = nl80211_parse_sta_channel_info(info, params);
4203         if (err)
4204                 return err;
4205
4206         return nl80211_parse_sta_wme(info, params);
4207 }
4208
4209 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
4210 {
4211         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4212         struct net_device *dev = info->user_ptr[1];
4213         struct station_parameters params;
4214         u8 *mac_addr;
4215         int err;
4216
4217         memset(&params, 0, sizeof(params));
4218
4219         params.listen_interval = -1;
4220
4221         if (!rdev->ops->change_station)
4222                 return -EOPNOTSUPP;
4223
4224         if (info->attrs[NL80211_ATTR_STA_AID])
4225                 return -EINVAL;
4226
4227         if (!info->attrs[NL80211_ATTR_MAC])
4228                 return -EINVAL;
4229
4230         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4231
4232         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
4233                 params.supported_rates =
4234                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4235                 params.supported_rates_len =
4236                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4237         }
4238
4239         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4240                 params.capability =
4241                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4242                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4243         }
4244
4245         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4246                 params.ext_capab =
4247                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4248                 params.ext_capab_len =
4249                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4250         }
4251
4252         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4253                 return -EINVAL;
4254
4255         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4256                 return -EINVAL;
4257
4258         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4259                 params.plink_action =
4260                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4261                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4262                         return -EINVAL;
4263         }
4264
4265         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
4266                 params.plink_state =
4267                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
4268                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
4269                         return -EINVAL;
4270                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
4271         }
4272
4273         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
4274                 enum nl80211_mesh_power_mode pm = nla_get_u32(
4275                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
4276
4277                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
4278                     pm > NL80211_MESH_POWER_MAX)
4279                         return -EINVAL;
4280
4281                 params.local_pm = pm;
4282         }
4283
4284         /* Include parameters for TDLS peer (will check later) */
4285         err = nl80211_set_station_tdls(info, &params);
4286         if (err)
4287                 return err;
4288
4289         params.vlan = get_vlan(info, rdev);
4290         if (IS_ERR(params.vlan))
4291                 return PTR_ERR(params.vlan);
4292
4293         switch (dev->ieee80211_ptr->iftype) {
4294         case NL80211_IFTYPE_AP:
4295         case NL80211_IFTYPE_AP_VLAN:
4296         case NL80211_IFTYPE_P2P_GO:
4297         case NL80211_IFTYPE_P2P_CLIENT:
4298         case NL80211_IFTYPE_STATION:
4299         case NL80211_IFTYPE_ADHOC:
4300         case NL80211_IFTYPE_MESH_POINT:
4301                 break;
4302         default:
4303                 err = -EOPNOTSUPP;
4304                 goto out_put_vlan;
4305         }
4306
4307         /* driver will call cfg80211_check_station_change() */
4308         err = rdev_change_station(rdev, dev, mac_addr, &params);
4309
4310  out_put_vlan:
4311         if (params.vlan)
4312                 dev_put(params.vlan);
4313
4314         return err;
4315 }
4316
4317 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
4318 {
4319         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4320         int err;
4321         struct net_device *dev = info->user_ptr[1];
4322         struct station_parameters params;
4323         u8 *mac_addr = NULL;
4324
4325         memset(&params, 0, sizeof(params));
4326
4327         if (!rdev->ops->add_station)
4328                 return -EOPNOTSUPP;
4329
4330         if (!info->attrs[NL80211_ATTR_MAC])
4331                 return -EINVAL;
4332
4333         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4334                 return -EINVAL;
4335
4336         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
4337                 return -EINVAL;
4338
4339         if (!info->attrs[NL80211_ATTR_STA_AID] &&
4340             !info->attrs[NL80211_ATTR_PEER_AID])
4341                 return -EINVAL;
4342
4343         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4344         params.supported_rates =
4345                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4346         params.supported_rates_len =
4347                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4348         params.listen_interval =
4349                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4350
4351         if (info->attrs[NL80211_ATTR_PEER_AID])
4352                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4353         else
4354                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4355         if (!params.aid || params.aid > IEEE80211_MAX_AID)
4356                 return -EINVAL;
4357
4358         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4359                 params.capability =
4360                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4361                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4362         }
4363
4364         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4365                 params.ext_capab =
4366                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4367                 params.ext_capab_len =
4368                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4369         }
4370
4371         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4372                 params.ht_capa =
4373                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4374
4375         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4376                 params.vht_capa =
4377                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4378
4379         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
4380                 params.opmode_notif_used = true;
4381                 params.opmode_notif =
4382                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
4383         }
4384
4385         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4386                 params.plink_action =
4387                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4388                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4389                         return -EINVAL;
4390         }
4391
4392         err = nl80211_parse_sta_channel_info(info, &params);
4393         if (err)
4394                 return err;
4395
4396         err = nl80211_parse_sta_wme(info, &params);
4397         if (err)
4398                 return err;
4399
4400         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4401                 return -EINVAL;
4402
4403         /* When you run into this, adjust the code below for the new flag */
4404         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4405
4406         switch (dev->ieee80211_ptr->iftype) {
4407         case NL80211_IFTYPE_AP:
4408         case NL80211_IFTYPE_AP_VLAN:
4409         case NL80211_IFTYPE_P2P_GO:
4410                 /* ignore WME attributes if iface/sta is not capable */
4411                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
4412                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
4413                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4414
4415                 /* TDLS peers cannot be added */
4416                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4417                     info->attrs[NL80211_ATTR_PEER_AID])
4418                         return -EINVAL;
4419                 /* but don't bother the driver with it */
4420                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4421
4422                 /* allow authenticated/associated only if driver handles it */
4423                 if (!(rdev->wiphy.features &
4424                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4425                     params.sta_flags_mask &
4426                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4427                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4428                         return -EINVAL;
4429
4430                 /* must be last in here for error handling */
4431                 params.vlan = get_vlan(info, rdev);
4432                 if (IS_ERR(params.vlan))
4433                         return PTR_ERR(params.vlan);
4434                 break;
4435         case NL80211_IFTYPE_MESH_POINT:
4436                 /* ignore uAPSD data */
4437                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4438
4439                 /* associated is disallowed */
4440                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
4441                         return -EINVAL;
4442                 /* TDLS peers cannot be added */
4443                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4444                     info->attrs[NL80211_ATTR_PEER_AID])
4445                         return -EINVAL;
4446                 break;
4447         case NL80211_IFTYPE_STATION:
4448         case NL80211_IFTYPE_P2P_CLIENT:
4449                 /* ignore uAPSD data */
4450                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4451
4452                 /* these are disallowed */
4453                 if (params.sta_flags_mask &
4454                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
4455                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4456                         return -EINVAL;
4457                 /* Only TDLS peers can be added */
4458                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4459                         return -EINVAL;
4460                 /* Can only add if TDLS ... */
4461                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
4462                         return -EOPNOTSUPP;
4463                 /* ... with external setup is supported */
4464                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
4465                         return -EOPNOTSUPP;
4466                 /*
4467                  * Older wpa_supplicant versions always mark the TDLS peer
4468                  * as authorized, but it shouldn't yet be.
4469                  */
4470                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4471                 break;
4472         default:
4473                 return -EOPNOTSUPP;
4474         }
4475
4476         /* be aware of params.vlan when changing code here */
4477
4478         err = rdev_add_station(rdev, dev, mac_addr, &params);
4479
4480         if (params.vlan)
4481                 dev_put(params.vlan);
4482         return err;
4483 }
4484
4485 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
4486 {
4487         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4488         struct net_device *dev = info->user_ptr[1];
4489         struct station_del_parameters params;
4490
4491         memset(&params, 0, sizeof(params));
4492
4493         if (info->attrs[NL80211_ATTR_MAC])
4494                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
4495
4496         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4497             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4498             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4499             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4500                 return -EINVAL;
4501
4502         if (!rdev->ops->del_station)
4503                 return -EOPNOTSUPP;
4504
4505         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
4506                 params.subtype =
4507                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
4508                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
4509                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
4510                         return -EINVAL;
4511         } else {
4512                 /* Default to Deauthentication frame */
4513                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
4514         }
4515
4516         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
4517                 params.reason_code =
4518                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4519                 if (params.reason_code == 0)
4520                         return -EINVAL; /* 0 is reserved */
4521         } else {
4522                 /* Default to reason code 2 */
4523                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
4524         }
4525
4526         return rdev_del_station(rdev, dev, &params);
4527 }
4528
4529 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4530                                 int flags, struct net_device *dev,
4531                                 u8 *dst, u8 *next_hop,
4532                                 struct mpath_info *pinfo)
4533 {
4534         void *hdr;
4535         struct nlattr *pinfoattr;
4536
4537         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
4538         if (!hdr)
4539                 return -1;
4540
4541         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4542             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
4543             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
4544             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
4545                 goto nla_put_failure;
4546
4547         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
4548         if (!pinfoattr)
4549                 goto nla_put_failure;
4550         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
4551             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
4552                         pinfo->frame_qlen))
4553                 goto nla_put_failure;
4554         if (((pinfo->filled & MPATH_INFO_SN) &&
4555              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
4556             ((pinfo->filled & MPATH_INFO_METRIC) &&
4557              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
4558                          pinfo->metric)) ||
4559             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
4560              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
4561                          pinfo->exptime)) ||
4562             ((pinfo->filled & MPATH_INFO_FLAGS) &&
4563              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
4564                         pinfo->flags)) ||
4565             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
4566              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
4567                          pinfo->discovery_timeout)) ||
4568             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
4569              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
4570                         pinfo->discovery_retries)))
4571                 goto nla_put_failure;
4572
4573         nla_nest_end(msg, pinfoattr);
4574
4575         genlmsg_end(msg, hdr);
4576         return 0;
4577
4578  nla_put_failure:
4579         genlmsg_cancel(msg, hdr);
4580         return -EMSGSIZE;
4581 }
4582
4583 static int nl80211_dump_mpath(struct sk_buff *skb,
4584                               struct netlink_callback *cb)
4585 {
4586         struct mpath_info pinfo;
4587         struct cfg80211_registered_device *rdev;
4588         struct wireless_dev *wdev;
4589         u8 dst[ETH_ALEN];
4590         u8 next_hop[ETH_ALEN];
4591         int path_idx = cb->args[2];
4592         int err;
4593
4594         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4595         if (err)
4596                 return err;
4597
4598         if (!rdev->ops->dump_mpath) {
4599                 err = -EOPNOTSUPP;
4600                 goto out_err;
4601         }
4602
4603         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4604                 err = -EOPNOTSUPP;
4605                 goto out_err;
4606         }
4607
4608         while (1) {
4609                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
4610                                       next_hop, &pinfo);
4611                 if (err == -ENOENT)
4612                         break;
4613                 if (err)
4614                         goto out_err;
4615
4616                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4617                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4618                                        wdev->netdev, dst, next_hop,
4619                                        &pinfo) < 0)
4620                         goto out;
4621
4622                 path_idx++;
4623         }
4624
4625
4626  out:
4627         cb->args[2] = path_idx;
4628         err = skb->len;
4629  out_err:
4630         nl80211_finish_wdev_dump(rdev);
4631         return err;
4632 }
4633
4634 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
4635 {
4636         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4637         int err;
4638         struct net_device *dev = info->user_ptr[1];
4639         struct mpath_info pinfo;
4640         struct sk_buff *msg;
4641         u8 *dst = NULL;
4642         u8 next_hop[ETH_ALEN];
4643
4644         memset(&pinfo, 0, sizeof(pinfo));
4645
4646         if (!info->attrs[NL80211_ATTR_MAC])
4647                 return -EINVAL;
4648
4649         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4650
4651         if (!rdev->ops->get_mpath)
4652                 return -EOPNOTSUPP;
4653
4654         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4655                 return -EOPNOTSUPP;
4656
4657         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4658         if (err)
4659                 return err;
4660
4661         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4662         if (!msg)
4663                 return -ENOMEM;
4664
4665         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4666                                  dev, dst, next_hop, &pinfo) < 0) {
4667                 nlmsg_free(msg);
4668                 return -ENOBUFS;
4669         }
4670
4671         return genlmsg_reply(msg, info);
4672 }
4673
4674 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
4675 {
4676         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4677         struct net_device *dev = info->user_ptr[1];
4678         u8 *dst = NULL;
4679         u8 *next_hop = NULL;
4680
4681         if (!info->attrs[NL80211_ATTR_MAC])
4682                 return -EINVAL;
4683
4684         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4685                 return -EINVAL;
4686
4687         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4688         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4689
4690         if (!rdev->ops->change_mpath)
4691                 return -EOPNOTSUPP;
4692
4693         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4694                 return -EOPNOTSUPP;
4695
4696         return rdev_change_mpath(rdev, dev, dst, next_hop);
4697 }
4698
4699 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
4700 {
4701         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4702         struct net_device *dev = info->user_ptr[1];
4703         u8 *dst = NULL;
4704         u8 *next_hop = NULL;
4705
4706         if (!info->attrs[NL80211_ATTR_MAC])
4707                 return -EINVAL;
4708
4709         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4710                 return -EINVAL;
4711
4712         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4713         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4714
4715         if (!rdev->ops->add_mpath)
4716                 return -EOPNOTSUPP;
4717
4718         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4719                 return -EOPNOTSUPP;
4720
4721         return rdev_add_mpath(rdev, dev, dst, next_hop);
4722 }
4723
4724 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
4725 {
4726         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4727         struct net_device *dev = info->user_ptr[1];
4728         u8 *dst = NULL;
4729
4730         if (info->attrs[NL80211_ATTR_MAC])
4731                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4732
4733         if (!rdev->ops->del_mpath)
4734                 return -EOPNOTSUPP;
4735
4736         return rdev_del_mpath(rdev, dev, dst);
4737 }
4738
4739 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
4740 {
4741         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4742         int err;
4743         struct net_device *dev = info->user_ptr[1];
4744         struct mpath_info pinfo;
4745         struct sk_buff *msg;
4746         u8 *dst = NULL;
4747         u8 mpp[ETH_ALEN];
4748
4749         memset(&pinfo, 0, sizeof(pinfo));
4750
4751         if (!info->attrs[NL80211_ATTR_MAC])
4752                 return -EINVAL;
4753
4754         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4755
4756         if (!rdev->ops->get_mpp)
4757                 return -EOPNOTSUPP;
4758
4759         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4760                 return -EOPNOTSUPP;
4761
4762         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
4763         if (err)
4764                 return err;
4765
4766         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4767         if (!msg)
4768                 return -ENOMEM;
4769
4770         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4771                                dev, dst, mpp, &pinfo) < 0) {
4772                 nlmsg_free(msg);
4773                 return -ENOBUFS;
4774         }
4775
4776         return genlmsg_reply(msg, info);
4777 }
4778
4779 static int nl80211_dump_mpp(struct sk_buff *skb,
4780                             struct netlink_callback *cb)
4781 {
4782         struct mpath_info pinfo;
4783         struct cfg80211_registered_device *rdev;
4784         struct wireless_dev *wdev;
4785         u8 dst[ETH_ALEN];
4786         u8 mpp[ETH_ALEN];
4787         int path_idx = cb->args[2];
4788         int err;
4789
4790         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4791         if (err)
4792                 return err;
4793
4794         if (!rdev->ops->dump_mpp) {
4795                 err = -EOPNOTSUPP;
4796                 goto out_err;
4797         }
4798
4799         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4800                 err = -EOPNOTSUPP;
4801                 goto out_err;
4802         }
4803
4804         while (1) {
4805                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
4806                                     mpp, &pinfo);
4807                 if (err == -ENOENT)
4808                         break;
4809                 if (err)
4810                         goto out_err;
4811
4812                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4813                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4814                                        wdev->netdev, dst, mpp,
4815                                        &pinfo) < 0)
4816                         goto out;
4817
4818                 path_idx++;
4819         }
4820
4821  out:
4822         cb->args[2] = path_idx;
4823         err = skb->len;
4824  out_err:
4825         nl80211_finish_wdev_dump(rdev);
4826         return err;
4827 }
4828
4829 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
4830 {
4831         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4832         struct net_device *dev = info->user_ptr[1];
4833         struct wireless_dev *wdev = dev->ieee80211_ptr;
4834         struct bss_parameters params;
4835         int err;
4836
4837         memset(&params, 0, sizeof(params));
4838         /* default to not changing parameters */
4839         params.use_cts_prot = -1;
4840         params.use_short_preamble = -1;
4841         params.use_short_slot_time = -1;
4842         params.ap_isolate = -1;
4843         params.ht_opmode = -1;
4844         params.p2p_ctwindow = -1;
4845         params.p2p_opp_ps = -1;
4846
4847         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
4848                 params.use_cts_prot =
4849                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
4850         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
4851                 params.use_short_preamble =
4852                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
4853         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
4854                 params.use_short_slot_time =
4855                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4856         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4857                 params.basic_rates =
4858                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4859                 params.basic_rates_len =
4860                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4861         }
4862         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
4863                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4864         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
4865                 params.ht_opmode =
4866                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4867
4868         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4869                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4870                         return -EINVAL;
4871                 params.p2p_ctwindow =
4872                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4873                 if (params.p2p_ctwindow < 0)
4874                         return -EINVAL;
4875                 if (params.p2p_ctwindow != 0 &&
4876                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4877                         return -EINVAL;
4878         }
4879
4880         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4881                 u8 tmp;
4882
4883                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4884                         return -EINVAL;
4885                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4886                 if (tmp > 1)
4887                         return -EINVAL;
4888                 params.p2p_opp_ps = tmp;
4889                 if (params.p2p_opp_ps &&
4890                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4891                         return -EINVAL;
4892         }
4893
4894         if (!rdev->ops->change_bss)
4895                 return -EOPNOTSUPP;
4896
4897         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4898             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4899                 return -EOPNOTSUPP;
4900
4901         wdev_lock(wdev);
4902         err = rdev_change_bss(rdev, dev, &params);
4903         wdev_unlock(wdev);
4904
4905         return err;
4906 }
4907
4908 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
4909         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
4910         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
4911         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
4912         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
4913         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
4914         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
4915         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
4916 };
4917
4918 static int parse_reg_rule(struct nlattr *tb[],
4919         struct ieee80211_reg_rule *reg_rule)
4920 {
4921         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
4922         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
4923
4924         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
4925                 return -EINVAL;
4926         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
4927                 return -EINVAL;
4928         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
4929                 return -EINVAL;
4930         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
4931                 return -EINVAL;
4932         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
4933                 return -EINVAL;
4934
4935         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
4936
4937         freq_range->start_freq_khz =
4938                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
4939         freq_range->end_freq_khz =
4940                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
4941         freq_range->max_bandwidth_khz =
4942                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
4943
4944         power_rule->max_eirp =
4945                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
4946
4947         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
4948                 power_rule->max_antenna_gain =
4949                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
4950
4951         if (tb[NL80211_ATTR_DFS_CAC_TIME])
4952                 reg_rule->dfs_cac_ms =
4953                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
4954
4955         return 0;
4956 }
4957
4958 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
4959 {
4960         char *data = NULL;
4961         enum nl80211_user_reg_hint_type user_reg_hint_type;
4962
4963         /*
4964          * You should only get this when cfg80211 hasn't yet initialized
4965          * completely when built-in to the kernel right between the time
4966          * window between nl80211_init() and regulatory_init(), if that is
4967          * even possible.
4968          */
4969         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4970                 return -EINPROGRESS;
4971
4972         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
4973                 user_reg_hint_type =
4974                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
4975         else
4976                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
4977
4978         switch (user_reg_hint_type) {
4979         case NL80211_USER_REG_HINT_USER:
4980         case NL80211_USER_REG_HINT_CELL_BASE:
4981                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4982                         return -EINVAL;
4983
4984                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4985                 return regulatory_hint_user(data, user_reg_hint_type);
4986         case NL80211_USER_REG_HINT_INDOOR:
4987                 return regulatory_hint_indoor_user();
4988         default:
4989                 return -EINVAL;
4990         }
4991 }
4992
4993 static int nl80211_get_mesh_config(struct sk_buff *skb,
4994                                    struct genl_info *info)
4995 {
4996         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4997         struct net_device *dev = info->user_ptr[1];
4998         struct wireless_dev *wdev = dev->ieee80211_ptr;
4999         struct mesh_config cur_params;
5000         int err = 0;
5001         void *hdr;
5002         struct nlattr *pinfoattr;
5003         struct sk_buff *msg;
5004
5005         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5006                 return -EOPNOTSUPP;
5007
5008         if (!rdev->ops->get_mesh_config)
5009                 return -EOPNOTSUPP;
5010
5011         wdev_lock(wdev);
5012         /* If not connected, get default parameters */
5013         if (!wdev->mesh_id_len)
5014                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
5015         else
5016                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
5017         wdev_unlock(wdev);
5018
5019         if (err)
5020                 return err;
5021
5022         /* Draw up a netlink message to send back */
5023         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5024         if (!msg)
5025                 return -ENOMEM;
5026         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5027                              NL80211_CMD_GET_MESH_CONFIG);
5028         if (!hdr)
5029                 goto out;
5030         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
5031         if (!pinfoattr)
5032                 goto nla_put_failure;
5033         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5034             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
5035                         cur_params.dot11MeshRetryTimeout) ||
5036             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5037                         cur_params.dot11MeshConfirmTimeout) ||
5038             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
5039                         cur_params.dot11MeshHoldingTimeout) ||
5040             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
5041                         cur_params.dot11MeshMaxPeerLinks) ||
5042             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
5043                        cur_params.dot11MeshMaxRetries) ||
5044             nla_put_u8(msg, NL80211_MESHCONF_TTL,
5045                        cur_params.dot11MeshTTL) ||
5046             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
5047                        cur_params.element_ttl) ||
5048             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5049                        cur_params.auto_open_plinks) ||
5050             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5051                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
5052             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5053                        cur_params.dot11MeshHWMPmaxPREQretries) ||
5054             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
5055                         cur_params.path_refresh_time) ||
5056             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5057                         cur_params.min_discovery_timeout) ||
5058             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5059                         cur_params.dot11MeshHWMPactivePathTimeout) ||
5060             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5061                         cur_params.dot11MeshHWMPpreqMinInterval) ||
5062             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5063                         cur_params.dot11MeshHWMPperrMinInterval) ||
5064             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5065                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
5066             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
5067                        cur_params.dot11MeshHWMPRootMode) ||
5068             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5069                         cur_params.dot11MeshHWMPRannInterval) ||
5070             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5071                        cur_params.dot11MeshGateAnnouncementProtocol) ||
5072             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
5073                        cur_params.dot11MeshForwarding) ||
5074             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
5075                         cur_params.rssi_threshold) ||
5076             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
5077                         cur_params.ht_opmode) ||
5078             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5079                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
5080             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5081                         cur_params.dot11MeshHWMProotInterval) ||
5082             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5083                         cur_params.dot11MeshHWMPconfirmationInterval) ||
5084             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
5085                         cur_params.power_mode) ||
5086             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
5087                         cur_params.dot11MeshAwakeWindowDuration) ||
5088             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
5089                         cur_params.plink_timeout))
5090                 goto nla_put_failure;
5091         nla_nest_end(msg, pinfoattr);
5092         genlmsg_end(msg, hdr);
5093         return genlmsg_reply(msg, info);
5094
5095  nla_put_failure:
5096         genlmsg_cancel(msg, hdr);
5097  out:
5098         nlmsg_free(msg);
5099         return -ENOBUFS;
5100 }
5101
5102 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
5103         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
5104         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
5105         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
5106         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
5107         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
5108         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
5109         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
5110         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
5111         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
5112         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
5113         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
5114         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
5115         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
5116         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
5117         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
5118         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
5119         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
5120         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
5121         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
5122         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
5123         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
5124         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
5125         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
5126         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
5127         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
5128         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
5129         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
5130         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
5131 };
5132
5133 static const struct nla_policy
5134         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
5135         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
5136         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
5137         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
5138         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
5139         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
5140         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
5141         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
5142                                     .len = IEEE80211_MAX_DATA_LEN },
5143         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
5144 };
5145
5146 static int nl80211_parse_mesh_config(struct genl_info *info,
5147                                      struct mesh_config *cfg,
5148                                      u32 *mask_out)
5149 {
5150         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
5151         u32 mask = 0;
5152
5153 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
5154 do {                                                                        \
5155         if (tb[attr]) {                                                     \
5156                 if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
5157                         return -EINVAL;                                     \
5158                 cfg->param = fn(tb[attr]);                                  \
5159                 mask |= (1 << (attr - 1));                                  \
5160         }                                                                   \
5161 } while (0)
5162
5163
5164         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
5165                 return -EINVAL;
5166         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
5167                              info->attrs[NL80211_ATTR_MESH_CONFIG],
5168                              nl80211_meshconf_params_policy))
5169                 return -EINVAL;
5170
5171         /* This makes sure that there aren't more than 32 mesh config
5172          * parameters (otherwise our bitfield scheme would not work.) */
5173         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
5174
5175         /* Fill in the params struct */
5176         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
5177                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
5178                                   nla_get_u16);
5179         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
5180                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5181                                   nla_get_u16);
5182         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
5183                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
5184                                   nla_get_u16);
5185         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
5186                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
5187                                   nla_get_u16);
5188         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
5189                                   mask, NL80211_MESHCONF_MAX_RETRIES,
5190                                   nla_get_u8);
5191         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
5192                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
5193         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
5194                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
5195                                   nla_get_u8);
5196         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
5197                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5198                                   nla_get_u8);
5199         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
5200                                   1, 255, mask,
5201                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5202                                   nla_get_u32);
5203         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
5204                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5205                                   nla_get_u8);
5206         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
5207                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
5208                                   nla_get_u32);
5209         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
5210                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5211                                   nla_get_u16);
5212         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
5213                                   1, 65535, mask,
5214                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5215                                   nla_get_u32);
5216         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
5217                                   1, 65535, mask,
5218                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5219                                   nla_get_u16);
5220         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
5221                                   1, 65535, mask,
5222                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5223                                   nla_get_u16);
5224         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5225                                   dot11MeshHWMPnetDiameterTraversalTime,
5226                                   1, 65535, mask,
5227                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5228                                   nla_get_u16);
5229         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
5230                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
5231                                   nla_get_u8);
5232         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
5233                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5234                                   nla_get_u16);
5235         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5236                                   dot11MeshGateAnnouncementProtocol, 0, 1,
5237                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5238                                   nla_get_u8);
5239         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
5240                                   mask, NL80211_MESHCONF_FORWARDING,
5241                                   nla_get_u8);
5242         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
5243                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
5244                                   nla_get_s32);
5245         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
5246                                   mask, NL80211_MESHCONF_HT_OPMODE,
5247                                   nla_get_u16);
5248         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
5249                                   1, 65535, mask,
5250                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5251                                   nla_get_u32);
5252         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
5253                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5254                                   nla_get_u16);
5255         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5256                                   dot11MeshHWMPconfirmationInterval,
5257                                   1, 65535, mask,
5258                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5259                                   nla_get_u16);
5260         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
5261                                   NL80211_MESH_POWER_ACTIVE,
5262                                   NL80211_MESH_POWER_MAX,
5263                                   mask, NL80211_MESHCONF_POWER_MODE,
5264                                   nla_get_u32);
5265         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
5266                                   0, 65535, mask,
5267                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
5268         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 1, 0xffffffff,
5269                                   mask, NL80211_MESHCONF_PLINK_TIMEOUT,
5270                                   nla_get_u32);
5271         if (mask_out)
5272                 *mask_out = mask;
5273
5274         return 0;
5275
5276 #undef FILL_IN_MESH_PARAM_IF_SET
5277 }
5278
5279 static int nl80211_parse_mesh_setup(struct genl_info *info,
5280                                      struct mesh_setup *setup)
5281 {
5282         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5283         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
5284
5285         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
5286                 return -EINVAL;
5287         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
5288                              info->attrs[NL80211_ATTR_MESH_SETUP],
5289                              nl80211_mesh_setup_params_policy))
5290                 return -EINVAL;
5291
5292         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
5293                 setup->sync_method =
5294                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
5295                  IEEE80211_SYNC_METHOD_VENDOR :
5296                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
5297
5298         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
5299                 setup->path_sel_proto =
5300                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
5301                  IEEE80211_PATH_PROTOCOL_VENDOR :
5302                  IEEE80211_PATH_PROTOCOL_HWMP;
5303
5304         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
5305                 setup->path_metric =
5306                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
5307                  IEEE80211_PATH_METRIC_VENDOR :
5308                  IEEE80211_PATH_METRIC_AIRTIME;
5309
5310
5311         if (tb[NL80211_MESH_SETUP_IE]) {
5312                 struct nlattr *ieattr =
5313                         tb[NL80211_MESH_SETUP_IE];
5314                 if (!is_valid_ie_attr(ieattr))
5315                         return -EINVAL;
5316                 setup->ie = nla_data(ieattr);
5317                 setup->ie_len = nla_len(ieattr);
5318         }
5319         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
5320             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
5321                 return -EINVAL;
5322         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
5323         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
5324         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
5325         if (setup->is_secure)
5326                 setup->user_mpm = true;
5327
5328         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
5329                 if (!setup->user_mpm)
5330                         return -EINVAL;
5331                 setup->auth_id =
5332                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
5333         }
5334
5335         return 0;
5336 }
5337
5338 static int nl80211_update_mesh_config(struct sk_buff *skb,
5339                                       struct genl_info *info)
5340 {
5341         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5342         struct net_device *dev = info->user_ptr[1];
5343         struct wireless_dev *wdev = dev->ieee80211_ptr;
5344         struct mesh_config cfg;
5345         u32 mask;
5346         int err;
5347
5348         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5349                 return -EOPNOTSUPP;
5350
5351         if (!rdev->ops->update_mesh_config)
5352                 return -EOPNOTSUPP;
5353
5354         err = nl80211_parse_mesh_config(info, &cfg, &mask);
5355         if (err)
5356                 return err;
5357
5358         wdev_lock(wdev);
5359         if (!wdev->mesh_id_len)
5360                 err = -ENOLINK;
5361
5362         if (!err)
5363                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
5364
5365         wdev_unlock(wdev);
5366
5367         return err;
5368 }
5369
5370 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
5371                               struct sk_buff *msg)
5372 {
5373         struct nlattr *nl_reg_rules;
5374         unsigned int i;
5375
5376         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
5377             (regdom->dfs_region &&
5378              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
5379                 goto nla_put_failure;
5380
5381         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
5382         if (!nl_reg_rules)
5383                 goto nla_put_failure;
5384
5385         for (i = 0; i < regdom->n_reg_rules; i++) {
5386                 struct nlattr *nl_reg_rule;
5387                 const struct ieee80211_reg_rule *reg_rule;
5388                 const struct ieee80211_freq_range *freq_range;
5389                 const struct ieee80211_power_rule *power_rule;
5390                 unsigned int max_bandwidth_khz;
5391
5392                 reg_rule = &regdom->reg_rules[i];
5393                 freq_range = &reg_rule->freq_range;
5394                 power_rule = &reg_rule->power_rule;
5395
5396                 nl_reg_rule = nla_nest_start(msg, i);
5397                 if (!nl_reg_rule)
5398                         goto nla_put_failure;
5399
5400                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
5401                 if (!max_bandwidth_khz)
5402                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
5403                                                                   reg_rule);
5404
5405                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
5406                                 reg_rule->flags) ||
5407                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
5408                                 freq_range->start_freq_khz) ||
5409                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
5410                                 freq_range->end_freq_khz) ||
5411                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
5412                                 max_bandwidth_khz) ||
5413                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
5414                                 power_rule->max_antenna_gain) ||
5415                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
5416                                 power_rule->max_eirp) ||
5417                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
5418                                 reg_rule->dfs_cac_ms))
5419                         goto nla_put_failure;
5420
5421                 nla_nest_end(msg, nl_reg_rule);
5422         }
5423
5424         nla_nest_end(msg, nl_reg_rules);
5425         return 0;
5426
5427 nla_put_failure:
5428         return -EMSGSIZE;
5429 }
5430
5431 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
5432 {
5433         const struct ieee80211_regdomain *regdom = NULL;
5434         struct cfg80211_registered_device *rdev;
5435         struct wiphy *wiphy = NULL;
5436         struct sk_buff *msg;
5437         void *hdr;
5438
5439         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5440         if (!msg)
5441                 return -ENOBUFS;
5442
5443         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5444                              NL80211_CMD_GET_REG);
5445         if (!hdr)
5446                 goto put_failure;
5447
5448         if (info->attrs[NL80211_ATTR_WIPHY]) {
5449                 bool self_managed;
5450
5451                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
5452                 if (IS_ERR(rdev)) {
5453                         nlmsg_free(msg);
5454                         return PTR_ERR(rdev);
5455                 }
5456
5457                 wiphy = &rdev->wiphy;
5458                 self_managed = wiphy->regulatory_flags &
5459                                REGULATORY_WIPHY_SELF_MANAGED;
5460                 regdom = get_wiphy_regdom(wiphy);
5461
5462                 /* a self-managed-reg device must have a private regdom */
5463                 if (WARN_ON(!regdom && self_managed)) {
5464                         nlmsg_free(msg);
5465                         return -EINVAL;
5466                 }
5467
5468                 if (regdom &&
5469                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
5470                         goto nla_put_failure;
5471         }
5472
5473         if (!wiphy && reg_last_request_cell_base() &&
5474             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
5475                         NL80211_USER_REG_HINT_CELL_BASE))
5476                 goto nla_put_failure;
5477
5478         rcu_read_lock();
5479
5480         if (!regdom)
5481                 regdom = rcu_dereference(cfg80211_regdomain);
5482
5483         if (nl80211_put_regdom(regdom, msg))
5484                 goto nla_put_failure_rcu;
5485
5486         rcu_read_unlock();
5487
5488         genlmsg_end(msg, hdr);
5489         return genlmsg_reply(msg, info);
5490
5491 nla_put_failure_rcu:
5492         rcu_read_unlock();
5493 nla_put_failure:
5494         genlmsg_cancel(msg, hdr);
5495 put_failure:
5496         nlmsg_free(msg);
5497         return -EMSGSIZE;
5498 }
5499
5500 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
5501                                u32 seq, int flags, struct wiphy *wiphy,
5502                                const struct ieee80211_regdomain *regdom)
5503 {
5504         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
5505                                    NL80211_CMD_GET_REG);
5506
5507         if (!hdr)
5508                 return -1;
5509
5510         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
5511
5512         if (nl80211_put_regdom(regdom, msg))
5513                 goto nla_put_failure;
5514
5515         if (!wiphy && reg_last_request_cell_base() &&
5516             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
5517                         NL80211_USER_REG_HINT_CELL_BASE))
5518                 goto nla_put_failure;
5519
5520         if (wiphy &&
5521             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
5522                 goto nla_put_failure;
5523
5524         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
5525             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
5526                 goto nla_put_failure;
5527
5528         genlmsg_end(msg, hdr);
5529         return 0;
5530
5531 nla_put_failure:
5532         genlmsg_cancel(msg, hdr);
5533         return -EMSGSIZE;
5534 }
5535
5536 static int nl80211_get_reg_dump(struct sk_buff *skb,
5537                                 struct netlink_callback *cb)
5538 {
5539         const struct ieee80211_regdomain *regdom = NULL;
5540         struct cfg80211_registered_device *rdev;
5541         int err, reg_idx, start = cb->args[2];
5542
5543         rtnl_lock();
5544
5545         if (cfg80211_regdomain && start == 0) {
5546                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
5547                                           NLM_F_MULTI, NULL,
5548                                           rtnl_dereference(cfg80211_regdomain));
5549                 if (err < 0)
5550                         goto out_err;
5551         }
5552
5553         /* the global regdom is idx 0 */
5554         reg_idx = 1;
5555         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
5556                 regdom = get_wiphy_regdom(&rdev->wiphy);
5557                 if (!regdom)
5558                         continue;
5559
5560                 if (++reg_idx <= start)
5561                         continue;
5562
5563                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
5564                                           NLM_F_MULTI, &rdev->wiphy, regdom);
5565                 if (err < 0) {
5566                         reg_idx--;
5567                         break;
5568                 }
5569         }
5570
5571         cb->args[2] = reg_idx;
5572         err = skb->len;
5573 out_err:
5574         rtnl_unlock();
5575         return err;
5576 }
5577
5578 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
5579 {
5580         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
5581         struct nlattr *nl_reg_rule;
5582         char *alpha2;
5583         int rem_reg_rules, r;
5584         u32 num_rules = 0, rule_idx = 0, size_of_regd;
5585         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
5586         struct ieee80211_regdomain *rd;
5587
5588         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5589                 return -EINVAL;
5590
5591         if (!info->attrs[NL80211_ATTR_REG_RULES])
5592                 return -EINVAL;
5593
5594         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5595
5596         if (info->attrs[NL80211_ATTR_DFS_REGION])
5597                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
5598
5599         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5600                             rem_reg_rules) {
5601                 num_rules++;
5602                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
5603                         return -EINVAL;
5604         }
5605
5606         if (!reg_is_valid_request(alpha2))
5607                 return -EINVAL;
5608
5609         size_of_regd = sizeof(struct ieee80211_regdomain) +
5610                        num_rules * sizeof(struct ieee80211_reg_rule);
5611
5612         rd = kzalloc(size_of_regd, GFP_KERNEL);
5613         if (!rd)
5614                 return -ENOMEM;
5615
5616         rd->n_reg_rules = num_rules;
5617         rd->alpha2[0] = alpha2[0];
5618         rd->alpha2[1] = alpha2[1];
5619
5620         /*
5621          * Disable DFS master mode if the DFS region was
5622          * not supported or known on this kernel.
5623          */
5624         if (reg_supported_dfs_region(dfs_region))
5625                 rd->dfs_region = dfs_region;
5626
5627         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5628                             rem_reg_rules) {
5629                 r = nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
5630                               nla_data(nl_reg_rule), nla_len(nl_reg_rule),
5631                               reg_rule_policy);
5632                 if (r)
5633                         goto bad_reg;
5634                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
5635                 if (r)
5636                         goto bad_reg;
5637
5638                 rule_idx++;
5639
5640                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
5641                         r = -EINVAL;
5642                         goto bad_reg;
5643                 }
5644         }
5645
5646         r = set_regdom(rd);
5647         /* set_regdom took ownership */
5648         rd = NULL;
5649
5650  bad_reg:
5651         kfree(rd);
5652         return r;
5653 }
5654
5655 static int validate_scan_freqs(struct nlattr *freqs)
5656 {
5657         struct nlattr *attr1, *attr2;
5658         int n_channels = 0, tmp1, tmp2;
5659
5660         nla_for_each_nested(attr1, freqs, tmp1) {
5661                 n_channels++;
5662                 /*
5663                  * Some hardware has a limited channel list for
5664                  * scanning, and it is pretty much nonsensical
5665                  * to scan for a channel twice, so disallow that
5666                  * and don't require drivers to check that the
5667                  * channel list they get isn't longer than what
5668                  * they can scan, as long as they can scan all
5669                  * the channels they registered at once.
5670                  */
5671                 nla_for_each_nested(attr2, freqs, tmp2)
5672                         if (attr1 != attr2 &&
5673                             nla_get_u32(attr1) == nla_get_u32(attr2))
5674                                 return 0;
5675         }
5676
5677         return n_channels;
5678 }
5679
5680 static int nl80211_parse_random_mac(struct nlattr **attrs,
5681                                     u8 *mac_addr, u8 *mac_addr_mask)
5682 {
5683         int i;
5684
5685         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
5686                 memset(mac_addr, 0, ETH_ALEN);
5687                 memset(mac_addr_mask, 0, ETH_ALEN);
5688                 mac_addr[0] = 0x2;
5689                 mac_addr_mask[0] = 0x3;
5690
5691                 return 0;
5692         }
5693
5694         /* need both or none */
5695         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
5696                 return -EINVAL;
5697
5698         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
5699         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
5700
5701         /* don't allow or configure an mcast address */
5702         if (!is_multicast_ether_addr(mac_addr_mask) ||
5703             is_multicast_ether_addr(mac_addr))
5704                 return -EINVAL;
5705
5706         /*
5707          * allow users to pass a MAC address that has bits set outside
5708          * of the mask, but don't bother drivers with having to deal
5709          * with such bits
5710          */
5711         for (i = 0; i < ETH_ALEN; i++)
5712                 mac_addr[i] &= mac_addr_mask[i];
5713
5714         return 0;
5715 }
5716
5717 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
5718 {
5719         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5720         struct wireless_dev *wdev = info->user_ptr[1];
5721         struct cfg80211_scan_request *request;
5722         struct nlattr *attr;
5723         struct wiphy *wiphy;
5724         int err, tmp, n_ssids = 0, n_channels, i;
5725         size_t ie_len;
5726
5727         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5728                 return -EINVAL;
5729
5730         wiphy = &rdev->wiphy;
5731
5732         if (!rdev->ops->scan)
5733                 return -EOPNOTSUPP;
5734
5735         if (rdev->scan_req || rdev->scan_msg) {
5736                 err = -EBUSY;
5737                 goto unlock;
5738         }
5739
5740         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5741                 n_channels = validate_scan_freqs(
5742                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5743                 if (!n_channels) {
5744                         err = -EINVAL;
5745                         goto unlock;
5746                 }
5747         } else {
5748                 n_channels = ieee80211_get_num_supported_channels(wiphy);
5749         }
5750
5751         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5752                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
5753                         n_ssids++;
5754
5755         if (n_ssids > wiphy->max_scan_ssids) {
5756                 err = -EINVAL;
5757                 goto unlock;
5758         }
5759
5760         if (info->attrs[NL80211_ATTR_IE])
5761                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5762         else
5763                 ie_len = 0;
5764
5765         if (ie_len > wiphy->max_scan_ie_len) {
5766                 err = -EINVAL;
5767                 goto unlock;
5768         }
5769
5770         request = kzalloc(sizeof(*request)
5771                         + sizeof(*request->ssids) * n_ssids
5772                         + sizeof(*request->channels) * n_channels
5773                         + ie_len, GFP_KERNEL);
5774         if (!request) {
5775                 err = -ENOMEM;
5776                 goto unlock;
5777         }
5778
5779         if (n_ssids)
5780                 request->ssids = (void *)&request->channels[n_channels];
5781         request->n_ssids = n_ssids;
5782         if (ie_len) {
5783                 if (n_ssids)
5784                         request->ie = (void *)(request->ssids + n_ssids);
5785                 else
5786                         request->ie = (void *)(request->channels + n_channels);
5787         }
5788
5789         i = 0;
5790         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5791                 /* user specified, bail out if channel not found */
5792                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
5793                         struct ieee80211_channel *chan;
5794
5795                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5796
5797                         if (!chan) {
5798                                 err = -EINVAL;
5799                                 goto out_free;
5800                         }
5801
5802                         /* ignore disabled channels */
5803                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5804                                 continue;
5805
5806                         request->channels[i] = chan;
5807                         i++;
5808                 }
5809         } else {
5810                 enum ieee80211_band band;
5811
5812                 /* all channels */
5813                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5814                         int j;
5815                         if (!wiphy->bands[band])
5816                                 continue;
5817                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5818                                 struct ieee80211_channel *chan;
5819
5820                                 chan = &wiphy->bands[band]->channels[j];
5821
5822                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5823                                         continue;
5824
5825                                 request->channels[i] = chan;
5826                                 i++;
5827                         }
5828                 }
5829         }
5830
5831         if (!i) {
5832                 err = -EINVAL;
5833                 goto out_free;
5834         }
5835
5836         request->n_channels = i;
5837
5838         i = 0;
5839         if (n_ssids) {
5840                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
5841                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5842                                 err = -EINVAL;
5843                                 goto out_free;
5844                         }
5845                         request->ssids[i].ssid_len = nla_len(attr);
5846                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
5847                         i++;
5848                 }
5849         }
5850
5851         if (info->attrs[NL80211_ATTR_IE]) {
5852                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5853                 memcpy((void *)request->ie,
5854                        nla_data(info->attrs[NL80211_ATTR_IE]),
5855                        request->ie_len);
5856         }
5857
5858         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
5859                 if (wiphy->bands[i])
5860                         request->rates[i] =
5861                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
5862
5863         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
5864                 nla_for_each_nested(attr,
5865                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
5866                                     tmp) {
5867                         enum ieee80211_band band = nla_type(attr);
5868
5869                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
5870                                 err = -EINVAL;
5871                                 goto out_free;
5872                         }
5873
5874                         if (!wiphy->bands[band])
5875                                 continue;
5876
5877                         err = ieee80211_get_ratemask(wiphy->bands[band],
5878                                                      nla_data(attr),
5879                                                      nla_len(attr),
5880                                                      &request->rates[band]);
5881                         if (err)
5882                                 goto out_free;
5883                 }
5884         }
5885
5886         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5887                 request->flags = nla_get_u32(
5888                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5889                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5890                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
5891                         err = -EOPNOTSUPP;
5892                         goto out_free;
5893                 }
5894
5895                 if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
5896                         if (!(wiphy->features &
5897                                         NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR)) {
5898                                 err = -EOPNOTSUPP;
5899                                 goto out_free;
5900                         }
5901
5902                         if (wdev->current_bss) {
5903                                 err = -EOPNOTSUPP;
5904                                 goto out_free;
5905                         }
5906
5907                         err = nl80211_parse_random_mac(info->attrs,
5908                                                        request->mac_addr,
5909                                                        request->mac_addr_mask);
5910                         if (err)
5911                                 goto out_free;
5912                 }
5913         }
5914
5915         request->no_cck =
5916                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
5917
5918         request->wdev = wdev;
5919         request->wiphy = &rdev->wiphy;
5920         request->scan_start = jiffies;
5921
5922         rdev->scan_req = request;
5923         err = rdev_scan(rdev, request);
5924
5925         if (!err) {
5926                 nl80211_send_scan_start(rdev, wdev);
5927                 if (wdev->netdev)
5928                         dev_hold(wdev->netdev);
5929         } else {
5930  out_free:
5931                 rdev->scan_req = NULL;
5932                 kfree(request);
5933         }
5934
5935  unlock:
5936         return err;
5937 }
5938
5939 static struct cfg80211_sched_scan_request *
5940 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
5941                          struct nlattr **attrs)
5942 {
5943         struct cfg80211_sched_scan_request *request;
5944         struct nlattr *attr;
5945         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
5946         u32 interval;
5947         enum ieee80211_band band;
5948         size_t ie_len;
5949         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
5950         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
5951
5952         if (!is_valid_ie_attr(attrs[NL80211_ATTR_IE]))
5953                 return ERR_PTR(-EINVAL);
5954
5955         if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
5956                 return ERR_PTR(-EINVAL);
5957
5958         interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
5959         if (interval == 0)
5960                 return ERR_PTR(-EINVAL);
5961
5962         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5963                 n_channels = validate_scan_freqs(
5964                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5965                 if (!n_channels)
5966                         return ERR_PTR(-EINVAL);
5967         } else {
5968                 n_channels = ieee80211_get_num_supported_channels(wiphy);
5969         }
5970
5971         if (attrs[NL80211_ATTR_SCAN_SSIDS])
5972                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
5973                                     tmp)
5974                         n_ssids++;
5975
5976         if (n_ssids > wiphy->max_sched_scan_ssids)
5977                 return ERR_PTR(-EINVAL);
5978
5979         /*
5980          * First, count the number of 'real' matchsets. Due to an issue with
5981          * the old implementation, matchsets containing only the RSSI attribute
5982          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
5983          * RSSI for all matchsets, rather than their own matchset for reporting
5984          * all APs with a strong RSSI. This is needed to be compatible with
5985          * older userspace that treated a matchset with only the RSSI as the
5986          * global RSSI for all other matchsets - if there are other matchsets.
5987          */
5988         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5989                 nla_for_each_nested(attr,
5990                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5991                                     tmp) {
5992                         struct nlattr *rssi;
5993
5994                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5995                                         nla_data(attr), nla_len(attr),
5996                                         nl80211_match_policy);
5997                         if (err)
5998                                 return ERR_PTR(err);
5999                         /* add other standalone attributes here */
6000                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]) {
6001                                 n_match_sets++;
6002                                 continue;
6003                         }
6004                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
6005                         if (rssi)
6006                                 default_match_rssi = nla_get_s32(rssi);
6007                 }
6008         }
6009
6010         /* However, if there's no other matchset, add the RSSI one */
6011         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
6012                 n_match_sets = 1;
6013
6014         if (n_match_sets > wiphy->max_match_sets)
6015                 return ERR_PTR(-EINVAL);
6016
6017         if (attrs[NL80211_ATTR_IE])
6018                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
6019         else
6020                 ie_len = 0;
6021
6022         if (ie_len > wiphy->max_sched_scan_ie_len)
6023                 return ERR_PTR(-EINVAL);
6024
6025         request = kzalloc(sizeof(*request)
6026                         + sizeof(*request->ssids) * n_ssids
6027                         + sizeof(*request->match_sets) * n_match_sets
6028                         + sizeof(*request->channels) * n_channels
6029                         + ie_len, GFP_KERNEL);
6030         if (!request)
6031                 return ERR_PTR(-ENOMEM);
6032
6033         if (n_ssids)
6034                 request->ssids = (void *)&request->channels[n_channels];
6035         request->n_ssids = n_ssids;
6036         if (ie_len) {
6037                 if (n_ssids)
6038                         request->ie = (void *)(request->ssids + n_ssids);
6039                 else
6040                         request->ie = (void *)(request->channels + n_channels);
6041         }
6042
6043         if (n_match_sets) {
6044                 if (request->ie)
6045                         request->match_sets = (void *)(request->ie + ie_len);
6046                 else if (n_ssids)
6047                         request->match_sets =
6048                                 (void *)(request->ssids + n_ssids);
6049                 else
6050                         request->match_sets =
6051                                 (void *)(request->channels + n_channels);
6052         }
6053         request->n_match_sets = n_match_sets;
6054
6055         i = 0;
6056         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6057                 /* user specified, bail out if channel not found */
6058                 nla_for_each_nested(attr,
6059                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
6060                                     tmp) {
6061                         struct ieee80211_channel *chan;
6062
6063                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
6064
6065                         if (!chan) {
6066                                 err = -EINVAL;
6067                                 goto out_free;
6068                         }
6069
6070                         /* ignore disabled channels */
6071                         if (chan->flags & IEEE80211_CHAN_DISABLED)
6072                                 continue;
6073
6074                         request->channels[i] = chan;
6075                         i++;
6076                 }
6077         } else {
6078                 /* all channels */
6079                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
6080                         int j;
6081                         if (!wiphy->bands[band])
6082                                 continue;
6083                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
6084                                 struct ieee80211_channel *chan;
6085
6086                                 chan = &wiphy->bands[band]->channels[j];
6087
6088                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
6089                                         continue;
6090
6091                                 request->channels[i] = chan;
6092                                 i++;
6093                         }
6094                 }
6095         }
6096
6097         if (!i) {
6098                 err = -EINVAL;
6099                 goto out_free;
6100         }
6101
6102         request->n_channels = i;
6103
6104         i = 0;
6105         if (n_ssids) {
6106                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
6107                                     tmp) {
6108                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
6109                                 err = -EINVAL;
6110                                 goto out_free;
6111                         }
6112                         request->ssids[i].ssid_len = nla_len(attr);
6113                         memcpy(request->ssids[i].ssid, nla_data(attr),
6114                                nla_len(attr));
6115                         i++;
6116                 }
6117         }
6118
6119         i = 0;
6120         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
6121                 nla_for_each_nested(attr,
6122                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
6123                                     tmp) {
6124                         struct nlattr *ssid, *rssi;
6125
6126                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
6127                                         nla_data(attr), nla_len(attr),
6128                                         nl80211_match_policy);
6129                         if (err)
6130                                 goto out_free;
6131                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
6132                         if (ssid) {
6133                                 if (WARN_ON(i >= n_match_sets)) {
6134                                         /* this indicates a programming error,
6135                                          * the loop above should have verified
6136                                          * things properly
6137                                          */
6138                                         err = -EINVAL;
6139                                         goto out_free;
6140                                 }
6141
6142                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
6143                                         err = -EINVAL;
6144                                         goto out_free;
6145                                 }
6146                                 memcpy(request->match_sets[i].ssid.ssid,
6147                                        nla_data(ssid), nla_len(ssid));
6148                                 request->match_sets[i].ssid.ssid_len =
6149                                         nla_len(ssid);
6150                                 /* special attribute - old implemenation w/a */
6151                                 request->match_sets[i].rssi_thold =
6152                                         default_match_rssi;
6153                                 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
6154                                 if (rssi)
6155                                         request->match_sets[i].rssi_thold =
6156                                                 nla_get_s32(rssi);
6157                         }
6158                         i++;
6159                 }
6160
6161                 /* there was no other matchset, so the RSSI one is alone */
6162                 if (i == 0 && n_match_sets)
6163                         request->match_sets[0].rssi_thold = default_match_rssi;
6164
6165                 request->min_rssi_thold = INT_MAX;
6166                 for (i = 0; i < n_match_sets; i++)
6167                         request->min_rssi_thold =
6168                                 min(request->match_sets[i].rssi_thold,
6169                                     request->min_rssi_thold);
6170         } else {
6171                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
6172         }
6173
6174         if (ie_len) {
6175                 request->ie_len = ie_len;
6176                 memcpy((void *)request->ie,
6177                        nla_data(attrs[NL80211_ATTR_IE]),
6178                        request->ie_len);
6179         }
6180
6181         if (attrs[NL80211_ATTR_SCAN_FLAGS]) {
6182                 request->flags = nla_get_u32(
6183                         attrs[NL80211_ATTR_SCAN_FLAGS]);
6184                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
6185                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
6186                         err = -EOPNOTSUPP;
6187                         goto out_free;
6188                 }
6189
6190                 if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
6191                         u32 flg = NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
6192
6193                         if (!wdev) /* must be net-detect */
6194                                 flg = NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
6195
6196                         if (!(wiphy->features & flg)) {
6197                                 err = -EOPNOTSUPP;
6198                                 goto out_free;
6199                         }
6200
6201                         if (wdev && wdev->current_bss) {
6202                                 err = -EOPNOTSUPP;
6203                                 goto out_free;
6204                         }
6205
6206                         err = nl80211_parse_random_mac(attrs, request->mac_addr,
6207                                                        request->mac_addr_mask);
6208                         if (err)
6209                                 goto out_free;
6210                 }
6211         }
6212
6213         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
6214                 request->delay =
6215                         nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
6216
6217         request->interval = interval;
6218         request->scan_start = jiffies;
6219
6220         return request;
6221
6222 out_free:
6223         kfree(request);
6224         return ERR_PTR(err);
6225 }
6226
6227 static int nl80211_start_sched_scan(struct sk_buff *skb,
6228                                     struct genl_info *info)
6229 {
6230         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6231         struct net_device *dev = info->user_ptr[1];
6232         struct wireless_dev *wdev = dev->ieee80211_ptr;
6233         struct cfg80211_sched_scan_request *sched_scan_req;
6234         int err;
6235
6236         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
6237             !rdev->ops->sched_scan_start)
6238                 return -EOPNOTSUPP;
6239
6240         if (rdev->sched_scan_req)
6241                 return -EINPROGRESS;
6242
6243         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
6244                                                   info->attrs);
6245
6246         err = PTR_ERR_OR_ZERO(sched_scan_req);
6247         if (err)
6248                 goto out_err;
6249
6250         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
6251         if (err)
6252                 goto out_free;
6253
6254         sched_scan_req->dev = dev;
6255         sched_scan_req->wiphy = &rdev->wiphy;
6256
6257         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
6258                 sched_scan_req->owner_nlportid = info->snd_portid;
6259
6260         rcu_assign_pointer(rdev->sched_scan_req, sched_scan_req);
6261
6262         nl80211_send_sched_scan(rdev, dev,
6263                                 NL80211_CMD_START_SCHED_SCAN);
6264         return 0;
6265
6266 out_free:
6267         kfree(sched_scan_req);
6268 out_err:
6269         return err;
6270 }
6271
6272 static int nl80211_stop_sched_scan(struct sk_buff *skb,
6273                                    struct genl_info *info)
6274 {
6275         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6276
6277         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
6278             !rdev->ops->sched_scan_stop)
6279                 return -EOPNOTSUPP;
6280
6281         return __cfg80211_stop_sched_scan(rdev, false);
6282 }
6283
6284 static int nl80211_start_radar_detection(struct sk_buff *skb,
6285                                          struct genl_info *info)
6286 {
6287         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6288         struct net_device *dev = info->user_ptr[1];
6289         struct wireless_dev *wdev = dev->ieee80211_ptr;
6290         struct cfg80211_chan_def chandef;
6291         enum nl80211_dfs_regions dfs_region;
6292         unsigned int cac_time_ms;
6293         int err;
6294
6295         dfs_region = reg_get_dfs_region(wdev->wiphy);
6296         if (dfs_region == NL80211_DFS_UNSET)
6297                 return -EINVAL;
6298
6299         err = nl80211_parse_chandef(rdev, info, &chandef);
6300         if (err)
6301                 return err;
6302
6303         if (netif_carrier_ok(dev))
6304                 return -EBUSY;
6305
6306         if (wdev->cac_started)
6307                 return -EBUSY;
6308
6309         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef,
6310                                             wdev->iftype);
6311         if (err < 0)
6312                 return err;
6313
6314         if (err == 0)
6315                 return -EINVAL;
6316
6317         if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef))
6318                 return -EINVAL;
6319
6320         if (!rdev->ops->start_radar_detection)
6321                 return -EOPNOTSUPP;
6322
6323         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
6324         if (WARN_ON(!cac_time_ms))
6325                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
6326
6327         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef,
6328                                                cac_time_ms);
6329         if (!err) {
6330                 wdev->chandef = chandef;
6331                 wdev->cac_started = true;
6332                 wdev->cac_start_time = jiffies;
6333                 wdev->cac_time_ms = cac_time_ms;
6334         }
6335         return err;
6336 }
6337
6338 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
6339 {
6340         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6341         struct net_device *dev = info->user_ptr[1];
6342         struct wireless_dev *wdev = dev->ieee80211_ptr;
6343         struct cfg80211_csa_settings params;
6344         /* csa_attrs is defined static to avoid waste of stack size - this
6345          * function is called under RTNL lock, so this should not be a problem.
6346          */
6347         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
6348         int err;
6349         bool need_new_beacon = false;
6350         int len, i;
6351         u32 cs_count;
6352
6353         if (!rdev->ops->channel_switch ||
6354             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
6355                 return -EOPNOTSUPP;
6356
6357         switch (dev->ieee80211_ptr->iftype) {
6358         case NL80211_IFTYPE_AP:
6359         case NL80211_IFTYPE_P2P_GO:
6360                 need_new_beacon = true;
6361
6362                 /* useless if AP is not running */
6363                 if (!wdev->beacon_interval)
6364                         return -ENOTCONN;
6365                 break;
6366         case NL80211_IFTYPE_ADHOC:
6367                 if (!wdev->ssid_len)
6368                         return -ENOTCONN;
6369                 break;
6370         case NL80211_IFTYPE_MESH_POINT:
6371                 if (!wdev->mesh_id_len)
6372                         return -ENOTCONN;
6373                 break;
6374         default:
6375                 return -EOPNOTSUPP;
6376         }
6377
6378         memset(&params, 0, sizeof(params));
6379
6380         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
6381             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
6382                 return -EINVAL;
6383
6384         /* only important for AP, IBSS and mesh create IEs internally */
6385         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
6386                 return -EINVAL;
6387
6388         /* Even though the attribute is u32, the specification says
6389          * u8, so let's make sure we don't overflow.
6390          */
6391         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
6392         if (cs_count > 255)
6393                 return -EINVAL;
6394
6395         params.count = cs_count;
6396
6397         if (!need_new_beacon)
6398                 goto skip_beacons;
6399
6400         err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
6401         if (err)
6402                 return err;
6403
6404         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
6405                                info->attrs[NL80211_ATTR_CSA_IES],
6406                                nl80211_policy);
6407         if (err)
6408                 return err;
6409
6410         err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
6411         if (err)
6412                 return err;
6413
6414         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
6415                 return -EINVAL;
6416
6417         len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
6418         if (!len || (len % sizeof(u16)))
6419                 return -EINVAL;
6420
6421         params.n_counter_offsets_beacon = len / sizeof(u16);
6422         if (rdev->wiphy.max_num_csa_counters &&
6423             (params.n_counter_offsets_beacon >
6424              rdev->wiphy.max_num_csa_counters))
6425                 return -EINVAL;
6426
6427         params.counter_offsets_beacon =
6428                 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
6429
6430         /* sanity checks - counters should fit and be the same */
6431         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
6432                 u16 offset = params.counter_offsets_beacon[i];
6433
6434                 if (offset >= params.beacon_csa.tail_len)
6435                         return -EINVAL;
6436
6437                 if (params.beacon_csa.tail[offset] != params.count)
6438                         return -EINVAL;
6439         }
6440
6441         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
6442                 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
6443                 if (!len || (len % sizeof(u16)))
6444                         return -EINVAL;
6445
6446                 params.n_counter_offsets_presp = len / sizeof(u16);
6447                 if (rdev->wiphy.max_num_csa_counters &&
6448                     (params.n_counter_offsets_beacon >
6449                      rdev->wiphy.max_num_csa_counters))
6450                         return -EINVAL;
6451
6452                 params.counter_offsets_presp =
6453                         nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
6454
6455                 /* sanity checks - counters should fit and be the same */
6456                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
6457                         u16 offset = params.counter_offsets_presp[i];
6458
6459                         if (offset >= params.beacon_csa.probe_resp_len)
6460                                 return -EINVAL;
6461
6462                         if (params.beacon_csa.probe_resp[offset] !=
6463                             params.count)
6464                                 return -EINVAL;
6465                 }
6466         }
6467
6468 skip_beacons:
6469         err = nl80211_parse_chandef(rdev, info, &params.chandef);
6470         if (err)
6471                 return err;
6472
6473         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef,
6474                                      wdev->iftype))
6475                 return -EINVAL;
6476
6477         err = cfg80211_chandef_dfs_required(wdev->wiphy,
6478                                             &params.chandef,
6479                                             wdev->iftype);
6480         if (err < 0)
6481                 return err;
6482
6483         if (err > 0)
6484                 params.radar_required = true;
6485
6486         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
6487                 params.block_tx = true;
6488
6489         wdev_lock(wdev);
6490         err = rdev_channel_switch(rdev, dev, &params);
6491         wdev_unlock(wdev);
6492
6493         return err;
6494 }
6495
6496 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
6497                             u32 seq, int flags,
6498                             struct cfg80211_registered_device *rdev,
6499                             struct wireless_dev *wdev,
6500                             struct cfg80211_internal_bss *intbss)
6501 {
6502         struct cfg80211_bss *res = &intbss->pub;
6503         const struct cfg80211_bss_ies *ies;
6504         void *hdr;
6505         struct nlattr *bss;
6506
6507         ASSERT_WDEV_LOCK(wdev);
6508
6509         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6510                              NL80211_CMD_NEW_SCAN_RESULTS);
6511         if (!hdr)
6512                 return -1;
6513
6514         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
6515
6516         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
6517                 goto nla_put_failure;
6518         if (wdev->netdev &&
6519             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
6520                 goto nla_put_failure;
6521         if (nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
6522                 goto nla_put_failure;
6523
6524         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
6525         if (!bss)
6526                 goto nla_put_failure;
6527         if ((!is_zero_ether_addr(res->bssid) &&
6528              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
6529                 goto nla_put_failure;
6530
6531         rcu_read_lock();
6532         /* indicate whether we have probe response data or not */
6533         if (rcu_access_pointer(res->proberesp_ies) &&
6534             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
6535                 goto fail_unlock_rcu;
6536
6537         /* this pointer prefers to be pointed to probe response data
6538          * but is always valid
6539          */
6540         ies = rcu_dereference(res->ies);
6541         if (ies) {
6542                 if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
6543                         goto fail_unlock_rcu;
6544                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
6545                                         ies->len, ies->data))
6546                         goto fail_unlock_rcu;
6547         }
6548
6549         /* and this pointer is always (unless driver didn't know) beacon data */
6550         ies = rcu_dereference(res->beacon_ies);
6551         if (ies && ies->from_beacon) {
6552                 if (nla_put_u64(msg, NL80211_BSS_BEACON_TSF, ies->tsf))
6553                         goto fail_unlock_rcu;
6554                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
6555                                         ies->len, ies->data))
6556                         goto fail_unlock_rcu;
6557         }
6558         rcu_read_unlock();
6559
6560         if (res->beacon_interval &&
6561             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
6562                 goto nla_put_failure;
6563         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
6564             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
6565             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
6566             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
6567                         jiffies_to_msecs(jiffies - intbss->ts)))
6568                 goto nla_put_failure;
6569
6570         switch (rdev->wiphy.signal_type) {
6571         case CFG80211_SIGNAL_TYPE_MBM:
6572                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
6573                         goto nla_put_failure;
6574                 break;
6575         case CFG80211_SIGNAL_TYPE_UNSPEC:
6576                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
6577                         goto nla_put_failure;
6578                 break;
6579         default:
6580                 break;
6581         }
6582
6583         switch (wdev->iftype) {
6584         case NL80211_IFTYPE_P2P_CLIENT:
6585         case NL80211_IFTYPE_STATION:
6586                 if (intbss == wdev->current_bss &&
6587                     nla_put_u32(msg, NL80211_BSS_STATUS,
6588                                 NL80211_BSS_STATUS_ASSOCIATED))
6589                         goto nla_put_failure;
6590                 break;
6591         case NL80211_IFTYPE_ADHOC:
6592                 if (intbss == wdev->current_bss &&
6593                     nla_put_u32(msg, NL80211_BSS_STATUS,
6594                                 NL80211_BSS_STATUS_IBSS_JOINED))
6595                         goto nla_put_failure;
6596                 break;
6597         default:
6598                 break;
6599         }
6600
6601         nla_nest_end(msg, bss);
6602
6603         genlmsg_end(msg, hdr);
6604         return 0;
6605
6606  fail_unlock_rcu:
6607         rcu_read_unlock();
6608  nla_put_failure:
6609         genlmsg_cancel(msg, hdr);
6610         return -EMSGSIZE;
6611 }
6612
6613 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
6614 {
6615         struct cfg80211_registered_device *rdev;
6616         struct cfg80211_internal_bss *scan;
6617         struct wireless_dev *wdev;
6618         int start = cb->args[2], idx = 0;
6619         int err;
6620
6621         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
6622         if (err)
6623                 return err;
6624
6625         wdev_lock(wdev);
6626         spin_lock_bh(&rdev->bss_lock);
6627         cfg80211_bss_expire(rdev);
6628
6629         cb->seq = rdev->bss_generation;
6630
6631         list_for_each_entry(scan, &rdev->bss_list, list) {
6632                 if (++idx <= start)
6633                         continue;
6634                 if (nl80211_send_bss(skb, cb,
6635                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6636                                 rdev, wdev, scan) < 0) {
6637                         idx--;
6638                         break;
6639                 }
6640         }
6641
6642         spin_unlock_bh(&rdev->bss_lock);
6643         wdev_unlock(wdev);
6644
6645         cb->args[2] = idx;
6646         nl80211_finish_wdev_dump(rdev);
6647
6648         return skb->len;
6649 }
6650
6651 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
6652                                int flags, struct net_device *dev,
6653                                bool allow_radio_stats,
6654                                struct survey_info *survey)
6655 {
6656         void *hdr;
6657         struct nlattr *infoattr;
6658
6659         /* skip radio stats if userspace didn't request them */
6660         if (!survey->channel && !allow_radio_stats)
6661                 return 0;
6662
6663         hdr = nl80211hdr_put(msg, portid, seq, flags,
6664                              NL80211_CMD_NEW_SURVEY_RESULTS);
6665         if (!hdr)
6666                 return -ENOMEM;
6667
6668         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
6669                 goto nla_put_failure;
6670
6671         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
6672         if (!infoattr)
6673                 goto nla_put_failure;
6674
6675         if (survey->channel &&
6676             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
6677                         survey->channel->center_freq))
6678                 goto nla_put_failure;
6679
6680         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
6681             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
6682                 goto nla_put_failure;
6683         if ((survey->filled & SURVEY_INFO_IN_USE) &&
6684             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
6685                 goto nla_put_failure;
6686         if ((survey->filled & SURVEY_INFO_TIME) &&
6687             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME,
6688                         survey->time))
6689                 goto nla_put_failure;
6690         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
6691             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_BUSY,
6692                         survey->time_busy))
6693                 goto nla_put_failure;
6694         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
6695             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
6696                         survey->time_ext_busy))
6697                 goto nla_put_failure;
6698         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
6699             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_RX,
6700                         survey->time_rx))
6701                 goto nla_put_failure;
6702         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
6703             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_TX,
6704                         survey->time_tx))
6705                 goto nla_put_failure;
6706         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
6707             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_SCAN,
6708                         survey->time_scan))
6709                 goto nla_put_failure;
6710
6711         nla_nest_end(msg, infoattr);
6712
6713         genlmsg_end(msg, hdr);
6714         return 0;
6715
6716  nla_put_failure:
6717         genlmsg_cancel(msg, hdr);
6718         return -EMSGSIZE;
6719 }
6720
6721 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
6722 {
6723         struct survey_info survey;
6724         struct cfg80211_registered_device *rdev;
6725         struct wireless_dev *wdev;
6726         int survey_idx = cb->args[2];
6727         int res;
6728         bool radio_stats;
6729
6730         res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
6731         if (res)
6732                 return res;
6733
6734         /* prepare_wdev_dump parsed the attributes */
6735         radio_stats = nl80211_fam.attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
6736
6737         if (!wdev->netdev) {
6738                 res = -EINVAL;
6739                 goto out_err;
6740         }
6741
6742         if (!rdev->ops->dump_survey) {
6743                 res = -EOPNOTSUPP;
6744                 goto out_err;
6745         }
6746
6747         while (1) {
6748                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
6749                 if (res == -ENOENT)
6750                         break;
6751                 if (res)
6752                         goto out_err;
6753
6754                 /* don't send disabled channels, but do send non-channel data */
6755                 if (survey.channel &&
6756                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
6757                         survey_idx++;
6758                         continue;
6759                 }
6760
6761                 if (nl80211_send_survey(skb,
6762                                 NETLINK_CB(cb->skb).portid,
6763                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6764                                 wdev->netdev, radio_stats, &survey) < 0)
6765                         goto out;
6766                 survey_idx++;
6767         }
6768
6769  out:
6770         cb->args[2] = survey_idx;
6771         res = skb->len;
6772  out_err:
6773         nl80211_finish_wdev_dump(rdev);
6774         return res;
6775 }
6776
6777 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
6778 {
6779         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
6780                                   NL80211_WPA_VERSION_2));
6781 }
6782
6783 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
6784 {
6785         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6786         struct net_device *dev = info->user_ptr[1];
6787         struct ieee80211_channel *chan;
6788         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
6789         int err, ssid_len, ie_len = 0, sae_data_len = 0;
6790         enum nl80211_auth_type auth_type;
6791         struct key_parse key;
6792         bool local_state_change;
6793
6794         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6795                 return -EINVAL;
6796
6797         if (!info->attrs[NL80211_ATTR_MAC])
6798                 return -EINVAL;
6799
6800         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
6801                 return -EINVAL;
6802
6803         if (!info->attrs[NL80211_ATTR_SSID])
6804                 return -EINVAL;
6805
6806         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
6807                 return -EINVAL;
6808
6809         err = nl80211_parse_key(info, &key);
6810         if (err)
6811                 return err;
6812
6813         if (key.idx >= 0) {
6814                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
6815                         return -EINVAL;
6816                 if (!key.p.key || !key.p.key_len)
6817                         return -EINVAL;
6818                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
6819                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
6820                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
6821                      key.p.key_len != WLAN_KEY_LEN_WEP104))
6822                         return -EINVAL;
6823                 if (key.idx > 4)
6824                         return -EINVAL;
6825         } else {
6826                 key.p.key_len = 0;
6827                 key.p.key = NULL;
6828         }
6829
6830         if (key.idx >= 0) {
6831                 int i;
6832                 bool ok = false;
6833                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
6834                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
6835                                 ok = true;
6836                                 break;
6837                         }
6838                 }
6839                 if (!ok)
6840                         return -EINVAL;
6841         }
6842
6843         if (!rdev->ops->auth)
6844                 return -EOPNOTSUPP;
6845
6846         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6847             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6848                 return -EOPNOTSUPP;
6849
6850         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6851         chan = nl80211_get_valid_chan(&rdev->wiphy,
6852                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
6853         if (!chan)
6854                 return -EINVAL;
6855
6856         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6857         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6858
6859         if (info->attrs[NL80211_ATTR_IE]) {
6860                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6861                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6862         }
6863
6864         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6865         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
6866                 return -EINVAL;
6867
6868         if (auth_type == NL80211_AUTHTYPE_SAE &&
6869             !info->attrs[NL80211_ATTR_SAE_DATA])
6870                 return -EINVAL;
6871
6872         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
6873                 if (auth_type != NL80211_AUTHTYPE_SAE)
6874                         return -EINVAL;
6875                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
6876                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
6877                 /* need to include at least Auth Transaction and Status Code */
6878                 if (sae_data_len < 4)
6879                         return -EINVAL;
6880         }
6881
6882         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6883
6884         /*
6885          * Since we no longer track auth state, ignore
6886          * requests to only change local state.
6887          */
6888         if (local_state_change)
6889                 return 0;
6890
6891         wdev_lock(dev->ieee80211_ptr);
6892         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
6893                                  ssid, ssid_len, ie, ie_len,
6894                                  key.p.key, key.p.key_len, key.idx,
6895                                  sae_data, sae_data_len);
6896         wdev_unlock(dev->ieee80211_ptr);
6897         return err;
6898 }
6899
6900 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
6901                                    struct genl_info *info,
6902                                    struct cfg80211_crypto_settings *settings,
6903                                    int cipher_limit)
6904 {
6905         memset(settings, 0, sizeof(*settings));
6906
6907         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
6908
6909         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
6910                 u16 proto;
6911                 proto = nla_get_u16(
6912                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
6913                 settings->control_port_ethertype = cpu_to_be16(proto);
6914                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
6915                     proto != ETH_P_PAE)
6916                         return -EINVAL;
6917                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
6918                         settings->control_port_no_encrypt = true;
6919         } else
6920                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
6921
6922         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
6923                 void *data;
6924                 int len, i;
6925
6926                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6927                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6928                 settings->n_ciphers_pairwise = len / sizeof(u32);
6929
6930                 if (len % sizeof(u32))
6931                         return -EINVAL;
6932
6933                 if (settings->n_ciphers_pairwise > cipher_limit)
6934                         return -EINVAL;
6935
6936                 memcpy(settings->ciphers_pairwise, data, len);
6937
6938                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
6939                         if (!cfg80211_supported_cipher_suite(
6940                                         &rdev->wiphy,
6941                                         settings->ciphers_pairwise[i]))
6942                                 return -EINVAL;
6943         }
6944
6945         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
6946                 settings->cipher_group =
6947                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
6948                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
6949                                                      settings->cipher_group))
6950                         return -EINVAL;
6951         }
6952
6953         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
6954                 settings->wpa_versions =
6955                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
6956                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
6957                         return -EINVAL;
6958         }
6959
6960         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
6961                 void *data;
6962                 int len;
6963
6964                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
6965                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
6966                 settings->n_akm_suites = len / sizeof(u32);
6967
6968                 if (len % sizeof(u32))
6969                         return -EINVAL;
6970
6971                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
6972                         return -EINVAL;
6973
6974                 memcpy(settings->akm_suites, data, len);
6975         }
6976
6977         return 0;
6978 }
6979
6980 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
6981 {
6982         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6983         struct net_device *dev = info->user_ptr[1];
6984         struct ieee80211_channel *chan;
6985         struct cfg80211_assoc_request req = {};
6986         const u8 *bssid, *ssid;
6987         int err, ssid_len = 0;
6988
6989         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6990                 return -EINVAL;
6991
6992         if (!info->attrs[NL80211_ATTR_MAC] ||
6993             !info->attrs[NL80211_ATTR_SSID] ||
6994             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
6995                 return -EINVAL;
6996
6997         if (!rdev->ops->assoc)
6998                 return -EOPNOTSUPP;
6999
7000         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7001             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7002                 return -EOPNOTSUPP;
7003
7004         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7005
7006         chan = nl80211_get_valid_chan(&rdev->wiphy,
7007                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7008         if (!chan)
7009                 return -EINVAL;
7010
7011         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7012         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7013
7014         if (info->attrs[NL80211_ATTR_IE]) {
7015                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7016                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7017         }
7018
7019         if (info->attrs[NL80211_ATTR_USE_MFP]) {
7020                 enum nl80211_mfp mfp =
7021                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
7022                 if (mfp == NL80211_MFP_REQUIRED)
7023                         req.use_mfp = true;
7024                 else if (mfp != NL80211_MFP_NO)
7025                         return -EINVAL;
7026         }
7027
7028         if (info->attrs[NL80211_ATTR_PREV_BSSID])
7029                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
7030
7031         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
7032                 req.flags |= ASSOC_REQ_DISABLE_HT;
7033
7034         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7035                 memcpy(&req.ht_capa_mask,
7036                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7037                        sizeof(req.ht_capa_mask));
7038
7039         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7040                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7041                         return -EINVAL;
7042                 memcpy(&req.ht_capa,
7043                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7044                        sizeof(req.ht_capa));
7045         }
7046
7047         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
7048                 req.flags |= ASSOC_REQ_DISABLE_VHT;
7049
7050         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7051                 memcpy(&req.vht_capa_mask,
7052                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
7053                        sizeof(req.vht_capa_mask));
7054
7055         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
7056                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7057                         return -EINVAL;
7058                 memcpy(&req.vht_capa,
7059                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
7060                        sizeof(req.vht_capa));
7061         }
7062
7063         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
7064                 if (!(rdev->wiphy.features &
7065                       NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) ||
7066                     !(rdev->wiphy.features & NL80211_FEATURE_QUIET))
7067                         return -EINVAL;
7068                 req.flags |= ASSOC_REQ_USE_RRM;
7069         }
7070
7071         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
7072         if (!err) {
7073                 wdev_lock(dev->ieee80211_ptr);
7074                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
7075                                           ssid, ssid_len, &req);
7076                 wdev_unlock(dev->ieee80211_ptr);
7077         }
7078
7079         return err;
7080 }
7081
7082 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
7083 {
7084         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7085         struct net_device *dev = info->user_ptr[1];
7086         const u8 *ie = NULL, *bssid;
7087         int ie_len = 0, err;
7088         u16 reason_code;
7089         bool local_state_change;
7090
7091         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7092                 return -EINVAL;
7093
7094         if (!info->attrs[NL80211_ATTR_MAC])
7095                 return -EINVAL;
7096
7097         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7098                 return -EINVAL;
7099
7100         if (!rdev->ops->deauth)
7101                 return -EOPNOTSUPP;
7102
7103         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7104             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7105                 return -EOPNOTSUPP;
7106
7107         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7108
7109         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7110         if (reason_code == 0) {
7111                 /* Reason Code 0 is reserved */
7112                 return -EINVAL;
7113         }
7114
7115         if (info->attrs[NL80211_ATTR_IE]) {
7116                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7117                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7118         }
7119
7120         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
7121
7122         wdev_lock(dev->ieee80211_ptr);
7123         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
7124                                    local_state_change);
7125         wdev_unlock(dev->ieee80211_ptr);
7126         return err;
7127 }
7128
7129 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
7130 {
7131         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7132         struct net_device *dev = info->user_ptr[1];
7133         const u8 *ie = NULL, *bssid;
7134         int ie_len = 0, err;
7135         u16 reason_code;
7136         bool local_state_change;
7137
7138         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7139                 return -EINVAL;
7140
7141         if (!info->attrs[NL80211_ATTR_MAC])
7142                 return -EINVAL;
7143
7144         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7145                 return -EINVAL;
7146
7147         if (!rdev->ops->disassoc)
7148                 return -EOPNOTSUPP;
7149
7150         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7151             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7152                 return -EOPNOTSUPP;
7153
7154         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7155
7156         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7157         if (reason_code == 0) {
7158                 /* Reason Code 0 is reserved */
7159                 return -EINVAL;
7160         }
7161
7162         if (info->attrs[NL80211_ATTR_IE]) {
7163                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7164                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7165         }
7166
7167         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
7168
7169         wdev_lock(dev->ieee80211_ptr);
7170         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
7171                                      local_state_change);
7172         wdev_unlock(dev->ieee80211_ptr);
7173         return err;
7174 }
7175
7176 static bool
7177 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
7178                          int mcast_rate[IEEE80211_NUM_BANDS],
7179                          int rateval)
7180 {
7181         struct wiphy *wiphy = &rdev->wiphy;
7182         bool found = false;
7183         int band, i;
7184
7185         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
7186                 struct ieee80211_supported_band *sband;
7187
7188                 sband = wiphy->bands[band];
7189                 if (!sband)
7190                         continue;
7191
7192                 for (i = 0; i < sband->n_bitrates; i++) {
7193                         if (sband->bitrates[i].bitrate == rateval) {
7194                                 mcast_rate[band] = i + 1;
7195                                 found = true;
7196                                 break;
7197                         }
7198                 }
7199         }
7200
7201         return found;
7202 }
7203
7204 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
7205 {
7206         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7207         struct net_device *dev = info->user_ptr[1];
7208         struct cfg80211_ibss_params ibss;
7209         struct wiphy *wiphy;
7210         struct cfg80211_cached_keys *connkeys = NULL;
7211         int err;
7212
7213         memset(&ibss, 0, sizeof(ibss));
7214
7215         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7216                 return -EINVAL;
7217
7218         if (!info->attrs[NL80211_ATTR_SSID] ||
7219             !nla_len(info->attrs[NL80211_ATTR_SSID]))
7220                 return -EINVAL;
7221
7222         ibss.beacon_interval = 100;
7223
7224         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
7225                 ibss.beacon_interval =
7226                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
7227                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
7228                         return -EINVAL;
7229         }
7230
7231         if (!rdev->ops->join_ibss)
7232                 return -EOPNOTSUPP;
7233
7234         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
7235                 return -EOPNOTSUPP;
7236
7237         wiphy = &rdev->wiphy;
7238
7239         if (info->attrs[NL80211_ATTR_MAC]) {
7240                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7241
7242                 if (!is_valid_ether_addr(ibss.bssid))
7243                         return -EINVAL;
7244         }
7245         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7246         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7247
7248         if (info->attrs[NL80211_ATTR_IE]) {
7249                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7250                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7251         }
7252
7253         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
7254         if (err)
7255                 return err;
7256
7257         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
7258                                      NL80211_IFTYPE_ADHOC))
7259                 return -EINVAL;
7260
7261         switch (ibss.chandef.width) {
7262         case NL80211_CHAN_WIDTH_5:
7263         case NL80211_CHAN_WIDTH_10:
7264         case NL80211_CHAN_WIDTH_20_NOHT:
7265                 break;
7266         case NL80211_CHAN_WIDTH_20:
7267         case NL80211_CHAN_WIDTH_40:
7268                 if (rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)
7269                         break;
7270         default:
7271                 return -EINVAL;
7272         }
7273
7274         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
7275         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
7276
7277         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
7278                 u8 *rates =
7279                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7280                 int n_rates =
7281                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7282                 struct ieee80211_supported_band *sband =
7283                         wiphy->bands[ibss.chandef.chan->band];
7284
7285                 err = ieee80211_get_ratemask(sband, rates, n_rates,
7286                                              &ibss.basic_rates);
7287                 if (err)
7288                         return err;
7289         }
7290
7291         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7292                 memcpy(&ibss.ht_capa_mask,
7293                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7294                        sizeof(ibss.ht_capa_mask));
7295
7296         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7297                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7298                         return -EINVAL;
7299                 memcpy(&ibss.ht_capa,
7300                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7301                        sizeof(ibss.ht_capa));
7302         }
7303
7304         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
7305             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
7306                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
7307                 return -EINVAL;
7308
7309         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
7310                 bool no_ht = false;
7311
7312                 connkeys = nl80211_parse_connkeys(rdev,
7313                                           info->attrs[NL80211_ATTR_KEYS],
7314                                           &no_ht);
7315                 if (IS_ERR(connkeys))
7316                         return PTR_ERR(connkeys);
7317
7318                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
7319                     no_ht) {
7320                         kfree(connkeys);
7321                         return -EINVAL;
7322                 }
7323         }
7324
7325         ibss.control_port =
7326                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
7327
7328         ibss.userspace_handles_dfs =
7329                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
7330
7331         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
7332         if (err)
7333                 kzfree(connkeys);
7334         return err;
7335 }
7336
7337 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
7338 {
7339         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7340         struct net_device *dev = info->user_ptr[1];
7341
7342         if (!rdev->ops->leave_ibss)
7343                 return -EOPNOTSUPP;
7344
7345         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
7346                 return -EOPNOTSUPP;
7347
7348         return cfg80211_leave_ibss(rdev, dev, false);
7349 }
7350
7351 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
7352 {
7353         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7354         struct net_device *dev = info->user_ptr[1];
7355         int mcast_rate[IEEE80211_NUM_BANDS];
7356         u32 nla_rate;
7357         int err;
7358
7359         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
7360             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7361                 return -EOPNOTSUPP;
7362
7363         if (!rdev->ops->set_mcast_rate)
7364                 return -EOPNOTSUPP;
7365
7366         memset(mcast_rate, 0, sizeof(mcast_rate));
7367
7368         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
7369                 return -EINVAL;
7370
7371         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
7372         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
7373                 return -EINVAL;
7374
7375         err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
7376
7377         return err;
7378 }
7379
7380 static struct sk_buff *
7381 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
7382                             int approxlen, u32 portid, u32 seq,
7383                             enum nl80211_commands cmd,
7384                             enum nl80211_attrs attr,
7385                             const struct nl80211_vendor_cmd_info *info,
7386                             gfp_t gfp)
7387 {
7388         struct sk_buff *skb;
7389         void *hdr;
7390         struct nlattr *data;
7391
7392         skb = nlmsg_new(approxlen + 100, gfp);
7393         if (!skb)
7394                 return NULL;
7395
7396         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
7397         if (!hdr) {
7398                 kfree_skb(skb);
7399                 return NULL;
7400         }
7401
7402         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
7403                 goto nla_put_failure;
7404
7405         if (info) {
7406                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
7407                                 info->vendor_id))
7408                         goto nla_put_failure;
7409                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
7410                                 info->subcmd))
7411                         goto nla_put_failure;
7412         }
7413
7414         data = nla_nest_start(skb, attr);
7415
7416         ((void **)skb->cb)[0] = rdev;
7417         ((void **)skb->cb)[1] = hdr;
7418         ((void **)skb->cb)[2] = data;
7419
7420         return skb;
7421
7422  nla_put_failure:
7423         kfree_skb(skb);
7424         return NULL;
7425 }
7426
7427 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
7428                                            enum nl80211_commands cmd,
7429                                            enum nl80211_attrs attr,
7430                                            int vendor_event_idx,
7431                                            int approxlen, gfp_t gfp)
7432 {
7433         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
7434         const struct nl80211_vendor_cmd_info *info;
7435
7436         switch (cmd) {
7437         case NL80211_CMD_TESTMODE:
7438                 if (WARN_ON(vendor_event_idx != -1))
7439                         return NULL;
7440                 info = NULL;
7441                 break;
7442         case NL80211_CMD_VENDOR:
7443                 if (WARN_ON(vendor_event_idx < 0 ||
7444                             vendor_event_idx >= wiphy->n_vendor_events))
7445                         return NULL;
7446                 info = &wiphy->vendor_events[vendor_event_idx];
7447                 break;
7448         default:
7449                 WARN_ON(1);
7450                 return NULL;
7451         }
7452
7453         return __cfg80211_alloc_vendor_skb(rdev, approxlen, 0, 0,
7454                                            cmd, attr, info, gfp);
7455 }
7456 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
7457
7458 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
7459 {
7460         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
7461         void *hdr = ((void **)skb->cb)[1];
7462         struct nlattr *data = ((void **)skb->cb)[2];
7463         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
7464
7465         /* clear CB data for netlink core to own from now on */
7466         memset(skb->cb, 0, sizeof(skb->cb));
7467
7468         nla_nest_end(skb, data);
7469         genlmsg_end(skb, hdr);
7470
7471         if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
7472                 mcgrp = NL80211_MCGRP_VENDOR;
7473
7474         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
7475                                 mcgrp, gfp);
7476 }
7477 EXPORT_SYMBOL(__cfg80211_send_event_skb);
7478
7479 #ifdef CONFIG_NL80211_TESTMODE
7480 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
7481 {
7482         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7483         struct wireless_dev *wdev =
7484                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
7485         int err;
7486
7487         if (!rdev->ops->testmode_cmd)
7488                 return -EOPNOTSUPP;
7489
7490         if (IS_ERR(wdev)) {
7491                 err = PTR_ERR(wdev);
7492                 if (err != -EINVAL)
7493                         return err;
7494                 wdev = NULL;
7495         } else if (wdev->wiphy != &rdev->wiphy) {
7496                 return -EINVAL;
7497         }
7498
7499         if (!info->attrs[NL80211_ATTR_TESTDATA])
7500                 return -EINVAL;
7501
7502         rdev->cur_cmd_info = info;
7503         err = rdev_testmode_cmd(rdev, wdev,
7504                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
7505                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
7506         rdev->cur_cmd_info = NULL;
7507
7508         return err;
7509 }
7510
7511 static int nl80211_testmode_dump(struct sk_buff *skb,
7512                                  struct netlink_callback *cb)
7513 {
7514         struct cfg80211_registered_device *rdev;
7515         int err;
7516         long phy_idx;
7517         void *data = NULL;
7518         int data_len = 0;
7519
7520         rtnl_lock();
7521
7522         if (cb->args[0]) {
7523                 /*
7524                  * 0 is a valid index, but not valid for args[0],
7525                  * so we need to offset by 1.
7526                  */
7527                 phy_idx = cb->args[0] - 1;
7528         } else {
7529                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
7530                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
7531                                   nl80211_policy);
7532                 if (err)
7533                         goto out_err;
7534
7535                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
7536                                                   nl80211_fam.attrbuf);
7537                 if (IS_ERR(rdev)) {
7538                         err = PTR_ERR(rdev);
7539                         goto out_err;
7540                 }
7541                 phy_idx = rdev->wiphy_idx;
7542                 rdev = NULL;
7543
7544                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
7545                         cb->args[1] =
7546                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
7547         }
7548
7549         if (cb->args[1]) {
7550                 data = nla_data((void *)cb->args[1]);
7551                 data_len = nla_len((void *)cb->args[1]);
7552         }
7553
7554         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
7555         if (!rdev) {
7556                 err = -ENOENT;
7557                 goto out_err;
7558         }
7559
7560         if (!rdev->ops->testmode_dump) {
7561                 err = -EOPNOTSUPP;
7562                 goto out_err;
7563         }
7564
7565         while (1) {
7566                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
7567                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
7568                                            NL80211_CMD_TESTMODE);
7569                 struct nlattr *tmdata;
7570
7571                 if (!hdr)
7572                         break;
7573
7574                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
7575                         genlmsg_cancel(skb, hdr);
7576                         break;
7577                 }
7578
7579                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
7580                 if (!tmdata) {
7581                         genlmsg_cancel(skb, hdr);
7582                         break;
7583                 }
7584                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
7585                 nla_nest_end(skb, tmdata);
7586
7587                 if (err == -ENOBUFS || err == -ENOENT) {
7588                         genlmsg_cancel(skb, hdr);
7589                         break;
7590                 } else if (err) {
7591                         genlmsg_cancel(skb, hdr);
7592                         goto out_err;
7593                 }
7594
7595                 genlmsg_end(skb, hdr);
7596         }
7597
7598         err = skb->len;
7599         /* see above */
7600         cb->args[0] = phy_idx + 1;
7601  out_err:
7602         rtnl_unlock();
7603         return err;
7604 }
7605 #endif
7606
7607 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
7608 {
7609         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7610         struct net_device *dev = info->user_ptr[1];
7611         struct cfg80211_connect_params connect;
7612         struct wiphy *wiphy;
7613         struct cfg80211_cached_keys *connkeys = NULL;
7614         int err;
7615
7616         memset(&connect, 0, sizeof(connect));
7617
7618         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7619                 return -EINVAL;
7620
7621         if (!info->attrs[NL80211_ATTR_SSID] ||
7622             !nla_len(info->attrs[NL80211_ATTR_SSID]))
7623                 return -EINVAL;
7624
7625         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
7626                 connect.auth_type =
7627                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
7628                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
7629                                              NL80211_CMD_CONNECT))
7630                         return -EINVAL;
7631         } else
7632                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
7633
7634         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
7635
7636         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
7637                                       NL80211_MAX_NR_CIPHER_SUITES);
7638         if (err)
7639                 return err;
7640
7641         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7642             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7643                 return -EOPNOTSUPP;
7644
7645         wiphy = &rdev->wiphy;
7646
7647         connect.bg_scan_period = -1;
7648         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
7649                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
7650                 connect.bg_scan_period =
7651                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
7652         }
7653
7654         if (info->attrs[NL80211_ATTR_MAC])
7655                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7656         else if (info->attrs[NL80211_ATTR_MAC_HINT])
7657                 connect.bssid_hint =
7658                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
7659         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7660         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7661
7662         if (info->attrs[NL80211_ATTR_IE]) {
7663                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7664                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7665         }
7666
7667         if (info->attrs[NL80211_ATTR_USE_MFP]) {
7668                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
7669                 if (connect.mfp != NL80211_MFP_REQUIRED &&
7670                     connect.mfp != NL80211_MFP_NO)
7671                         return -EINVAL;
7672         } else {
7673                 connect.mfp = NL80211_MFP_NO;
7674         }
7675
7676         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7677                 connect.channel = nl80211_get_valid_chan(
7678                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7679                 if (!connect.channel)
7680                         return -EINVAL;
7681         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
7682                 connect.channel_hint = nl80211_get_valid_chan(
7683                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
7684                 if (!connect.channel_hint)
7685                         return -EINVAL;
7686         }
7687
7688         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
7689                 connkeys = nl80211_parse_connkeys(rdev,
7690                                           info->attrs[NL80211_ATTR_KEYS], NULL);
7691                 if (IS_ERR(connkeys))
7692                         return PTR_ERR(connkeys);
7693         }
7694
7695         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
7696                 connect.flags |= ASSOC_REQ_DISABLE_HT;
7697
7698         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7699                 memcpy(&connect.ht_capa_mask,
7700                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7701                        sizeof(connect.ht_capa_mask));
7702
7703         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7704                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
7705                         kzfree(connkeys);
7706                         return -EINVAL;
7707                 }
7708                 memcpy(&connect.ht_capa,
7709                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7710                        sizeof(connect.ht_capa));
7711         }
7712
7713         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
7714                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
7715
7716         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7717                 memcpy(&connect.vht_capa_mask,
7718                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
7719                        sizeof(connect.vht_capa_mask));
7720
7721         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
7722                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
7723                         kzfree(connkeys);
7724                         return -EINVAL;
7725                 }
7726                 memcpy(&connect.vht_capa,
7727                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
7728                        sizeof(connect.vht_capa));
7729         }
7730
7731         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
7732                 if (!(rdev->wiphy.features &
7733                       NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) ||
7734                     !(rdev->wiphy.features & NL80211_FEATURE_QUIET))
7735                         return -EINVAL;
7736                 connect.flags |= ASSOC_REQ_USE_RRM;
7737         }
7738
7739         wdev_lock(dev->ieee80211_ptr);
7740         err = cfg80211_connect(rdev, dev, &connect, connkeys, NULL);
7741         wdev_unlock(dev->ieee80211_ptr);
7742         if (err)
7743                 kzfree(connkeys);
7744         return err;
7745 }
7746
7747 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
7748 {
7749         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7750         struct net_device *dev = info->user_ptr[1];
7751         u16 reason;
7752         int ret;
7753
7754         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7755                 reason = WLAN_REASON_DEAUTH_LEAVING;
7756         else
7757                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7758
7759         if (reason == 0)
7760                 return -EINVAL;
7761
7762         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7763             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7764                 return -EOPNOTSUPP;
7765
7766         wdev_lock(dev->ieee80211_ptr);
7767         ret = cfg80211_disconnect(rdev, dev, reason, true);
7768         wdev_unlock(dev->ieee80211_ptr);
7769         return ret;
7770 }
7771
7772 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
7773 {
7774         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7775         struct net *net;
7776         int err;
7777
7778         if (info->attrs[NL80211_ATTR_PID]) {
7779                 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
7780
7781                 net = get_net_ns_by_pid(pid);
7782         } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
7783                 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
7784
7785                 net = get_net_ns_by_fd(fd);
7786         } else {
7787                 return -EINVAL;
7788         }
7789
7790         if (IS_ERR(net))
7791                 return PTR_ERR(net);
7792
7793         err = 0;
7794
7795         /* check if anything to do */
7796         if (!net_eq(wiphy_net(&rdev->wiphy), net))
7797                 err = cfg80211_switch_netns(rdev, net);
7798
7799         put_net(net);
7800         return err;
7801 }
7802
7803 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
7804 {
7805         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7806         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
7807                         struct cfg80211_pmksa *pmksa) = NULL;
7808         struct net_device *dev = info->user_ptr[1];
7809         struct cfg80211_pmksa pmksa;
7810
7811         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
7812
7813         if (!info->attrs[NL80211_ATTR_MAC])
7814                 return -EINVAL;
7815
7816         if (!info->attrs[NL80211_ATTR_PMKID])
7817                 return -EINVAL;
7818
7819         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
7820         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7821
7822         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7823             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7824                 return -EOPNOTSUPP;
7825
7826         switch (info->genlhdr->cmd) {
7827         case NL80211_CMD_SET_PMKSA:
7828                 rdev_ops = rdev->ops->set_pmksa;
7829                 break;
7830         case NL80211_CMD_DEL_PMKSA:
7831                 rdev_ops = rdev->ops->del_pmksa;
7832                 break;
7833         default:
7834                 WARN_ON(1);
7835                 break;
7836         }
7837
7838         if (!rdev_ops)
7839                 return -EOPNOTSUPP;
7840
7841         return rdev_ops(&rdev->wiphy, dev, &pmksa);
7842 }
7843
7844 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
7845 {
7846         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7847         struct net_device *dev = info->user_ptr[1];
7848
7849         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7850             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7851                 return -EOPNOTSUPP;
7852
7853         if (!rdev->ops->flush_pmksa)
7854                 return -EOPNOTSUPP;
7855
7856         return rdev_flush_pmksa(rdev, dev);
7857 }
7858
7859 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
7860 {
7861         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7862         struct net_device *dev = info->user_ptr[1];
7863         u8 action_code, dialog_token;
7864         u32 peer_capability = 0;
7865         u16 status_code;
7866         u8 *peer;
7867         bool initiator;
7868
7869         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
7870             !rdev->ops->tdls_mgmt)
7871                 return -EOPNOTSUPP;
7872
7873         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
7874             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
7875             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
7876             !info->attrs[NL80211_ATTR_IE] ||
7877             !info->attrs[NL80211_ATTR_MAC])
7878                 return -EINVAL;
7879
7880         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
7881         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
7882         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
7883         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
7884         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
7885         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
7886                 peer_capability =
7887                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
7888
7889         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
7890                               dialog_token, status_code, peer_capability,
7891                               initiator,
7892                               nla_data(info->attrs[NL80211_ATTR_IE]),
7893                               nla_len(info->attrs[NL80211_ATTR_IE]));
7894 }
7895
7896 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
7897 {
7898         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7899         struct net_device *dev = info->user_ptr[1];
7900         enum nl80211_tdls_operation operation;
7901         u8 *peer;
7902
7903         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
7904             !rdev->ops->tdls_oper)
7905                 return -EOPNOTSUPP;
7906
7907         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
7908             !info->attrs[NL80211_ATTR_MAC])
7909                 return -EINVAL;
7910
7911         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
7912         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
7913
7914         return rdev_tdls_oper(rdev, dev, peer, operation);
7915 }
7916
7917 static int nl80211_remain_on_channel(struct sk_buff *skb,
7918                                      struct genl_info *info)
7919 {
7920         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7921         struct wireless_dev *wdev = info->user_ptr[1];
7922         struct cfg80211_chan_def chandef;
7923         struct sk_buff *msg;
7924         void *hdr;
7925         u64 cookie;
7926         u32 duration;
7927         int err;
7928
7929         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
7930             !info->attrs[NL80211_ATTR_DURATION])
7931                 return -EINVAL;
7932
7933         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7934
7935         if (!rdev->ops->remain_on_channel ||
7936             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
7937                 return -EOPNOTSUPP;
7938
7939         /*
7940          * We should be on that channel for at least a minimum amount of
7941          * time (10ms) but no longer than the driver supports.
7942          */
7943         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7944             duration > rdev->wiphy.max_remain_on_channel_duration)
7945                 return -EINVAL;
7946
7947         err = nl80211_parse_chandef(rdev, info, &chandef);
7948         if (err)
7949                 return err;
7950
7951         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7952         if (!msg)
7953                 return -ENOMEM;
7954
7955         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7956                              NL80211_CMD_REMAIN_ON_CHANNEL);
7957         if (!hdr) {
7958                 err = -ENOBUFS;
7959                 goto free_msg;
7960         }
7961
7962         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
7963                                      duration, &cookie);
7964
7965         if (err)
7966                 goto free_msg;
7967
7968         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7969                 goto nla_put_failure;
7970
7971         genlmsg_end(msg, hdr);
7972
7973         return genlmsg_reply(msg, info);
7974
7975  nla_put_failure:
7976         err = -ENOBUFS;
7977  free_msg:
7978         nlmsg_free(msg);
7979         return err;
7980 }
7981
7982 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
7983                                             struct genl_info *info)
7984 {
7985         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7986         struct wireless_dev *wdev = info->user_ptr[1];
7987         u64 cookie;
7988
7989         if (!info->attrs[NL80211_ATTR_COOKIE])
7990                 return -EINVAL;
7991
7992         if (!rdev->ops->cancel_remain_on_channel)
7993                 return -EOPNOTSUPP;
7994
7995         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7996
7997         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
7998 }
7999
8000 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
8001                            u8 *rates, u8 rates_len)
8002 {
8003         u8 i;
8004         u32 mask = 0;
8005
8006         for (i = 0; i < rates_len; i++) {
8007                 int rate = (rates[i] & 0x7f) * 5;
8008                 int ridx;
8009                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
8010                         struct ieee80211_rate *srate =
8011                                 &sband->bitrates[ridx];
8012                         if (rate == srate->bitrate) {
8013                                 mask |= 1 << ridx;
8014                                 break;
8015                         }
8016                 }
8017                 if (ridx == sband->n_bitrates)
8018                         return 0; /* rate not found */
8019         }
8020
8021         return mask;
8022 }
8023
8024 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
8025                                u8 *rates, u8 rates_len,
8026                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
8027 {
8028         u8 i;
8029
8030         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
8031
8032         for (i = 0; i < rates_len; i++) {
8033                 int ridx, rbit;
8034
8035                 ridx = rates[i] / 8;
8036                 rbit = BIT(rates[i] % 8);
8037
8038                 /* check validity */
8039                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
8040                         return false;
8041
8042                 /* check availability */
8043                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
8044                         mcs[ridx] |= rbit;
8045                 else
8046                         return false;
8047         }
8048
8049         return true;
8050 }
8051
8052 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
8053 {
8054         u16 mcs_mask = 0;
8055
8056         switch (vht_mcs_map) {
8057         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
8058                 break;
8059         case IEEE80211_VHT_MCS_SUPPORT_0_7:
8060                 mcs_mask = 0x00FF;
8061                 break;
8062         case IEEE80211_VHT_MCS_SUPPORT_0_8:
8063                 mcs_mask = 0x01FF;
8064                 break;
8065         case IEEE80211_VHT_MCS_SUPPORT_0_9:
8066                 mcs_mask = 0x03FF;
8067                 break;
8068         default:
8069                 break;
8070         }
8071
8072         return mcs_mask;
8073 }
8074
8075 static void vht_build_mcs_mask(u16 vht_mcs_map,
8076                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
8077 {
8078         u8 nss;
8079
8080         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
8081                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
8082                 vht_mcs_map >>= 2;
8083         }
8084 }
8085
8086 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
8087                              struct nl80211_txrate_vht *txrate,
8088                              u16 mcs[NL80211_VHT_NSS_MAX])
8089 {
8090         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
8091         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
8092         u8 i;
8093
8094         if (!sband->vht_cap.vht_supported)
8095                 return false;
8096
8097         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
8098
8099         /* Build vht_mcs_mask from VHT capabilities */
8100         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
8101
8102         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
8103                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
8104                         mcs[i] = txrate->mcs[i];
8105                 else
8106                         return false;
8107         }
8108
8109         return true;
8110 }
8111
8112 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
8113         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
8114                                     .len = NL80211_MAX_SUPP_RATES },
8115         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
8116                                 .len = NL80211_MAX_SUPP_HT_RATES },
8117         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
8118         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
8119 };
8120
8121 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
8122                                        struct genl_info *info)
8123 {
8124         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
8125         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8126         struct cfg80211_bitrate_mask mask;
8127         int rem, i;
8128         struct net_device *dev = info->user_ptr[1];
8129         struct nlattr *tx_rates;
8130         struct ieee80211_supported_band *sband;
8131         u16 vht_tx_mcs_map;
8132
8133         if (!rdev->ops->set_bitrate_mask)
8134                 return -EOPNOTSUPP;
8135
8136         memset(&mask, 0, sizeof(mask));
8137         /* Default to all rates enabled */
8138         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
8139                 sband = rdev->wiphy.bands[i];
8140
8141                 if (!sband)
8142                         continue;
8143
8144                 mask.control[i].legacy = (1 << sband->n_bitrates) - 1;
8145                 memcpy(mask.control[i].ht_mcs,
8146                        sband->ht_cap.mcs.rx_mask,
8147                        sizeof(mask.control[i].ht_mcs));
8148
8149                 if (!sband->vht_cap.vht_supported)
8150                         continue;
8151
8152                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
8153                 vht_build_mcs_mask(vht_tx_mcs_map, mask.control[i].vht_mcs);
8154         }
8155
8156         /* if no rates are given set it back to the defaults */
8157         if (!info->attrs[NL80211_ATTR_TX_RATES])
8158                 goto out;
8159
8160         /*
8161          * The nested attribute uses enum nl80211_band as the index. This maps
8162          * directly to the enum ieee80211_band values used in cfg80211.
8163          */
8164         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
8165         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
8166                 enum ieee80211_band band = nla_type(tx_rates);
8167                 int err;
8168
8169                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
8170                         return -EINVAL;
8171                 sband = rdev->wiphy.bands[band];
8172                 if (sband == NULL)
8173                         return -EINVAL;
8174                 err = nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
8175                                 nla_len(tx_rates), nl80211_txattr_policy);
8176                 if (err)
8177                         return err;
8178                 if (tb[NL80211_TXRATE_LEGACY]) {
8179                         mask.control[band].legacy = rateset_to_mask(
8180                                 sband,
8181                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
8182                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
8183                         if ((mask.control[band].legacy == 0) &&
8184                             nla_len(tb[NL80211_TXRATE_LEGACY]))
8185                                 return -EINVAL;
8186                 }
8187                 if (tb[NL80211_TXRATE_HT]) {
8188                         if (!ht_rateset_to_mask(
8189                                         sband,
8190                                         nla_data(tb[NL80211_TXRATE_HT]),
8191                                         nla_len(tb[NL80211_TXRATE_HT]),
8192                                         mask.control[band].ht_mcs))
8193                                 return -EINVAL;
8194                 }
8195                 if (tb[NL80211_TXRATE_VHT]) {
8196                         if (!vht_set_mcs_mask(
8197                                         sband,
8198                                         nla_data(tb[NL80211_TXRATE_VHT]),
8199                                         mask.control[band].vht_mcs))
8200                                 return -EINVAL;
8201                 }
8202                 if (tb[NL80211_TXRATE_GI]) {
8203                         mask.control[band].gi =
8204                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
8205                         if (mask.control[band].gi > NL80211_TXRATE_FORCE_LGI)
8206                                 return -EINVAL;
8207                 }
8208
8209                 if (mask.control[band].legacy == 0) {
8210                         /* don't allow empty legacy rates if HT or VHT
8211                          * are not even supported.
8212                          */
8213                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
8214                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
8215                                 return -EINVAL;
8216
8217                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
8218                                 if (mask.control[band].ht_mcs[i])
8219                                         goto out;
8220
8221                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
8222                                 if (mask.control[band].vht_mcs[i])
8223                                         goto out;
8224
8225                         /* legacy and mcs rates may not be both empty */
8226                         return -EINVAL;
8227                 }
8228         }
8229
8230 out:
8231         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
8232 }
8233
8234 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
8235 {
8236         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8237         struct wireless_dev *wdev = info->user_ptr[1];
8238         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
8239
8240         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
8241                 return -EINVAL;
8242
8243         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
8244                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
8245
8246         switch (wdev->iftype) {
8247         case NL80211_IFTYPE_STATION:
8248         case NL80211_IFTYPE_ADHOC:
8249         case NL80211_IFTYPE_P2P_CLIENT:
8250         case NL80211_IFTYPE_AP:
8251         case NL80211_IFTYPE_AP_VLAN:
8252         case NL80211_IFTYPE_MESH_POINT:
8253         case NL80211_IFTYPE_P2P_GO:
8254         case NL80211_IFTYPE_P2P_DEVICE:
8255                 break;
8256         default:
8257                 return -EOPNOTSUPP;
8258         }
8259
8260         /* not much point in registering if we can't reply */
8261         if (!rdev->ops->mgmt_tx)
8262                 return -EOPNOTSUPP;
8263
8264         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
8265                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
8266                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
8267 }
8268
8269 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
8270 {
8271         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8272         struct wireless_dev *wdev = info->user_ptr[1];
8273         struct cfg80211_chan_def chandef;
8274         int err;
8275         void *hdr = NULL;
8276         u64 cookie;
8277         struct sk_buff *msg = NULL;
8278         struct cfg80211_mgmt_tx_params params = {
8279                 .dont_wait_for_ack =
8280                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
8281         };
8282
8283         if (!info->attrs[NL80211_ATTR_FRAME])
8284                 return -EINVAL;
8285
8286         if (!rdev->ops->mgmt_tx)
8287                 return -EOPNOTSUPP;
8288
8289         switch (wdev->iftype) {
8290         case NL80211_IFTYPE_P2P_DEVICE:
8291                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
8292                         return -EINVAL;
8293         case NL80211_IFTYPE_STATION:
8294         case NL80211_IFTYPE_ADHOC:
8295         case NL80211_IFTYPE_P2P_CLIENT:
8296         case NL80211_IFTYPE_AP:
8297         case NL80211_IFTYPE_AP_VLAN:
8298         case NL80211_IFTYPE_MESH_POINT:
8299         case NL80211_IFTYPE_P2P_GO:
8300                 break;
8301         default:
8302                 return -EOPNOTSUPP;
8303         }
8304
8305         if (info->attrs[NL80211_ATTR_DURATION]) {
8306                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
8307                         return -EINVAL;
8308                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
8309
8310                 /*
8311                  * We should wait on the channel for at least a minimum amount
8312                  * of time (10ms) but no longer than the driver supports.
8313                  */
8314                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
8315                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
8316                         return -EINVAL;
8317
8318         }
8319
8320         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
8321
8322         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
8323                 return -EINVAL;
8324
8325         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
8326
8327         /* get the channel if any has been specified, otherwise pass NULL to
8328          * the driver. The latter will use the current one
8329          */
8330         chandef.chan = NULL;
8331         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8332                 err = nl80211_parse_chandef(rdev, info, &chandef);
8333                 if (err)
8334                         return err;
8335         }
8336
8337         if (!chandef.chan && params.offchan)
8338                 return -EINVAL;
8339
8340         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
8341         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
8342
8343         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
8344                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
8345                 int i;
8346
8347                 if (len % sizeof(u16))
8348                         return -EINVAL;
8349
8350                 params.n_csa_offsets = len / sizeof(u16);
8351                 params.csa_offsets =
8352                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
8353
8354                 /* check that all the offsets fit the frame */
8355                 for (i = 0; i < params.n_csa_offsets; i++) {
8356                         if (params.csa_offsets[i] >= params.len)
8357                                 return -EINVAL;
8358                 }
8359         }
8360
8361         if (!params.dont_wait_for_ack) {
8362                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8363                 if (!msg)
8364                         return -ENOMEM;
8365
8366                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8367                                      NL80211_CMD_FRAME);
8368                 if (!hdr) {
8369                         err = -ENOBUFS;
8370                         goto free_msg;
8371                 }
8372         }
8373
8374         params.chan = chandef.chan;
8375         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
8376         if (err)
8377                 goto free_msg;
8378
8379         if (msg) {
8380                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8381                         goto nla_put_failure;
8382
8383                 genlmsg_end(msg, hdr);
8384                 return genlmsg_reply(msg, info);
8385         }
8386
8387         return 0;
8388
8389  nla_put_failure:
8390         err = -ENOBUFS;
8391  free_msg:
8392         nlmsg_free(msg);
8393         return err;
8394 }
8395
8396 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
8397 {
8398         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8399         struct wireless_dev *wdev = info->user_ptr[1];
8400         u64 cookie;
8401
8402         if (!info->attrs[NL80211_ATTR_COOKIE])
8403                 return -EINVAL;
8404
8405         if (!rdev->ops->mgmt_tx_cancel_wait)
8406                 return -EOPNOTSUPP;
8407
8408         switch (wdev->iftype) {
8409         case NL80211_IFTYPE_STATION:
8410         case NL80211_IFTYPE_ADHOC:
8411         case NL80211_IFTYPE_P2P_CLIENT:
8412         case NL80211_IFTYPE_AP:
8413         case NL80211_IFTYPE_AP_VLAN:
8414         case NL80211_IFTYPE_P2P_GO:
8415         case NL80211_IFTYPE_P2P_DEVICE:
8416                 break;
8417         default:
8418                 return -EOPNOTSUPP;
8419         }
8420
8421         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
8422
8423         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
8424 }
8425
8426 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
8427 {
8428         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8429         struct wireless_dev *wdev;
8430         struct net_device *dev = info->user_ptr[1];
8431         u8 ps_state;
8432         bool state;
8433         int err;
8434
8435         if (!info->attrs[NL80211_ATTR_PS_STATE])
8436                 return -EINVAL;
8437
8438         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
8439
8440         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
8441                 return -EINVAL;
8442
8443         wdev = dev->ieee80211_ptr;
8444
8445         if (!rdev->ops->set_power_mgmt)
8446                 return -EOPNOTSUPP;
8447
8448         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
8449
8450         if (state == wdev->ps)
8451                 return 0;
8452
8453         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
8454         if (!err)
8455                 wdev->ps = state;
8456         return err;
8457 }
8458
8459 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
8460 {
8461         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8462         enum nl80211_ps_state ps_state;
8463         struct wireless_dev *wdev;
8464         struct net_device *dev = info->user_ptr[1];
8465         struct sk_buff *msg;
8466         void *hdr;
8467         int err;
8468
8469         wdev = dev->ieee80211_ptr;
8470
8471         if (!rdev->ops->set_power_mgmt)
8472                 return -EOPNOTSUPP;
8473
8474         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8475         if (!msg)
8476                 return -ENOMEM;
8477
8478         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8479                              NL80211_CMD_GET_POWER_SAVE);
8480         if (!hdr) {
8481                 err = -ENOBUFS;
8482                 goto free_msg;
8483         }
8484
8485         if (wdev->ps)
8486                 ps_state = NL80211_PS_ENABLED;
8487         else
8488                 ps_state = NL80211_PS_DISABLED;
8489
8490         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
8491                 goto nla_put_failure;
8492
8493         genlmsg_end(msg, hdr);
8494         return genlmsg_reply(msg, info);
8495
8496  nla_put_failure:
8497         err = -ENOBUFS;
8498  free_msg:
8499         nlmsg_free(msg);
8500         return err;
8501 }
8502
8503 static const struct nla_policy
8504 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
8505         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
8506         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
8507         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
8508         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
8509         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
8510         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
8511 };
8512
8513 static int nl80211_set_cqm_txe(struct genl_info *info,
8514                                u32 rate, u32 pkts, u32 intvl)
8515 {
8516         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8517         struct net_device *dev = info->user_ptr[1];
8518         struct wireless_dev *wdev = dev->ieee80211_ptr;
8519
8520         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
8521                 return -EINVAL;
8522
8523         if (!rdev->ops->set_cqm_txe_config)
8524                 return -EOPNOTSUPP;
8525
8526         if (wdev->iftype != NL80211_IFTYPE_STATION &&
8527             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
8528                 return -EOPNOTSUPP;
8529
8530         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
8531 }
8532
8533 static int nl80211_set_cqm_rssi(struct genl_info *info,
8534                                 s32 threshold, u32 hysteresis)
8535 {
8536         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8537         struct net_device *dev = info->user_ptr[1];
8538         struct wireless_dev *wdev = dev->ieee80211_ptr;
8539
8540         if (threshold > 0)
8541                 return -EINVAL;
8542
8543         /* disabling - hysteresis should also be zero then */
8544         if (threshold == 0)
8545                 hysteresis = 0;
8546
8547         if (!rdev->ops->set_cqm_rssi_config)
8548                 return -EOPNOTSUPP;
8549
8550         if (wdev->iftype != NL80211_IFTYPE_STATION &&
8551             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
8552                 return -EOPNOTSUPP;
8553
8554         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
8555 }
8556
8557 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
8558 {
8559         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
8560         struct nlattr *cqm;
8561         int err;
8562
8563         cqm = info->attrs[NL80211_ATTR_CQM];
8564         if (!cqm)
8565                 return -EINVAL;
8566
8567         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
8568                                nl80211_attr_cqm_policy);
8569         if (err)
8570                 return err;
8571
8572         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
8573             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
8574                 s32 threshold = nla_get_s32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
8575                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
8576
8577                 return nl80211_set_cqm_rssi(info, threshold, hysteresis);
8578         }
8579
8580         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
8581             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
8582             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
8583                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
8584                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
8585                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
8586
8587                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
8588         }
8589
8590         return -EINVAL;
8591 }
8592
8593 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
8594 {
8595         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8596         struct net_device *dev = info->user_ptr[1];
8597         struct ocb_setup setup = {};
8598         int err;
8599
8600         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
8601         if (err)
8602                 return err;
8603
8604         return cfg80211_join_ocb(rdev, dev, &setup);
8605 }
8606
8607 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
8608 {
8609         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8610         struct net_device *dev = info->user_ptr[1];
8611
8612         return cfg80211_leave_ocb(rdev, dev);
8613 }
8614
8615 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
8616 {
8617         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8618         struct net_device *dev = info->user_ptr[1];
8619         struct mesh_config cfg;
8620         struct mesh_setup setup;
8621         int err;
8622
8623         /* start with default */
8624         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
8625         memcpy(&setup, &default_mesh_setup, sizeof(setup));
8626
8627         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
8628                 /* and parse parameters if given */
8629                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
8630                 if (err)
8631                         return err;
8632         }
8633
8634         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
8635             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
8636                 return -EINVAL;
8637
8638         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
8639         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
8640
8641         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
8642             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
8643                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
8644                         return -EINVAL;
8645
8646         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
8647                 setup.beacon_interval =
8648                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
8649                 if (setup.beacon_interval < 10 ||
8650                     setup.beacon_interval > 10000)
8651                         return -EINVAL;
8652         }
8653
8654         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
8655                 setup.dtim_period =
8656                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
8657                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
8658                         return -EINVAL;
8659         }
8660
8661         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
8662                 /* parse additional setup parameters if given */
8663                 err = nl80211_parse_mesh_setup(info, &setup);
8664                 if (err)
8665                         return err;
8666         }
8667
8668         if (setup.user_mpm)
8669                 cfg.auto_open_plinks = false;
8670
8671         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8672                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
8673                 if (err)
8674                         return err;
8675         } else {
8676                 /* cfg80211_join_mesh() will sort it out */
8677                 setup.chandef.chan = NULL;
8678         }
8679
8680         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8681                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8682                 int n_rates =
8683                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8684                 struct ieee80211_supported_band *sband;
8685
8686                 if (!setup.chandef.chan)
8687                         return -EINVAL;
8688
8689                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
8690
8691                 err = ieee80211_get_ratemask(sband, rates, n_rates,
8692                                              &setup.basic_rates);
8693                 if (err)
8694                         return err;
8695         }
8696
8697         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
8698 }
8699
8700 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
8701 {
8702         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8703         struct net_device *dev = info->user_ptr[1];
8704
8705         return cfg80211_leave_mesh(rdev, dev);
8706 }
8707
8708 #ifdef CONFIG_PM
8709 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
8710                                         struct cfg80211_registered_device *rdev)
8711 {
8712         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
8713         struct nlattr *nl_pats, *nl_pat;
8714         int i, pat_len;
8715
8716         if (!wowlan->n_patterns)
8717                 return 0;
8718
8719         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
8720         if (!nl_pats)
8721                 return -ENOBUFS;
8722
8723         for (i = 0; i < wowlan->n_patterns; i++) {
8724                 nl_pat = nla_nest_start(msg, i + 1);
8725                 if (!nl_pat)
8726                         return -ENOBUFS;
8727                 pat_len = wowlan->patterns[i].pattern_len;
8728                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
8729                             wowlan->patterns[i].mask) ||
8730                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
8731                             wowlan->patterns[i].pattern) ||
8732                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
8733                                 wowlan->patterns[i].pkt_offset))
8734                         return -ENOBUFS;
8735                 nla_nest_end(msg, nl_pat);
8736         }
8737         nla_nest_end(msg, nl_pats);
8738
8739         return 0;
8740 }
8741
8742 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
8743                                    struct cfg80211_wowlan_tcp *tcp)
8744 {
8745         struct nlattr *nl_tcp;
8746
8747         if (!tcp)
8748                 return 0;
8749
8750         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
8751         if (!nl_tcp)
8752                 return -ENOBUFS;
8753
8754         if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
8755             nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
8756             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
8757             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
8758             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
8759             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
8760                     tcp->payload_len, tcp->payload) ||
8761             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
8762                         tcp->data_interval) ||
8763             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
8764                     tcp->wake_len, tcp->wake_data) ||
8765             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
8766                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
8767                 return -ENOBUFS;
8768
8769         if (tcp->payload_seq.len &&
8770             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
8771                     sizeof(tcp->payload_seq), &tcp->payload_seq))
8772                 return -ENOBUFS;
8773
8774         if (tcp->payload_tok.len &&
8775             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
8776                     sizeof(tcp->payload_tok) + tcp->tokens_size,
8777                     &tcp->payload_tok))
8778                 return -ENOBUFS;
8779
8780         nla_nest_end(msg, nl_tcp);
8781
8782         return 0;
8783 }
8784
8785 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
8786                                   struct cfg80211_sched_scan_request *req)
8787 {
8788         struct nlattr *nd, *freqs, *matches, *match;
8789         int i;
8790
8791         if (!req)
8792                 return 0;
8793
8794         nd = nla_nest_start(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
8795         if (!nd)
8796                 return -ENOBUFS;
8797
8798         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL, req->interval))
8799                 return -ENOBUFS;
8800
8801         freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
8802         if (!freqs)
8803                 return -ENOBUFS;
8804
8805         for (i = 0; i < req->n_channels; i++)
8806                 nla_put_u32(msg, i, req->channels[i]->center_freq);
8807
8808         nla_nest_end(msg, freqs);
8809
8810         if (req->n_match_sets) {
8811                 matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
8812                 for (i = 0; i < req->n_match_sets; i++) {
8813                         match = nla_nest_start(msg, i);
8814                         nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
8815                                 req->match_sets[i].ssid.ssid_len,
8816                                 req->match_sets[i].ssid.ssid);
8817                         nla_nest_end(msg, match);
8818                 }
8819                 nla_nest_end(msg, matches);
8820         }
8821
8822         nla_nest_end(msg, nd);
8823
8824         return 0;
8825 }
8826
8827 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
8828 {
8829         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8830         struct sk_buff *msg;
8831         void *hdr;
8832         u32 size = NLMSG_DEFAULT_SIZE;
8833
8834         if (!rdev->wiphy.wowlan)
8835                 return -EOPNOTSUPP;
8836
8837         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
8838                 /* adjust size to have room for all the data */
8839                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
8840                         rdev->wiphy.wowlan_config->tcp->payload_len +
8841                         rdev->wiphy.wowlan_config->tcp->wake_len +
8842                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
8843         }
8844
8845         msg = nlmsg_new(size, GFP_KERNEL);
8846         if (!msg)
8847                 return -ENOMEM;
8848
8849         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8850                              NL80211_CMD_GET_WOWLAN);
8851         if (!hdr)
8852                 goto nla_put_failure;
8853
8854         if (rdev->wiphy.wowlan_config) {
8855                 struct nlattr *nl_wowlan;
8856
8857                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
8858                 if (!nl_wowlan)
8859                         goto nla_put_failure;
8860
8861                 if ((rdev->wiphy.wowlan_config->any &&
8862                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
8863                     (rdev->wiphy.wowlan_config->disconnect &&
8864                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
8865                     (rdev->wiphy.wowlan_config->magic_pkt &&
8866                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
8867                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
8868                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
8869                     (rdev->wiphy.wowlan_config->eap_identity_req &&
8870                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
8871                     (rdev->wiphy.wowlan_config->four_way_handshake &&
8872                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
8873                     (rdev->wiphy.wowlan_config->rfkill_release &&
8874                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
8875                         goto nla_put_failure;
8876
8877                 if (nl80211_send_wowlan_patterns(msg, rdev))
8878                         goto nla_put_failure;
8879
8880                 if (nl80211_send_wowlan_tcp(msg,
8881                                             rdev->wiphy.wowlan_config->tcp))
8882                         goto nla_put_failure;
8883
8884                 if (nl80211_send_wowlan_nd(
8885                             msg,
8886                             rdev->wiphy.wowlan_config->nd_config))
8887                         goto nla_put_failure;
8888
8889                 nla_nest_end(msg, nl_wowlan);
8890         }
8891
8892         genlmsg_end(msg, hdr);
8893         return genlmsg_reply(msg, info);
8894
8895 nla_put_failure:
8896         nlmsg_free(msg);
8897         return -ENOBUFS;
8898 }
8899
8900 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
8901                                     struct nlattr *attr,
8902                                     struct cfg80211_wowlan *trig)
8903 {
8904         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
8905         struct cfg80211_wowlan_tcp *cfg;
8906         struct nl80211_wowlan_tcp_data_token *tok = NULL;
8907         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
8908         u32 size;
8909         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
8910         int err, port;
8911
8912         if (!rdev->wiphy.wowlan->tcp)
8913                 return -EINVAL;
8914
8915         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
8916                         nla_data(attr), nla_len(attr),
8917                         nl80211_wowlan_tcp_policy);
8918         if (err)
8919                 return err;
8920
8921         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
8922             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
8923             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
8924             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
8925             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
8926             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
8927             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
8928             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
8929                 return -EINVAL;
8930
8931         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
8932         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
8933                 return -EINVAL;
8934
8935         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
8936                         rdev->wiphy.wowlan->tcp->data_interval_max ||
8937             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
8938                 return -EINVAL;
8939
8940         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
8941         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
8942                 return -EINVAL;
8943
8944         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
8945         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
8946                 return -EINVAL;
8947
8948         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
8949                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
8950
8951                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
8952                 tokens_size = tokln - sizeof(*tok);
8953
8954                 if (!tok->len || tokens_size % tok->len)
8955                         return -EINVAL;
8956                 if (!rdev->wiphy.wowlan->tcp->tok)
8957                         return -EINVAL;
8958                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
8959                         return -EINVAL;
8960                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
8961                         return -EINVAL;
8962                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
8963                         return -EINVAL;
8964                 if (tok->offset + tok->len > data_size)
8965                         return -EINVAL;
8966         }
8967
8968         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
8969                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
8970                 if (!rdev->wiphy.wowlan->tcp->seq)
8971                         return -EINVAL;
8972                 if (seq->len == 0 || seq->len > 4)
8973                         return -EINVAL;
8974                 if (seq->len + seq->offset > data_size)
8975                         return -EINVAL;
8976         }
8977
8978         size = sizeof(*cfg);
8979         size += data_size;
8980         size += wake_size + wake_mask_size;
8981         size += tokens_size;
8982
8983         cfg = kzalloc(size, GFP_KERNEL);
8984         if (!cfg)
8985                 return -ENOMEM;
8986         cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
8987         cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
8988         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
8989                ETH_ALEN);
8990         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
8991                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
8992         else
8993                 port = 0;
8994 #ifdef CONFIG_INET
8995         /* allocate a socket and port for it and use it */
8996         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
8997                             IPPROTO_TCP, &cfg->sock, 1);
8998         if (err) {
8999                 kfree(cfg);
9000                 return err;
9001         }
9002         if (inet_csk_get_port(cfg->sock->sk, port)) {
9003                 sock_release(cfg->sock);
9004                 kfree(cfg);
9005                 return -EADDRINUSE;
9006         }
9007         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
9008 #else
9009         if (!port) {
9010                 kfree(cfg);
9011                 return -EINVAL;
9012         }
9013         cfg->src_port = port;
9014 #endif
9015
9016         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
9017         cfg->payload_len = data_size;
9018         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
9019         memcpy((void *)cfg->payload,
9020                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
9021                data_size);
9022         if (seq)
9023                 cfg->payload_seq = *seq;
9024         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
9025         cfg->wake_len = wake_size;
9026         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
9027         memcpy((void *)cfg->wake_data,
9028                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
9029                wake_size);
9030         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
9031                          data_size + wake_size;
9032         memcpy((void *)cfg->wake_mask,
9033                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
9034                wake_mask_size);
9035         if (tok) {
9036                 cfg->tokens_size = tokens_size;
9037                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
9038         }
9039
9040         trig->tcp = cfg;
9041
9042         return 0;
9043 }
9044
9045 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
9046                                    const struct wiphy_wowlan_support *wowlan,
9047                                    struct nlattr *attr,
9048                                    struct cfg80211_wowlan *trig)
9049 {
9050         struct nlattr **tb;
9051         int err;
9052
9053         tb = kzalloc(NUM_NL80211_ATTR * sizeof(*tb), GFP_KERNEL);
9054         if (!tb)
9055                 return -ENOMEM;
9056
9057         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
9058                 err = -EOPNOTSUPP;
9059                 goto out;
9060         }
9061
9062         err = nla_parse(tb, NL80211_ATTR_MAX,
9063                         nla_data(attr), nla_len(attr),
9064                         nl80211_policy);
9065         if (err)
9066                 goto out;
9067
9068         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb);
9069         err = PTR_ERR_OR_ZERO(trig->nd_config);
9070         if (err)
9071                 trig->nd_config = NULL;
9072
9073 out:
9074         kfree(tb);
9075         return err;
9076 }
9077
9078 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
9079 {
9080         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9081         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
9082         struct cfg80211_wowlan new_triggers = {};
9083         struct cfg80211_wowlan *ntrig;
9084         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
9085         int err, i;
9086         bool prev_enabled = rdev->wiphy.wowlan_config;
9087
9088         if (!wowlan)
9089                 return -EOPNOTSUPP;
9090
9091         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
9092                 cfg80211_rdev_free_wowlan(rdev);
9093                 rdev->wiphy.wowlan_config = NULL;
9094                 goto set_wakeup;
9095         }
9096
9097         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
9098                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
9099                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
9100                         nl80211_wowlan_policy);
9101         if (err)
9102                 return err;
9103
9104         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
9105                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
9106                         return -EINVAL;
9107                 new_triggers.any = true;
9108         }
9109
9110         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
9111                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
9112                         return -EINVAL;
9113                 new_triggers.disconnect = true;
9114         }
9115
9116         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
9117                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
9118                         return -EINVAL;
9119                 new_triggers.magic_pkt = true;
9120         }
9121
9122         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
9123                 return -EINVAL;
9124
9125         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
9126                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
9127                         return -EINVAL;
9128                 new_triggers.gtk_rekey_failure = true;
9129         }
9130
9131         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
9132                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
9133                         return -EINVAL;
9134                 new_triggers.eap_identity_req = true;
9135         }
9136
9137         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
9138                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
9139                         return -EINVAL;
9140                 new_triggers.four_way_handshake = true;
9141         }
9142
9143         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
9144                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
9145                         return -EINVAL;
9146                 new_triggers.rfkill_release = true;
9147         }
9148
9149         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
9150                 struct nlattr *pat;
9151                 int n_patterns = 0;
9152                 int rem, pat_len, mask_len, pkt_offset;
9153                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
9154
9155                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
9156                                     rem)
9157                         n_patterns++;
9158                 if (n_patterns > wowlan->n_patterns)
9159                         return -EINVAL;
9160
9161                 new_triggers.patterns = kcalloc(n_patterns,
9162                                                 sizeof(new_triggers.patterns[0]),
9163                                                 GFP_KERNEL);
9164                 if (!new_triggers.patterns)
9165                         return -ENOMEM;
9166
9167                 new_triggers.n_patterns = n_patterns;
9168                 i = 0;
9169
9170                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
9171                                     rem) {
9172                         u8 *mask_pat;
9173
9174                         nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
9175                                   nla_len(pat), NULL);
9176                         err = -EINVAL;
9177                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
9178                             !pat_tb[NL80211_PKTPAT_PATTERN])
9179                                 goto error;
9180                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
9181                         mask_len = DIV_ROUND_UP(pat_len, 8);
9182                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
9183                                 goto error;
9184                         if (pat_len > wowlan->pattern_max_len ||
9185                             pat_len < wowlan->pattern_min_len)
9186                                 goto error;
9187
9188                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
9189                                 pkt_offset = 0;
9190                         else
9191                                 pkt_offset = nla_get_u32(
9192                                         pat_tb[NL80211_PKTPAT_OFFSET]);
9193                         if (pkt_offset > wowlan->max_pkt_offset)
9194                                 goto error;
9195                         new_triggers.patterns[i].pkt_offset = pkt_offset;
9196
9197                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
9198                         if (!mask_pat) {
9199                                 err = -ENOMEM;
9200                                 goto error;
9201                         }
9202                         new_triggers.patterns[i].mask = mask_pat;
9203                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
9204                                mask_len);
9205                         mask_pat += mask_len;
9206                         new_triggers.patterns[i].pattern = mask_pat;
9207                         new_triggers.patterns[i].pattern_len = pat_len;
9208                         memcpy(mask_pat,
9209                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
9210                                pat_len);
9211                         i++;
9212                 }
9213         }
9214
9215         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
9216                 err = nl80211_parse_wowlan_tcp(
9217                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
9218                         &new_triggers);
9219                 if (err)
9220                         goto error;
9221         }
9222
9223         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
9224                 err = nl80211_parse_wowlan_nd(
9225                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
9226                         &new_triggers);
9227                 if (err)
9228                         goto error;
9229         }
9230
9231         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
9232         if (!ntrig) {
9233                 err = -ENOMEM;
9234                 goto error;
9235         }
9236         cfg80211_rdev_free_wowlan(rdev);
9237         rdev->wiphy.wowlan_config = ntrig;
9238
9239  set_wakeup:
9240         if (rdev->ops->set_wakeup &&
9241             prev_enabled != !!rdev->wiphy.wowlan_config)
9242                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
9243
9244         return 0;
9245  error:
9246         for (i = 0; i < new_triggers.n_patterns; i++)
9247                 kfree(new_triggers.patterns[i].mask);
9248         kfree(new_triggers.patterns);
9249         if (new_triggers.tcp && new_triggers.tcp->sock)
9250                 sock_release(new_triggers.tcp->sock);
9251         kfree(new_triggers.tcp);
9252         return err;
9253 }
9254 #endif
9255
9256 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
9257                                        struct cfg80211_registered_device *rdev)
9258 {
9259         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
9260         int i, j, pat_len;
9261         struct cfg80211_coalesce_rules *rule;
9262
9263         if (!rdev->coalesce->n_rules)
9264                 return 0;
9265
9266         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
9267         if (!nl_rules)
9268                 return -ENOBUFS;
9269
9270         for (i = 0; i < rdev->coalesce->n_rules; i++) {
9271                 nl_rule = nla_nest_start(msg, i + 1);
9272                 if (!nl_rule)
9273                         return -ENOBUFS;
9274
9275                 rule = &rdev->coalesce->rules[i];
9276                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
9277                                 rule->delay))
9278                         return -ENOBUFS;
9279
9280                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
9281                                 rule->condition))
9282                         return -ENOBUFS;
9283
9284                 nl_pats = nla_nest_start(msg,
9285                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
9286                 if (!nl_pats)
9287                         return -ENOBUFS;
9288
9289                 for (j = 0; j < rule->n_patterns; j++) {
9290                         nl_pat = nla_nest_start(msg, j + 1);
9291                         if (!nl_pat)
9292                                 return -ENOBUFS;
9293                         pat_len = rule->patterns[j].pattern_len;
9294                         if (nla_put(msg, NL80211_PKTPAT_MASK,
9295                                     DIV_ROUND_UP(pat_len, 8),
9296                                     rule->patterns[j].mask) ||
9297                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
9298                                     rule->patterns[j].pattern) ||
9299                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
9300                                         rule->patterns[j].pkt_offset))
9301                                 return -ENOBUFS;
9302                         nla_nest_end(msg, nl_pat);
9303                 }
9304                 nla_nest_end(msg, nl_pats);
9305                 nla_nest_end(msg, nl_rule);
9306         }
9307         nla_nest_end(msg, nl_rules);
9308
9309         return 0;
9310 }
9311
9312 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
9313 {
9314         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9315         struct sk_buff *msg;
9316         void *hdr;
9317
9318         if (!rdev->wiphy.coalesce)
9319                 return -EOPNOTSUPP;
9320
9321         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9322         if (!msg)
9323                 return -ENOMEM;
9324
9325         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9326                              NL80211_CMD_GET_COALESCE);
9327         if (!hdr)
9328                 goto nla_put_failure;
9329
9330         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
9331                 goto nla_put_failure;
9332
9333         genlmsg_end(msg, hdr);
9334         return genlmsg_reply(msg, info);
9335
9336 nla_put_failure:
9337         nlmsg_free(msg);
9338         return -ENOBUFS;
9339 }
9340
9341 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
9342 {
9343         struct cfg80211_coalesce *coalesce = rdev->coalesce;
9344         int i, j;
9345         struct cfg80211_coalesce_rules *rule;
9346
9347         if (!coalesce)
9348                 return;
9349
9350         for (i = 0; i < coalesce->n_rules; i++) {
9351                 rule = &coalesce->rules[i];
9352                 for (j = 0; j < rule->n_patterns; j++)
9353                         kfree(rule->patterns[j].mask);
9354                 kfree(rule->patterns);
9355         }
9356         kfree(coalesce->rules);
9357         kfree(coalesce);
9358         rdev->coalesce = NULL;
9359 }
9360
9361 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
9362                                        struct nlattr *rule,
9363                                        struct cfg80211_coalesce_rules *new_rule)
9364 {
9365         int err, i;
9366         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
9367         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
9368         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
9369         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
9370
9371         err = nla_parse(tb, NL80211_ATTR_COALESCE_RULE_MAX, nla_data(rule),
9372                         nla_len(rule), nl80211_coalesce_policy);
9373         if (err)
9374                 return err;
9375
9376         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
9377                 new_rule->delay =
9378                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
9379         if (new_rule->delay > coalesce->max_delay)
9380                 return -EINVAL;
9381
9382         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
9383                 new_rule->condition =
9384                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
9385         if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
9386             new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
9387                 return -EINVAL;
9388
9389         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
9390                 return -EINVAL;
9391
9392         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
9393                             rem)
9394                 n_patterns++;
9395         if (n_patterns > coalesce->n_patterns)
9396                 return -EINVAL;
9397
9398         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
9399                                      GFP_KERNEL);
9400         if (!new_rule->patterns)
9401                 return -ENOMEM;
9402
9403         new_rule->n_patterns = n_patterns;
9404         i = 0;
9405
9406         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
9407                             rem) {
9408                 u8 *mask_pat;
9409
9410                 nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
9411                           nla_len(pat), NULL);
9412                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
9413                     !pat_tb[NL80211_PKTPAT_PATTERN])
9414                         return -EINVAL;
9415                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
9416                 mask_len = DIV_ROUND_UP(pat_len, 8);
9417                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
9418                         return -EINVAL;
9419                 if (pat_len > coalesce->pattern_max_len ||
9420                     pat_len < coalesce->pattern_min_len)
9421                         return -EINVAL;
9422
9423                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
9424                         pkt_offset = 0;
9425                 else
9426                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
9427                 if (pkt_offset > coalesce->max_pkt_offset)
9428                         return -EINVAL;
9429                 new_rule->patterns[i].pkt_offset = pkt_offset;
9430
9431                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
9432                 if (!mask_pat)
9433                         return -ENOMEM;
9434
9435                 new_rule->patterns[i].mask = mask_pat;
9436                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
9437                        mask_len);
9438
9439                 mask_pat += mask_len;
9440                 new_rule->patterns[i].pattern = mask_pat;
9441                 new_rule->patterns[i].pattern_len = pat_len;
9442                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
9443                        pat_len);
9444                 i++;
9445         }
9446
9447         return 0;
9448 }
9449
9450 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
9451 {
9452         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9453         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
9454         struct cfg80211_coalesce new_coalesce = {};
9455         struct cfg80211_coalesce *n_coalesce;
9456         int err, rem_rule, n_rules = 0, i, j;
9457         struct nlattr *rule;
9458         struct cfg80211_coalesce_rules *tmp_rule;
9459
9460         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
9461                 return -EOPNOTSUPP;
9462
9463         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
9464                 cfg80211_rdev_free_coalesce(rdev);
9465                 rdev->ops->set_coalesce(&rdev->wiphy, NULL);
9466                 return 0;
9467         }
9468
9469         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
9470                             rem_rule)
9471                 n_rules++;
9472         if (n_rules > coalesce->n_rules)
9473                 return -EINVAL;
9474
9475         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
9476                                      GFP_KERNEL);
9477         if (!new_coalesce.rules)
9478                 return -ENOMEM;
9479
9480         new_coalesce.n_rules = n_rules;
9481         i = 0;
9482
9483         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
9484                             rem_rule) {
9485                 err = nl80211_parse_coalesce_rule(rdev, rule,
9486                                                   &new_coalesce.rules[i]);
9487                 if (err)
9488                         goto error;
9489
9490                 i++;
9491         }
9492
9493         err = rdev->ops->set_coalesce(&rdev->wiphy, &new_coalesce);
9494         if (err)
9495                 goto error;
9496
9497         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
9498         if (!n_coalesce) {
9499                 err = -ENOMEM;
9500                 goto error;
9501         }
9502         cfg80211_rdev_free_coalesce(rdev);
9503         rdev->coalesce = n_coalesce;
9504
9505         return 0;
9506 error:
9507         for (i = 0; i < new_coalesce.n_rules; i++) {
9508                 tmp_rule = &new_coalesce.rules[i];
9509                 for (j = 0; j < tmp_rule->n_patterns; j++)
9510                         kfree(tmp_rule->patterns[j].mask);
9511                 kfree(tmp_rule->patterns);
9512         }
9513         kfree(new_coalesce.rules);
9514
9515         return err;
9516 }
9517
9518 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
9519 {
9520         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9521         struct net_device *dev = info->user_ptr[1];
9522         struct wireless_dev *wdev = dev->ieee80211_ptr;
9523         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
9524         struct cfg80211_gtk_rekey_data rekey_data;
9525         int err;
9526
9527         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
9528                 return -EINVAL;
9529
9530         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
9531                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
9532                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
9533                         nl80211_rekey_policy);
9534         if (err)
9535                 return err;
9536
9537         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
9538                 return -ERANGE;
9539         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
9540                 return -ERANGE;
9541         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
9542                 return -ERANGE;
9543
9544         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
9545         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
9546         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
9547
9548         wdev_lock(wdev);
9549         if (!wdev->current_bss) {
9550                 err = -ENOTCONN;
9551                 goto out;
9552         }
9553
9554         if (!rdev->ops->set_rekey_data) {
9555                 err = -EOPNOTSUPP;
9556                 goto out;
9557         }
9558
9559         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
9560  out:
9561         wdev_unlock(wdev);
9562         return err;
9563 }
9564
9565 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
9566                                              struct genl_info *info)
9567 {
9568         struct net_device *dev = info->user_ptr[1];
9569         struct wireless_dev *wdev = dev->ieee80211_ptr;
9570
9571         if (wdev->iftype != NL80211_IFTYPE_AP &&
9572             wdev->iftype != NL80211_IFTYPE_P2P_GO)
9573                 return -EINVAL;
9574
9575         if (wdev->ap_unexpected_nlportid)
9576                 return -EBUSY;
9577
9578         wdev->ap_unexpected_nlportid = info->snd_portid;
9579         return 0;
9580 }
9581
9582 static int nl80211_probe_client(struct sk_buff *skb,
9583                                 struct genl_info *info)
9584 {
9585         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9586         struct net_device *dev = info->user_ptr[1];
9587         struct wireless_dev *wdev = dev->ieee80211_ptr;
9588         struct sk_buff *msg;
9589         void *hdr;
9590         const u8 *addr;
9591         u64 cookie;
9592         int err;
9593
9594         if (wdev->iftype != NL80211_IFTYPE_AP &&
9595             wdev->iftype != NL80211_IFTYPE_P2P_GO)
9596                 return -EOPNOTSUPP;
9597
9598         if (!info->attrs[NL80211_ATTR_MAC])
9599                 return -EINVAL;
9600
9601         if (!rdev->ops->probe_client)
9602                 return -EOPNOTSUPP;
9603
9604         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9605         if (!msg)
9606                 return -ENOMEM;
9607
9608         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9609                              NL80211_CMD_PROBE_CLIENT);
9610         if (!hdr) {
9611                 err = -ENOBUFS;
9612                 goto free_msg;
9613         }
9614
9615         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
9616
9617         err = rdev_probe_client(rdev, dev, addr, &cookie);
9618         if (err)
9619                 goto free_msg;
9620
9621         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
9622                 goto nla_put_failure;
9623
9624         genlmsg_end(msg, hdr);
9625
9626         return genlmsg_reply(msg, info);
9627
9628  nla_put_failure:
9629         err = -ENOBUFS;
9630  free_msg:
9631         nlmsg_free(msg);
9632         return err;
9633 }
9634
9635 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
9636 {
9637         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9638         struct cfg80211_beacon_registration *reg, *nreg;
9639         int rv;
9640
9641         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
9642                 return -EOPNOTSUPP;
9643
9644         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
9645         if (!nreg)
9646                 return -ENOMEM;
9647
9648         /* First, check if already registered. */
9649         spin_lock_bh(&rdev->beacon_registrations_lock);
9650         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
9651                 if (reg->nlportid == info->snd_portid) {
9652                         rv = -EALREADY;
9653                         goto out_err;
9654                 }
9655         }
9656         /* Add it to the list */
9657         nreg->nlportid = info->snd_portid;
9658         list_add(&nreg->list, &rdev->beacon_registrations);
9659
9660         spin_unlock_bh(&rdev->beacon_registrations_lock);
9661
9662         return 0;
9663 out_err:
9664         spin_unlock_bh(&rdev->beacon_registrations_lock);
9665         kfree(nreg);
9666         return rv;
9667 }
9668
9669 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
9670 {
9671         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9672         struct wireless_dev *wdev = info->user_ptr[1];
9673         int err;
9674
9675         if (!rdev->ops->start_p2p_device)
9676                 return -EOPNOTSUPP;
9677
9678         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
9679                 return -EOPNOTSUPP;
9680
9681         if (wdev->p2p_started)
9682                 return 0;
9683
9684         if (rfkill_blocked(rdev->rfkill))
9685                 return -ERFKILL;
9686
9687         err = rdev_start_p2p_device(rdev, wdev);
9688         if (err)
9689                 return err;
9690
9691         wdev->p2p_started = true;
9692         rdev->opencount++;
9693
9694         return 0;
9695 }
9696
9697 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
9698 {
9699         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9700         struct wireless_dev *wdev = info->user_ptr[1];
9701
9702         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
9703                 return -EOPNOTSUPP;
9704
9705         if (!rdev->ops->stop_p2p_device)
9706                 return -EOPNOTSUPP;
9707
9708         cfg80211_stop_p2p_device(rdev, wdev);
9709
9710         return 0;
9711 }
9712
9713 static int nl80211_get_protocol_features(struct sk_buff *skb,
9714                                          struct genl_info *info)
9715 {
9716         void *hdr;
9717         struct sk_buff *msg;
9718
9719         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9720         if (!msg)
9721                 return -ENOMEM;
9722
9723         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9724                              NL80211_CMD_GET_PROTOCOL_FEATURES);
9725         if (!hdr)
9726                 goto nla_put_failure;
9727
9728         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
9729                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
9730                 goto nla_put_failure;
9731
9732         genlmsg_end(msg, hdr);
9733         return genlmsg_reply(msg, info);
9734
9735  nla_put_failure:
9736         kfree_skb(msg);
9737         return -ENOBUFS;
9738 }
9739
9740 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
9741 {
9742         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9743         struct cfg80211_update_ft_ies_params ft_params;
9744         struct net_device *dev = info->user_ptr[1];
9745
9746         if (!rdev->ops->update_ft_ies)
9747                 return -EOPNOTSUPP;
9748
9749         if (!info->attrs[NL80211_ATTR_MDID] ||
9750             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
9751                 return -EINVAL;
9752
9753         memset(&ft_params, 0, sizeof(ft_params));
9754         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
9755         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9756         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9757
9758         return rdev_update_ft_ies(rdev, dev, &ft_params);
9759 }
9760
9761 static int nl80211_crit_protocol_start(struct sk_buff *skb,
9762                                        struct genl_info *info)
9763 {
9764         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9765         struct wireless_dev *wdev = info->user_ptr[1];
9766         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
9767         u16 duration;
9768         int ret;
9769
9770         if (!rdev->ops->crit_proto_start)
9771                 return -EOPNOTSUPP;
9772
9773         if (WARN_ON(!rdev->ops->crit_proto_stop))
9774                 return -EINVAL;
9775
9776         if (rdev->crit_proto_nlportid)
9777                 return -EBUSY;
9778
9779         /* determine protocol if provided */
9780         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
9781                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
9782
9783         if (proto >= NUM_NL80211_CRIT_PROTO)
9784                 return -EINVAL;
9785
9786         /* timeout must be provided */
9787         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
9788                 return -EINVAL;
9789
9790         duration =
9791                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
9792
9793         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
9794                 return -ERANGE;
9795
9796         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
9797         if (!ret)
9798                 rdev->crit_proto_nlportid = info->snd_portid;
9799
9800         return ret;
9801 }
9802
9803 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
9804                                       struct genl_info *info)
9805 {
9806         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9807         struct wireless_dev *wdev = info->user_ptr[1];
9808
9809         if (!rdev->ops->crit_proto_stop)
9810                 return -EOPNOTSUPP;
9811
9812         if (rdev->crit_proto_nlportid) {
9813                 rdev->crit_proto_nlportid = 0;
9814                 rdev_crit_proto_stop(rdev, wdev);
9815         }
9816         return 0;
9817 }
9818
9819 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
9820 {
9821         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9822         struct wireless_dev *wdev =
9823                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
9824         int i, err;
9825         u32 vid, subcmd;
9826
9827         if (!rdev->wiphy.vendor_commands)
9828                 return -EOPNOTSUPP;
9829
9830         if (IS_ERR(wdev)) {
9831                 err = PTR_ERR(wdev);
9832                 if (err != -EINVAL)
9833                         return err;
9834                 wdev = NULL;
9835         } else if (wdev->wiphy != &rdev->wiphy) {
9836                 return -EINVAL;
9837         }
9838
9839         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
9840             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
9841                 return -EINVAL;
9842
9843         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
9844         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
9845         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
9846                 const struct wiphy_vendor_command *vcmd;
9847                 void *data = NULL;
9848                 int len = 0;
9849
9850                 vcmd = &rdev->wiphy.vendor_commands[i];
9851
9852                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
9853                         continue;
9854
9855                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
9856                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
9857                         if (!wdev)
9858                                 return -EINVAL;
9859                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
9860                             !wdev->netdev)
9861                                 return -EINVAL;
9862
9863                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
9864                                 if (wdev->netdev &&
9865                                     !netif_running(wdev->netdev))
9866                                         return -ENETDOWN;
9867                                 if (!wdev->netdev && !wdev->p2p_started)
9868                                         return -ENETDOWN;
9869                         }
9870                 } else {
9871                         wdev = NULL;
9872                 }
9873
9874                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
9875                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
9876                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
9877                 }
9878
9879                 rdev->cur_cmd_info = info;
9880                 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
9881                                                           data, len);
9882                 rdev->cur_cmd_info = NULL;
9883                 return err;
9884         }
9885
9886         return -EOPNOTSUPP;
9887 }
9888
9889 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
9890                                            enum nl80211_commands cmd,
9891                                            enum nl80211_attrs attr,
9892                                            int approxlen)
9893 {
9894         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
9895
9896         if (WARN_ON(!rdev->cur_cmd_info))
9897                 return NULL;
9898
9899         return __cfg80211_alloc_vendor_skb(rdev, approxlen,
9900                                            rdev->cur_cmd_info->snd_portid,
9901                                            rdev->cur_cmd_info->snd_seq,
9902                                            cmd, attr, NULL, GFP_KERNEL);
9903 }
9904 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
9905
9906 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
9907 {
9908         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
9909         void *hdr = ((void **)skb->cb)[1];
9910         struct nlattr *data = ((void **)skb->cb)[2];
9911
9912         /* clear CB data for netlink core to own from now on */
9913         memset(skb->cb, 0, sizeof(skb->cb));
9914
9915         if (WARN_ON(!rdev->cur_cmd_info)) {
9916                 kfree_skb(skb);
9917                 return -EINVAL;
9918         }
9919
9920         nla_nest_end(skb, data);
9921         genlmsg_end(skb, hdr);
9922         return genlmsg_reply(skb, rdev->cur_cmd_info);
9923 }
9924 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
9925
9926
9927 static int nl80211_set_qos_map(struct sk_buff *skb,
9928                                struct genl_info *info)
9929 {
9930         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9931         struct cfg80211_qos_map *qos_map = NULL;
9932         struct net_device *dev = info->user_ptr[1];
9933         u8 *pos, len, num_des, des_len, des;
9934         int ret;
9935
9936         if (!rdev->ops->set_qos_map)
9937                 return -EOPNOTSUPP;
9938
9939         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
9940                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
9941                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
9942
9943                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
9944                     len > IEEE80211_QOS_MAP_LEN_MAX)
9945                         return -EINVAL;
9946
9947                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
9948                 if (!qos_map)
9949                         return -ENOMEM;
9950
9951                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
9952                 if (num_des) {
9953                         des_len = num_des *
9954                                 sizeof(struct cfg80211_dscp_exception);
9955                         memcpy(qos_map->dscp_exception, pos, des_len);
9956                         qos_map->num_des = num_des;
9957                         for (des = 0; des < num_des; des++) {
9958                                 if (qos_map->dscp_exception[des].up > 7) {
9959                                         kfree(qos_map);
9960                                         return -EINVAL;
9961                                 }
9962                         }
9963                         pos += des_len;
9964                 }
9965                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
9966         }
9967
9968         wdev_lock(dev->ieee80211_ptr);
9969         ret = nl80211_key_allowed(dev->ieee80211_ptr);
9970         if (!ret)
9971                 ret = rdev_set_qos_map(rdev, dev, qos_map);
9972         wdev_unlock(dev->ieee80211_ptr);
9973
9974         kfree(qos_map);
9975         return ret;
9976 }
9977
9978 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
9979 {
9980         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9981         struct net_device *dev = info->user_ptr[1];
9982         struct wireless_dev *wdev = dev->ieee80211_ptr;
9983         const u8 *peer;
9984         u8 tsid, up;
9985         u16 admitted_time = 0;
9986         int err;
9987
9988         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
9989                 return -EOPNOTSUPP;
9990
9991         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
9992             !info->attrs[NL80211_ATTR_USER_PRIO])
9993                 return -EINVAL;
9994
9995         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
9996         if (tsid >= IEEE80211_NUM_TIDS)
9997                 return -EINVAL;
9998
9999         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
10000         if (up >= IEEE80211_NUM_UPS)
10001                 return -EINVAL;
10002
10003         /* WMM uses TIDs 0-7 even for TSPEC */
10004         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
10005                 /* TODO: handle 802.11 TSPEC/admission control
10006                  * need more attributes for that (e.g. BA session requirement);
10007                  * change the WMM adminssion test above to allow both then
10008                  */
10009                 return -EINVAL;
10010         }
10011
10012         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
10013
10014         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
10015                 admitted_time =
10016                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
10017                 if (!admitted_time)
10018                         return -EINVAL;
10019         }
10020
10021         wdev_lock(wdev);
10022         switch (wdev->iftype) {
10023         case NL80211_IFTYPE_STATION:
10024         case NL80211_IFTYPE_P2P_CLIENT:
10025                 if (wdev->current_bss)
10026                         break;
10027                 err = -ENOTCONN;
10028                 goto out;
10029         default:
10030                 err = -EOPNOTSUPP;
10031                 goto out;
10032         }
10033
10034         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
10035
10036  out:
10037         wdev_unlock(wdev);
10038         return err;
10039 }
10040
10041 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
10042 {
10043         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10044         struct net_device *dev = info->user_ptr[1];
10045         struct wireless_dev *wdev = dev->ieee80211_ptr;
10046         const u8 *peer;
10047         u8 tsid;
10048         int err;
10049
10050         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
10051                 return -EINVAL;
10052
10053         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
10054         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
10055
10056         wdev_lock(wdev);
10057         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
10058         wdev_unlock(wdev);
10059
10060         return err;
10061 }
10062
10063 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
10064                                        struct genl_info *info)
10065 {
10066         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10067         struct net_device *dev = info->user_ptr[1];
10068         struct wireless_dev *wdev = dev->ieee80211_ptr;
10069         struct cfg80211_chan_def chandef = {};
10070         const u8 *addr;
10071         u8 oper_class;
10072         int err;
10073
10074         if (!rdev->ops->tdls_channel_switch ||
10075             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
10076                 return -EOPNOTSUPP;
10077
10078         switch (dev->ieee80211_ptr->iftype) {
10079         case NL80211_IFTYPE_STATION:
10080         case NL80211_IFTYPE_P2P_CLIENT:
10081                 break;
10082         default:
10083                 return -EOPNOTSUPP;
10084         }
10085
10086         if (!info->attrs[NL80211_ATTR_MAC] ||
10087             !info->attrs[NL80211_ATTR_OPER_CLASS])
10088                 return -EINVAL;
10089
10090         err = nl80211_parse_chandef(rdev, info, &chandef);
10091         if (err)
10092                 return err;
10093
10094         /*
10095          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
10096          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
10097          * specification is not defined for them.
10098          */
10099         if (chandef.chan->band == IEEE80211_BAND_2GHZ &&
10100             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
10101             chandef.width != NL80211_CHAN_WIDTH_20)
10102                 return -EINVAL;
10103
10104         /* we will be active on the TDLS link */
10105         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef, wdev->iftype))
10106                 return -EINVAL;
10107
10108         /* don't allow switching to DFS channels */
10109         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
10110                 return -EINVAL;
10111
10112         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
10113         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
10114
10115         wdev_lock(wdev);
10116         err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
10117         wdev_unlock(wdev);
10118
10119         return err;
10120 }
10121
10122 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
10123                                               struct genl_info *info)
10124 {
10125         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10126         struct net_device *dev = info->user_ptr[1];
10127         struct wireless_dev *wdev = dev->ieee80211_ptr;
10128         const u8 *addr;
10129
10130         if (!rdev->ops->tdls_channel_switch ||
10131             !rdev->ops->tdls_cancel_channel_switch ||
10132             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
10133                 return -EOPNOTSUPP;
10134
10135         switch (dev->ieee80211_ptr->iftype) {
10136         case NL80211_IFTYPE_STATION:
10137         case NL80211_IFTYPE_P2P_CLIENT:
10138                 break;
10139         default:
10140                 return -EOPNOTSUPP;
10141         }
10142
10143         if (!info->attrs[NL80211_ATTR_MAC])
10144                 return -EINVAL;
10145
10146         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
10147
10148         wdev_lock(wdev);
10149         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
10150         wdev_unlock(wdev);
10151
10152         return 0;
10153 }
10154
10155 #define NL80211_FLAG_NEED_WIPHY         0x01
10156 #define NL80211_FLAG_NEED_NETDEV        0x02
10157 #define NL80211_FLAG_NEED_RTNL          0x04
10158 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
10159 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
10160                                          NL80211_FLAG_CHECK_NETDEV_UP)
10161 #define NL80211_FLAG_NEED_WDEV          0x10
10162 /* If a netdev is associated, it must be UP, P2P must be started */
10163 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
10164                                          NL80211_FLAG_CHECK_NETDEV_UP)
10165 #define NL80211_FLAG_CLEAR_SKB          0x20
10166
10167 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
10168                             struct genl_info *info)
10169 {
10170         struct cfg80211_registered_device *rdev;
10171         struct wireless_dev *wdev;
10172         struct net_device *dev;
10173         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
10174
10175         if (rtnl)
10176                 rtnl_lock();
10177
10178         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
10179                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
10180                 if (IS_ERR(rdev)) {
10181                         if (rtnl)
10182                                 rtnl_unlock();
10183                         return PTR_ERR(rdev);
10184                 }
10185                 info->user_ptr[0] = rdev;
10186         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
10187                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
10188                 ASSERT_RTNL();
10189
10190                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
10191                                                   info->attrs);
10192                 if (IS_ERR(wdev)) {
10193                         if (rtnl)
10194                                 rtnl_unlock();
10195                         return PTR_ERR(wdev);
10196                 }
10197
10198                 dev = wdev->netdev;
10199                 rdev = wiphy_to_rdev(wdev->wiphy);
10200
10201                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
10202                         if (!dev) {
10203                                 if (rtnl)
10204                                         rtnl_unlock();
10205                                 return -EINVAL;
10206                         }
10207
10208                         info->user_ptr[1] = dev;
10209                 } else {
10210                         info->user_ptr[1] = wdev;
10211                 }
10212
10213                 if (dev) {
10214                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
10215                             !netif_running(dev)) {
10216                                 if (rtnl)
10217                                         rtnl_unlock();
10218                                 return -ENETDOWN;
10219                         }
10220
10221                         dev_hold(dev);
10222                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
10223                         if (!wdev->p2p_started) {
10224                                 if (rtnl)
10225                                         rtnl_unlock();
10226                                 return -ENETDOWN;
10227                         }
10228                 }
10229
10230                 info->user_ptr[0] = rdev;
10231         }
10232
10233         return 0;
10234 }
10235
10236 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
10237                               struct genl_info *info)
10238 {
10239         if (info->user_ptr[1]) {
10240                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
10241                         struct wireless_dev *wdev = info->user_ptr[1];
10242
10243                         if (wdev->netdev)
10244                                 dev_put(wdev->netdev);
10245                 } else {
10246                         dev_put(info->user_ptr[1]);
10247                 }
10248         }
10249
10250         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
10251                 rtnl_unlock();
10252
10253         /* If needed, clear the netlink message payload from the SKB
10254          * as it might contain key data that shouldn't stick around on
10255          * the heap after the SKB is freed. The netlink message header
10256          * is still needed for further processing, so leave it intact.
10257          */
10258         if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
10259                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
10260
10261                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
10262         }
10263 }
10264
10265 static const struct genl_ops nl80211_ops[] = {
10266         {
10267                 .cmd = NL80211_CMD_GET_WIPHY,
10268                 .doit = nl80211_get_wiphy,
10269                 .dumpit = nl80211_dump_wiphy,
10270                 .done = nl80211_dump_wiphy_done,
10271                 .policy = nl80211_policy,
10272                 /* can be retrieved by unprivileged users */
10273                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10274                                   NL80211_FLAG_NEED_RTNL,
10275         },
10276         {
10277                 .cmd = NL80211_CMD_SET_WIPHY,
10278                 .doit = nl80211_set_wiphy,
10279                 .policy = nl80211_policy,
10280                 .flags = GENL_ADMIN_PERM,
10281                 .internal_flags = NL80211_FLAG_NEED_RTNL,
10282         },
10283         {
10284                 .cmd = NL80211_CMD_GET_INTERFACE,
10285                 .doit = nl80211_get_interface,
10286                 .dumpit = nl80211_dump_interface,
10287                 .policy = nl80211_policy,
10288                 /* can be retrieved by unprivileged users */
10289                 .internal_flags = NL80211_FLAG_NEED_WDEV |
10290                                   NL80211_FLAG_NEED_RTNL,
10291         },
10292         {
10293                 .cmd = NL80211_CMD_SET_INTERFACE,
10294                 .doit = nl80211_set_interface,
10295                 .policy = nl80211_policy,
10296                 .flags = GENL_ADMIN_PERM,
10297                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10298                                   NL80211_FLAG_NEED_RTNL,
10299         },
10300         {
10301                 .cmd = NL80211_CMD_NEW_INTERFACE,
10302                 .doit = nl80211_new_interface,
10303                 .policy = nl80211_policy,
10304                 .flags = GENL_ADMIN_PERM,
10305                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10306                                   NL80211_FLAG_NEED_RTNL,
10307         },
10308         {
10309                 .cmd = NL80211_CMD_DEL_INTERFACE,
10310                 .doit = nl80211_del_interface,
10311                 .policy = nl80211_policy,
10312                 .flags = GENL_ADMIN_PERM,
10313                 .internal_flags = NL80211_FLAG_NEED_WDEV |
10314                                   NL80211_FLAG_NEED_RTNL,
10315         },
10316         {
10317                 .cmd = NL80211_CMD_GET_KEY,
10318                 .doit = nl80211_get_key,
10319                 .policy = nl80211_policy,
10320                 .flags = GENL_ADMIN_PERM,
10321                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10322                                   NL80211_FLAG_NEED_RTNL,
10323         },
10324         {
10325                 .cmd = NL80211_CMD_SET_KEY,
10326                 .doit = nl80211_set_key,
10327                 .policy = nl80211_policy,
10328                 .flags = GENL_ADMIN_PERM,
10329                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10330                                   NL80211_FLAG_NEED_RTNL |
10331                                   NL80211_FLAG_CLEAR_SKB,
10332         },
10333         {
10334                 .cmd = NL80211_CMD_NEW_KEY,
10335                 .doit = nl80211_new_key,
10336                 .policy = nl80211_policy,
10337                 .flags = GENL_ADMIN_PERM,
10338                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10339                                   NL80211_FLAG_NEED_RTNL |
10340                                   NL80211_FLAG_CLEAR_SKB,
10341         },
10342         {
10343                 .cmd = NL80211_CMD_DEL_KEY,
10344                 .doit = nl80211_del_key,
10345                 .policy = nl80211_policy,
10346                 .flags = GENL_ADMIN_PERM,
10347                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10348                                   NL80211_FLAG_NEED_RTNL,
10349         },
10350         {
10351                 .cmd = NL80211_CMD_SET_BEACON,
10352                 .policy = nl80211_policy,
10353                 .flags = GENL_ADMIN_PERM,
10354                 .doit = nl80211_set_beacon,
10355                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10356                                   NL80211_FLAG_NEED_RTNL,
10357         },
10358         {
10359                 .cmd = NL80211_CMD_START_AP,
10360                 .policy = nl80211_policy,
10361                 .flags = GENL_ADMIN_PERM,
10362                 .doit = nl80211_start_ap,
10363                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10364                                   NL80211_FLAG_NEED_RTNL,
10365         },
10366         {
10367                 .cmd = NL80211_CMD_STOP_AP,
10368                 .policy = nl80211_policy,
10369                 .flags = GENL_ADMIN_PERM,
10370                 .doit = nl80211_stop_ap,
10371                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10372                                   NL80211_FLAG_NEED_RTNL,
10373         },
10374         {
10375                 .cmd = NL80211_CMD_GET_STATION,
10376                 .doit = nl80211_get_station,
10377                 .dumpit = nl80211_dump_station,
10378                 .policy = nl80211_policy,
10379                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10380                                   NL80211_FLAG_NEED_RTNL,
10381         },
10382         {
10383                 .cmd = NL80211_CMD_SET_STATION,
10384                 .doit = nl80211_set_station,
10385                 .policy = nl80211_policy,
10386                 .flags = GENL_ADMIN_PERM,
10387                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10388                                   NL80211_FLAG_NEED_RTNL,
10389         },
10390         {
10391                 .cmd = NL80211_CMD_NEW_STATION,
10392                 .doit = nl80211_new_station,
10393                 .policy = nl80211_policy,
10394                 .flags = GENL_ADMIN_PERM,
10395                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10396                                   NL80211_FLAG_NEED_RTNL,
10397         },
10398         {
10399                 .cmd = NL80211_CMD_DEL_STATION,
10400                 .doit = nl80211_del_station,
10401                 .policy = nl80211_policy,
10402                 .flags = GENL_ADMIN_PERM,
10403                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10404                                   NL80211_FLAG_NEED_RTNL,
10405         },
10406         {
10407                 .cmd = NL80211_CMD_GET_MPATH,
10408                 .doit = nl80211_get_mpath,
10409                 .dumpit = nl80211_dump_mpath,
10410                 .policy = nl80211_policy,
10411                 .flags = GENL_ADMIN_PERM,
10412                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10413                                   NL80211_FLAG_NEED_RTNL,
10414         },
10415         {
10416                 .cmd = NL80211_CMD_GET_MPP,
10417                 .doit = nl80211_get_mpp,
10418                 .dumpit = nl80211_dump_mpp,
10419                 .policy = nl80211_policy,
10420                 .flags = GENL_ADMIN_PERM,
10421                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10422                                   NL80211_FLAG_NEED_RTNL,
10423         },
10424         {
10425                 .cmd = NL80211_CMD_SET_MPATH,
10426                 .doit = nl80211_set_mpath,
10427                 .policy = nl80211_policy,
10428                 .flags = GENL_ADMIN_PERM,
10429                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10430                                   NL80211_FLAG_NEED_RTNL,
10431         },
10432         {
10433                 .cmd = NL80211_CMD_NEW_MPATH,
10434                 .doit = nl80211_new_mpath,
10435                 .policy = nl80211_policy,
10436                 .flags = GENL_ADMIN_PERM,
10437                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10438                                   NL80211_FLAG_NEED_RTNL,
10439         },
10440         {
10441                 .cmd = NL80211_CMD_DEL_MPATH,
10442                 .doit = nl80211_del_mpath,
10443                 .policy = nl80211_policy,
10444                 .flags = GENL_ADMIN_PERM,
10445                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10446                                   NL80211_FLAG_NEED_RTNL,
10447         },
10448         {
10449                 .cmd = NL80211_CMD_SET_BSS,
10450                 .doit = nl80211_set_bss,
10451                 .policy = nl80211_policy,
10452                 .flags = GENL_ADMIN_PERM,
10453                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10454                                   NL80211_FLAG_NEED_RTNL,
10455         },
10456         {
10457                 .cmd = NL80211_CMD_GET_REG,
10458                 .doit = nl80211_get_reg_do,
10459                 .dumpit = nl80211_get_reg_dump,
10460                 .policy = nl80211_policy,
10461                 .internal_flags = NL80211_FLAG_NEED_RTNL,
10462                 /* can be retrieved by unprivileged users */
10463         },
10464         {
10465                 .cmd = NL80211_CMD_SET_REG,
10466                 .doit = nl80211_set_reg,
10467                 .policy = nl80211_policy,
10468                 .flags = GENL_ADMIN_PERM,
10469                 .internal_flags = NL80211_FLAG_NEED_RTNL,
10470         },
10471         {
10472                 .cmd = NL80211_CMD_REQ_SET_REG,
10473                 .doit = nl80211_req_set_reg,
10474                 .policy = nl80211_policy,
10475                 .flags = GENL_ADMIN_PERM,
10476         },
10477         {
10478                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
10479                 .doit = nl80211_get_mesh_config,
10480                 .policy = nl80211_policy,
10481                 /* can be retrieved by unprivileged users */
10482                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10483                                   NL80211_FLAG_NEED_RTNL,
10484         },
10485         {
10486                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
10487                 .doit = nl80211_update_mesh_config,
10488                 .policy = nl80211_policy,
10489                 .flags = GENL_ADMIN_PERM,
10490                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10491                                   NL80211_FLAG_NEED_RTNL,
10492         },
10493         {
10494                 .cmd = NL80211_CMD_TRIGGER_SCAN,
10495                 .doit = nl80211_trigger_scan,
10496                 .policy = nl80211_policy,
10497                 .flags = GENL_ADMIN_PERM,
10498                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10499                                   NL80211_FLAG_NEED_RTNL,
10500         },
10501         {
10502                 .cmd = NL80211_CMD_GET_SCAN,
10503                 .policy = nl80211_policy,
10504                 .dumpit = nl80211_dump_scan,
10505         },
10506         {
10507                 .cmd = NL80211_CMD_START_SCHED_SCAN,
10508                 .doit = nl80211_start_sched_scan,
10509                 .policy = nl80211_policy,
10510                 .flags = GENL_ADMIN_PERM,
10511                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10512                                   NL80211_FLAG_NEED_RTNL,
10513         },
10514         {
10515                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
10516                 .doit = nl80211_stop_sched_scan,
10517                 .policy = nl80211_policy,
10518                 .flags = GENL_ADMIN_PERM,
10519                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10520                                   NL80211_FLAG_NEED_RTNL,
10521         },
10522         {
10523                 .cmd = NL80211_CMD_AUTHENTICATE,
10524                 .doit = nl80211_authenticate,
10525                 .policy = nl80211_policy,
10526                 .flags = GENL_ADMIN_PERM,
10527                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10528                                   NL80211_FLAG_NEED_RTNL |
10529                                   NL80211_FLAG_CLEAR_SKB,
10530         },
10531         {
10532                 .cmd = NL80211_CMD_ASSOCIATE,
10533                 .doit = nl80211_associate,
10534                 .policy = nl80211_policy,
10535                 .flags = GENL_ADMIN_PERM,
10536                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10537                                   NL80211_FLAG_NEED_RTNL,
10538         },
10539         {
10540                 .cmd = NL80211_CMD_DEAUTHENTICATE,
10541                 .doit = nl80211_deauthenticate,
10542                 .policy = nl80211_policy,
10543                 .flags = GENL_ADMIN_PERM,
10544                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10545                                   NL80211_FLAG_NEED_RTNL,
10546         },
10547         {
10548                 .cmd = NL80211_CMD_DISASSOCIATE,
10549                 .doit = nl80211_disassociate,
10550                 .policy = nl80211_policy,
10551                 .flags = GENL_ADMIN_PERM,
10552                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10553                                   NL80211_FLAG_NEED_RTNL,
10554         },
10555         {
10556                 .cmd = NL80211_CMD_JOIN_IBSS,
10557                 .doit = nl80211_join_ibss,
10558                 .policy = nl80211_policy,
10559                 .flags = GENL_ADMIN_PERM,
10560                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10561                                   NL80211_FLAG_NEED_RTNL,
10562         },
10563         {
10564                 .cmd = NL80211_CMD_LEAVE_IBSS,
10565                 .doit = nl80211_leave_ibss,
10566                 .policy = nl80211_policy,
10567                 .flags = GENL_ADMIN_PERM,
10568                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10569                                   NL80211_FLAG_NEED_RTNL,
10570         },
10571 #ifdef CONFIG_NL80211_TESTMODE
10572         {
10573                 .cmd = NL80211_CMD_TESTMODE,
10574                 .doit = nl80211_testmode_do,
10575                 .dumpit = nl80211_testmode_dump,
10576                 .policy = nl80211_policy,
10577                 .flags = GENL_ADMIN_PERM,
10578                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10579                                   NL80211_FLAG_NEED_RTNL,
10580         },
10581 #endif
10582         {
10583                 .cmd = NL80211_CMD_CONNECT,
10584                 .doit = nl80211_connect,
10585                 .policy = nl80211_policy,
10586                 .flags = GENL_ADMIN_PERM,
10587                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10588                                   NL80211_FLAG_NEED_RTNL,
10589         },
10590         {
10591                 .cmd = NL80211_CMD_DISCONNECT,
10592                 .doit = nl80211_disconnect,
10593                 .policy = nl80211_policy,
10594                 .flags = GENL_ADMIN_PERM,
10595                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10596                                   NL80211_FLAG_NEED_RTNL,
10597         },
10598         {
10599                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
10600                 .doit = nl80211_wiphy_netns,
10601                 .policy = nl80211_policy,
10602                 .flags = GENL_ADMIN_PERM,
10603                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10604                                   NL80211_FLAG_NEED_RTNL,
10605         },
10606         {
10607                 .cmd = NL80211_CMD_GET_SURVEY,
10608                 .policy = nl80211_policy,
10609                 .dumpit = nl80211_dump_survey,
10610         },
10611         {
10612                 .cmd = NL80211_CMD_SET_PMKSA,
10613                 .doit = nl80211_setdel_pmksa,
10614                 .policy = nl80211_policy,
10615                 .flags = GENL_ADMIN_PERM,
10616                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10617                                   NL80211_FLAG_NEED_RTNL,
10618         },
10619         {
10620                 .cmd = NL80211_CMD_DEL_PMKSA,
10621                 .doit = nl80211_setdel_pmksa,
10622                 .policy = nl80211_policy,
10623                 .flags = GENL_ADMIN_PERM,
10624                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10625                                   NL80211_FLAG_NEED_RTNL,
10626         },
10627         {
10628                 .cmd = NL80211_CMD_FLUSH_PMKSA,
10629                 .doit = nl80211_flush_pmksa,
10630                 .policy = nl80211_policy,
10631                 .flags = GENL_ADMIN_PERM,
10632                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10633                                   NL80211_FLAG_NEED_RTNL,
10634         },
10635         {
10636                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
10637                 .doit = nl80211_remain_on_channel,
10638                 .policy = nl80211_policy,
10639                 .flags = GENL_ADMIN_PERM,
10640                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10641                                   NL80211_FLAG_NEED_RTNL,
10642         },
10643         {
10644                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
10645                 .doit = nl80211_cancel_remain_on_channel,
10646                 .policy = nl80211_policy,
10647                 .flags = GENL_ADMIN_PERM,
10648                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10649                                   NL80211_FLAG_NEED_RTNL,
10650         },
10651         {
10652                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
10653                 .doit = nl80211_set_tx_bitrate_mask,
10654                 .policy = nl80211_policy,
10655                 .flags = GENL_ADMIN_PERM,
10656                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10657                                   NL80211_FLAG_NEED_RTNL,
10658         },
10659         {
10660                 .cmd = NL80211_CMD_REGISTER_FRAME,
10661                 .doit = nl80211_register_mgmt,
10662                 .policy = nl80211_policy,
10663                 .flags = GENL_ADMIN_PERM,
10664                 .internal_flags = NL80211_FLAG_NEED_WDEV |
10665                                   NL80211_FLAG_NEED_RTNL,
10666         },
10667         {
10668                 .cmd = NL80211_CMD_FRAME,
10669                 .doit = nl80211_tx_mgmt,
10670                 .policy = nl80211_policy,
10671                 .flags = GENL_ADMIN_PERM,
10672                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10673                                   NL80211_FLAG_NEED_RTNL,
10674         },
10675         {
10676                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
10677                 .doit = nl80211_tx_mgmt_cancel_wait,
10678                 .policy = nl80211_policy,
10679                 .flags = GENL_ADMIN_PERM,
10680                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10681                                   NL80211_FLAG_NEED_RTNL,
10682         },
10683         {
10684                 .cmd = NL80211_CMD_SET_POWER_SAVE,
10685                 .doit = nl80211_set_power_save,
10686                 .policy = nl80211_policy,
10687                 .flags = GENL_ADMIN_PERM,
10688                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10689                                   NL80211_FLAG_NEED_RTNL,
10690         },
10691         {
10692                 .cmd = NL80211_CMD_GET_POWER_SAVE,
10693                 .doit = nl80211_get_power_save,
10694                 .policy = nl80211_policy,
10695                 /* can be retrieved by unprivileged users */
10696                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10697                                   NL80211_FLAG_NEED_RTNL,
10698         },
10699         {
10700                 .cmd = NL80211_CMD_SET_CQM,
10701                 .doit = nl80211_set_cqm,
10702                 .policy = nl80211_policy,
10703                 .flags = GENL_ADMIN_PERM,
10704                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10705                                   NL80211_FLAG_NEED_RTNL,
10706         },
10707         {
10708                 .cmd = NL80211_CMD_SET_CHANNEL,
10709                 .doit = nl80211_set_channel,
10710                 .policy = nl80211_policy,
10711                 .flags = GENL_ADMIN_PERM,
10712                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10713                                   NL80211_FLAG_NEED_RTNL,
10714         },
10715         {
10716                 .cmd = NL80211_CMD_SET_WDS_PEER,
10717                 .doit = nl80211_set_wds_peer,
10718                 .policy = nl80211_policy,
10719                 .flags = GENL_ADMIN_PERM,
10720                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10721                                   NL80211_FLAG_NEED_RTNL,
10722         },
10723         {
10724                 .cmd = NL80211_CMD_JOIN_MESH,
10725                 .doit = nl80211_join_mesh,
10726                 .policy = nl80211_policy,
10727                 .flags = GENL_ADMIN_PERM,
10728                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10729                                   NL80211_FLAG_NEED_RTNL,
10730         },
10731         {
10732                 .cmd = NL80211_CMD_LEAVE_MESH,
10733                 .doit = nl80211_leave_mesh,
10734                 .policy = nl80211_policy,
10735                 .flags = GENL_ADMIN_PERM,
10736                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10737                                   NL80211_FLAG_NEED_RTNL,
10738         },
10739         {
10740                 .cmd = NL80211_CMD_JOIN_OCB,
10741                 .doit = nl80211_join_ocb,
10742                 .policy = nl80211_policy,
10743                 .flags = GENL_ADMIN_PERM,
10744                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10745                                   NL80211_FLAG_NEED_RTNL,
10746         },
10747         {
10748                 .cmd = NL80211_CMD_LEAVE_OCB,
10749                 .doit = nl80211_leave_ocb,
10750                 .policy = nl80211_policy,
10751                 .flags = GENL_ADMIN_PERM,
10752                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10753                                   NL80211_FLAG_NEED_RTNL,
10754         },
10755 #ifdef CONFIG_PM
10756         {
10757                 .cmd = NL80211_CMD_GET_WOWLAN,
10758                 .doit = nl80211_get_wowlan,
10759                 .policy = nl80211_policy,
10760                 /* can be retrieved by unprivileged users */
10761                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10762                                   NL80211_FLAG_NEED_RTNL,
10763         },
10764         {
10765                 .cmd = NL80211_CMD_SET_WOWLAN,
10766                 .doit = nl80211_set_wowlan,
10767                 .policy = nl80211_policy,
10768                 .flags = GENL_ADMIN_PERM,
10769                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10770                                   NL80211_FLAG_NEED_RTNL,
10771         },
10772 #endif
10773         {
10774                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
10775                 .doit = nl80211_set_rekey_data,
10776                 .policy = nl80211_policy,
10777                 .flags = GENL_ADMIN_PERM,
10778                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10779                                   NL80211_FLAG_NEED_RTNL |
10780                                   NL80211_FLAG_CLEAR_SKB,
10781         },
10782         {
10783                 .cmd = NL80211_CMD_TDLS_MGMT,
10784                 .doit = nl80211_tdls_mgmt,
10785                 .policy = nl80211_policy,
10786                 .flags = GENL_ADMIN_PERM,
10787                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10788                                   NL80211_FLAG_NEED_RTNL,
10789         },
10790         {
10791                 .cmd = NL80211_CMD_TDLS_OPER,
10792                 .doit = nl80211_tdls_oper,
10793                 .policy = nl80211_policy,
10794                 .flags = GENL_ADMIN_PERM,
10795                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10796                                   NL80211_FLAG_NEED_RTNL,
10797         },
10798         {
10799                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
10800                 .doit = nl80211_register_unexpected_frame,
10801                 .policy = nl80211_policy,
10802                 .flags = GENL_ADMIN_PERM,
10803                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10804                                   NL80211_FLAG_NEED_RTNL,
10805         },
10806         {
10807                 .cmd = NL80211_CMD_PROBE_CLIENT,
10808                 .doit = nl80211_probe_client,
10809                 .policy = nl80211_policy,
10810                 .flags = GENL_ADMIN_PERM,
10811                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10812                                   NL80211_FLAG_NEED_RTNL,
10813         },
10814         {
10815                 .cmd = NL80211_CMD_REGISTER_BEACONS,
10816                 .doit = nl80211_register_beacons,
10817                 .policy = nl80211_policy,
10818                 .flags = GENL_ADMIN_PERM,
10819                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10820                                   NL80211_FLAG_NEED_RTNL,
10821         },
10822         {
10823                 .cmd = NL80211_CMD_SET_NOACK_MAP,
10824                 .doit = nl80211_set_noack_map,
10825                 .policy = nl80211_policy,
10826                 .flags = GENL_ADMIN_PERM,
10827                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10828                                   NL80211_FLAG_NEED_RTNL,
10829         },
10830         {
10831                 .cmd = NL80211_CMD_START_P2P_DEVICE,
10832                 .doit = nl80211_start_p2p_device,
10833                 .policy = nl80211_policy,
10834                 .flags = GENL_ADMIN_PERM,
10835                 .internal_flags = NL80211_FLAG_NEED_WDEV |
10836                                   NL80211_FLAG_NEED_RTNL,
10837         },
10838         {
10839                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
10840                 .doit = nl80211_stop_p2p_device,
10841                 .policy = nl80211_policy,
10842                 .flags = GENL_ADMIN_PERM,
10843                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10844                                   NL80211_FLAG_NEED_RTNL,
10845         },
10846         {
10847                 .cmd = NL80211_CMD_SET_MCAST_RATE,
10848                 .doit = nl80211_set_mcast_rate,
10849                 .policy = nl80211_policy,
10850                 .flags = GENL_ADMIN_PERM,
10851                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10852                                   NL80211_FLAG_NEED_RTNL,
10853         },
10854         {
10855                 .cmd = NL80211_CMD_SET_MAC_ACL,
10856                 .doit = nl80211_set_mac_acl,
10857                 .policy = nl80211_policy,
10858                 .flags = GENL_ADMIN_PERM,
10859                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10860                                   NL80211_FLAG_NEED_RTNL,
10861         },
10862         {
10863                 .cmd = NL80211_CMD_RADAR_DETECT,
10864                 .doit = nl80211_start_radar_detection,
10865                 .policy = nl80211_policy,
10866                 .flags = GENL_ADMIN_PERM,
10867                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10868                                   NL80211_FLAG_NEED_RTNL,
10869         },
10870         {
10871                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
10872                 .doit = nl80211_get_protocol_features,
10873                 .policy = nl80211_policy,
10874         },
10875         {
10876                 .cmd = NL80211_CMD_UPDATE_FT_IES,
10877                 .doit = nl80211_update_ft_ies,
10878                 .policy = nl80211_policy,
10879                 .flags = GENL_ADMIN_PERM,
10880                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10881                                   NL80211_FLAG_NEED_RTNL,
10882         },
10883         {
10884                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
10885                 .doit = nl80211_crit_protocol_start,
10886                 .policy = nl80211_policy,
10887                 .flags = GENL_ADMIN_PERM,
10888                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10889                                   NL80211_FLAG_NEED_RTNL,
10890         },
10891         {
10892                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
10893                 .doit = nl80211_crit_protocol_stop,
10894                 .policy = nl80211_policy,
10895                 .flags = GENL_ADMIN_PERM,
10896                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10897                                   NL80211_FLAG_NEED_RTNL,
10898         },
10899         {
10900                 .cmd = NL80211_CMD_GET_COALESCE,
10901                 .doit = nl80211_get_coalesce,
10902                 .policy = nl80211_policy,
10903                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10904                                   NL80211_FLAG_NEED_RTNL,
10905         },
10906         {
10907                 .cmd = NL80211_CMD_SET_COALESCE,
10908                 .doit = nl80211_set_coalesce,
10909                 .policy = nl80211_policy,
10910                 .flags = GENL_ADMIN_PERM,
10911                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10912                                   NL80211_FLAG_NEED_RTNL,
10913         },
10914         {
10915                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
10916                 .doit = nl80211_channel_switch,
10917                 .policy = nl80211_policy,
10918                 .flags = GENL_ADMIN_PERM,
10919                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10920                                   NL80211_FLAG_NEED_RTNL,
10921         },
10922         {
10923                 .cmd = NL80211_CMD_VENDOR,
10924                 .doit = nl80211_vendor_cmd,
10925                 .policy = nl80211_policy,
10926                 .flags = GENL_ADMIN_PERM,
10927                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10928                                   NL80211_FLAG_NEED_RTNL,
10929         },
10930         {
10931                 .cmd = NL80211_CMD_SET_QOS_MAP,
10932                 .doit = nl80211_set_qos_map,
10933                 .policy = nl80211_policy,
10934                 .flags = GENL_ADMIN_PERM,
10935                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10936                                   NL80211_FLAG_NEED_RTNL,
10937         },
10938         {
10939                 .cmd = NL80211_CMD_ADD_TX_TS,
10940                 .doit = nl80211_add_tx_ts,
10941                 .policy = nl80211_policy,
10942                 .flags = GENL_ADMIN_PERM,
10943                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10944                                   NL80211_FLAG_NEED_RTNL,
10945         },
10946         {
10947                 .cmd = NL80211_CMD_DEL_TX_TS,
10948                 .doit = nl80211_del_tx_ts,
10949                 .policy = nl80211_policy,
10950                 .flags = GENL_ADMIN_PERM,
10951                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10952                                   NL80211_FLAG_NEED_RTNL,
10953         },
10954         {
10955                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
10956                 .doit = nl80211_tdls_channel_switch,
10957                 .policy = nl80211_policy,
10958                 .flags = GENL_ADMIN_PERM,
10959                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10960                                   NL80211_FLAG_NEED_RTNL,
10961         },
10962         {
10963                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
10964                 .doit = nl80211_tdls_cancel_channel_switch,
10965                 .policy = nl80211_policy,
10966                 .flags = GENL_ADMIN_PERM,
10967                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10968                                   NL80211_FLAG_NEED_RTNL,
10969         },
10970 };
10971
10972 /* notification functions */
10973
10974 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
10975                           enum nl80211_commands cmd)
10976 {
10977         struct sk_buff *msg;
10978         struct nl80211_dump_wiphy_state state = {};
10979
10980         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
10981                 cmd != NL80211_CMD_DEL_WIPHY);
10982
10983         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10984         if (!msg)
10985                 return;
10986
10987         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
10988                 nlmsg_free(msg);
10989                 return;
10990         }
10991
10992         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10993                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
10994 }
10995
10996 static int nl80211_add_scan_req(struct sk_buff *msg,
10997                                 struct cfg80211_registered_device *rdev)
10998 {
10999         struct cfg80211_scan_request *req = rdev->scan_req;
11000         struct nlattr *nest;
11001         int i;
11002
11003         if (WARN_ON(!req))
11004                 return 0;
11005
11006         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
11007         if (!nest)
11008                 goto nla_put_failure;
11009         for (i = 0; i < req->n_ssids; i++) {
11010                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
11011                         goto nla_put_failure;
11012         }
11013         nla_nest_end(msg, nest);
11014
11015         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
11016         if (!nest)
11017                 goto nla_put_failure;
11018         for (i = 0; i < req->n_channels; i++) {
11019                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
11020                         goto nla_put_failure;
11021         }
11022         nla_nest_end(msg, nest);
11023
11024         if (req->ie &&
11025             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
11026                 goto nla_put_failure;
11027
11028         if (req->flags &&
11029             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
11030                 goto nla_put_failure;
11031
11032         return 0;
11033  nla_put_failure:
11034         return -ENOBUFS;
11035 }
11036
11037 static int nl80211_send_scan_msg(struct sk_buff *msg,
11038                                  struct cfg80211_registered_device *rdev,
11039                                  struct wireless_dev *wdev,
11040                                  u32 portid, u32 seq, int flags,
11041                                  u32 cmd)
11042 {
11043         void *hdr;
11044
11045         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
11046         if (!hdr)
11047                 return -1;
11048
11049         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11050             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11051                                          wdev->netdev->ifindex)) ||
11052             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11053                 goto nla_put_failure;
11054
11055         /* ignore errors and send incomplete event anyway */
11056         nl80211_add_scan_req(msg, rdev);
11057
11058         genlmsg_end(msg, hdr);
11059         return 0;
11060
11061  nla_put_failure:
11062         genlmsg_cancel(msg, hdr);
11063         return -EMSGSIZE;
11064 }
11065
11066 static int
11067 nl80211_send_sched_scan_msg(struct sk_buff *msg,
11068                             struct cfg80211_registered_device *rdev,
11069                             struct net_device *netdev,
11070                             u32 portid, u32 seq, int flags, u32 cmd)
11071 {
11072         void *hdr;
11073
11074         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
11075         if (!hdr)
11076                 return -1;
11077
11078         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11079             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
11080                 goto nla_put_failure;
11081
11082         genlmsg_end(msg, hdr);
11083         return 0;
11084
11085  nla_put_failure:
11086         genlmsg_cancel(msg, hdr);
11087         return -EMSGSIZE;
11088 }
11089
11090 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
11091                              struct wireless_dev *wdev)
11092 {
11093         struct sk_buff *msg;
11094
11095         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11096         if (!msg)
11097                 return;
11098
11099         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
11100                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
11101                 nlmsg_free(msg);
11102                 return;
11103         }
11104
11105         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11106                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
11107 }
11108
11109 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
11110                                        struct wireless_dev *wdev, bool aborted)
11111 {
11112         struct sk_buff *msg;
11113
11114         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11115         if (!msg)
11116                 return NULL;
11117
11118         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
11119                                   aborted ? NL80211_CMD_SCAN_ABORTED :
11120                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
11121                 nlmsg_free(msg);
11122                 return NULL;
11123         }
11124
11125         return msg;
11126 }
11127
11128 void nl80211_send_scan_result(struct cfg80211_registered_device *rdev,
11129                               struct sk_buff *msg)
11130 {
11131         if (!msg)
11132                 return;
11133
11134         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11135                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
11136 }
11137
11138 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
11139                                      struct net_device *netdev)
11140 {
11141         struct sk_buff *msg;
11142
11143         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11144         if (!msg)
11145                 return;
11146
11147         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
11148                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
11149                 nlmsg_free(msg);
11150                 return;
11151         }
11152
11153         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11154                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
11155 }
11156
11157 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
11158                              struct net_device *netdev, u32 cmd)
11159 {
11160         struct sk_buff *msg;
11161
11162         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11163         if (!msg)
11164                 return;
11165
11166         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
11167                 nlmsg_free(msg);
11168                 return;
11169         }
11170
11171         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11172                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
11173 }
11174
11175 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
11176                                           struct regulatory_request *request)
11177 {
11178         /* Userspace can always count this one always being set */
11179         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
11180                 goto nla_put_failure;
11181
11182         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
11183                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
11184                                NL80211_REGDOM_TYPE_WORLD))
11185                         goto nla_put_failure;
11186         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
11187                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
11188                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
11189                         goto nla_put_failure;
11190         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
11191                    request->intersect) {
11192                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
11193                                NL80211_REGDOM_TYPE_INTERSECTION))
11194                         goto nla_put_failure;
11195         } else {
11196                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
11197                                NL80211_REGDOM_TYPE_COUNTRY) ||
11198                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
11199                                    request->alpha2))
11200                         goto nla_put_failure;
11201         }
11202
11203         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
11204                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
11205
11206                 if (wiphy &&
11207                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
11208                         goto nla_put_failure;
11209
11210                 if (wiphy &&
11211                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
11212                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
11213                         goto nla_put_failure;
11214         }
11215
11216         return true;
11217
11218 nla_put_failure:
11219         return false;
11220 }
11221
11222 /*
11223  * This can happen on global regulatory changes or device specific settings
11224  * based on custom regulatory domains.
11225  */
11226 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
11227                                      struct regulatory_request *request)
11228 {
11229         struct sk_buff *msg;
11230         void *hdr;
11231
11232         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11233         if (!msg)
11234                 return;
11235
11236         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
11237         if (!hdr) {
11238                 nlmsg_free(msg);
11239                 return;
11240         }
11241
11242         if (nl80211_reg_change_event_fill(msg, request) == false)
11243                 goto nla_put_failure;
11244
11245         genlmsg_end(msg, hdr);
11246
11247         rcu_read_lock();
11248         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
11249                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
11250         rcu_read_unlock();
11251
11252         return;
11253
11254 nla_put_failure:
11255         genlmsg_cancel(msg, hdr);
11256         nlmsg_free(msg);
11257 }
11258
11259 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
11260                                     struct net_device *netdev,
11261                                     const u8 *buf, size_t len,
11262                                     enum nl80211_commands cmd, gfp_t gfp,
11263                                     int uapsd_queues)
11264 {
11265         struct sk_buff *msg;
11266         void *hdr;
11267
11268         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11269         if (!msg)
11270                 return;
11271
11272         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
11273         if (!hdr) {
11274                 nlmsg_free(msg);
11275                 return;
11276         }
11277
11278         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11279             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11280             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
11281                 goto nla_put_failure;
11282
11283         if (uapsd_queues >= 0) {
11284                 struct nlattr *nla_wmm =
11285                         nla_nest_start(msg, NL80211_ATTR_STA_WME);
11286                 if (!nla_wmm)
11287                         goto nla_put_failure;
11288
11289                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
11290                                uapsd_queues))
11291                         goto nla_put_failure;
11292
11293                 nla_nest_end(msg, nla_wmm);
11294         }
11295
11296         genlmsg_end(msg, hdr);
11297
11298         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11299                                 NL80211_MCGRP_MLME, gfp);
11300         return;
11301
11302  nla_put_failure:
11303         genlmsg_cancel(msg, hdr);
11304         nlmsg_free(msg);
11305 }
11306
11307 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
11308                           struct net_device *netdev, const u8 *buf,
11309                           size_t len, gfp_t gfp)
11310 {
11311         nl80211_send_mlme_event(rdev, netdev, buf, len,
11312                                 NL80211_CMD_AUTHENTICATE, gfp, -1);
11313 }
11314
11315 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
11316                            struct net_device *netdev, const u8 *buf,
11317                            size_t len, gfp_t gfp, int uapsd_queues)
11318 {
11319         nl80211_send_mlme_event(rdev, netdev, buf, len,
11320                                 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues);
11321 }
11322
11323 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
11324                          struct net_device *netdev, const u8 *buf,
11325                          size_t len, gfp_t gfp)
11326 {
11327         nl80211_send_mlme_event(rdev, netdev, buf, len,
11328                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1);
11329 }
11330
11331 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
11332                            struct net_device *netdev, const u8 *buf,
11333                            size_t len, gfp_t gfp)
11334 {
11335         nl80211_send_mlme_event(rdev, netdev, buf, len,
11336                                 NL80211_CMD_DISASSOCIATE, gfp, -1);
11337 }
11338
11339 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
11340                                   size_t len)
11341 {
11342         struct wireless_dev *wdev = dev->ieee80211_ptr;
11343         struct wiphy *wiphy = wdev->wiphy;
11344         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11345         const struct ieee80211_mgmt *mgmt = (void *)buf;
11346         u32 cmd;
11347
11348         if (WARN_ON(len < 2))
11349                 return;
11350
11351         if (ieee80211_is_deauth(mgmt->frame_control))
11352                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
11353         else
11354                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
11355
11356         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
11357         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1);
11358 }
11359 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
11360
11361 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
11362                                       struct net_device *netdev, int cmd,
11363                                       const u8 *addr, gfp_t gfp)
11364 {
11365         struct sk_buff *msg;
11366         void *hdr;
11367
11368         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11369         if (!msg)
11370                 return;
11371
11372         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
11373         if (!hdr) {
11374                 nlmsg_free(msg);
11375                 return;
11376         }
11377
11378         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11379             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11380             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
11381             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
11382                 goto nla_put_failure;
11383
11384         genlmsg_end(msg, hdr);
11385
11386         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11387                                 NL80211_MCGRP_MLME, gfp);
11388         return;
11389
11390  nla_put_failure:
11391         genlmsg_cancel(msg, hdr);
11392         nlmsg_free(msg);
11393 }
11394
11395 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
11396                                struct net_device *netdev, const u8 *addr,
11397                                gfp_t gfp)
11398 {
11399         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
11400                                   addr, gfp);
11401 }
11402
11403 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
11404                                 struct net_device *netdev, const u8 *addr,
11405                                 gfp_t gfp)
11406 {
11407         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
11408                                   addr, gfp);
11409 }
11410
11411 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
11412                                  struct net_device *netdev, const u8 *bssid,
11413                                  const u8 *req_ie, size_t req_ie_len,
11414                                  const u8 *resp_ie, size_t resp_ie_len,
11415                                  u16 status, gfp_t gfp)
11416 {
11417         struct sk_buff *msg;
11418         void *hdr;
11419
11420         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11421         if (!msg)
11422                 return;
11423
11424         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
11425         if (!hdr) {
11426                 nlmsg_free(msg);
11427                 return;
11428         }
11429
11430         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11431             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11432             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
11433             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
11434             (req_ie &&
11435              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
11436             (resp_ie &&
11437              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
11438                 goto nla_put_failure;
11439
11440         genlmsg_end(msg, hdr);
11441
11442         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11443                                 NL80211_MCGRP_MLME, gfp);
11444         return;
11445
11446  nla_put_failure:
11447         genlmsg_cancel(msg, hdr);
11448         nlmsg_free(msg);
11449
11450 }
11451
11452 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
11453                          struct net_device *netdev, const u8 *bssid,
11454                          const u8 *req_ie, size_t req_ie_len,
11455                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
11456 {
11457         struct sk_buff *msg;
11458         void *hdr;
11459
11460         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11461         if (!msg)
11462                 return;
11463
11464         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
11465         if (!hdr) {
11466                 nlmsg_free(msg);
11467                 return;
11468         }
11469
11470         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11471             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11472             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
11473             (req_ie &&
11474              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
11475             (resp_ie &&
11476              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
11477                 goto nla_put_failure;
11478
11479         genlmsg_end(msg, hdr);
11480
11481         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11482                                 NL80211_MCGRP_MLME, gfp);
11483         return;
11484
11485  nla_put_failure:
11486         genlmsg_cancel(msg, hdr);
11487         nlmsg_free(msg);
11488
11489 }
11490
11491 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
11492                                struct net_device *netdev, u16 reason,
11493                                const u8 *ie, size_t ie_len, bool from_ap)
11494 {
11495         struct sk_buff *msg;
11496         void *hdr;
11497
11498         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11499         if (!msg)
11500                 return;
11501
11502         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
11503         if (!hdr) {
11504                 nlmsg_free(msg);
11505                 return;
11506         }
11507
11508         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11509             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11510             (from_ap && reason &&
11511              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
11512             (from_ap &&
11513              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
11514             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
11515                 goto nla_put_failure;
11516
11517         genlmsg_end(msg, hdr);
11518
11519         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11520                                 NL80211_MCGRP_MLME, GFP_KERNEL);
11521         return;
11522
11523  nla_put_failure:
11524         genlmsg_cancel(msg, hdr);
11525         nlmsg_free(msg);
11526
11527 }
11528
11529 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
11530                              struct net_device *netdev, const u8 *bssid,
11531                              gfp_t gfp)
11532 {
11533         struct sk_buff *msg;
11534         void *hdr;
11535
11536         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11537         if (!msg)
11538                 return;
11539
11540         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
11541         if (!hdr) {
11542                 nlmsg_free(msg);
11543                 return;
11544         }
11545
11546         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11547             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11548             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
11549                 goto nla_put_failure;
11550
11551         genlmsg_end(msg, hdr);
11552
11553         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11554                                 NL80211_MCGRP_MLME, gfp);
11555         return;
11556
11557  nla_put_failure:
11558         genlmsg_cancel(msg, hdr);
11559         nlmsg_free(msg);
11560 }
11561
11562 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
11563                                         const u8* ie, u8 ie_len, gfp_t gfp)
11564 {
11565         struct wireless_dev *wdev = dev->ieee80211_ptr;
11566         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
11567         struct sk_buff *msg;
11568         void *hdr;
11569
11570         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
11571                 return;
11572
11573         trace_cfg80211_notify_new_peer_candidate(dev, addr);
11574
11575         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11576         if (!msg)
11577                 return;
11578
11579         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
11580         if (!hdr) {
11581                 nlmsg_free(msg);
11582                 return;
11583         }
11584
11585         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11586             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11587             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
11588             (ie_len && ie &&
11589              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
11590                 goto nla_put_failure;
11591
11592         genlmsg_end(msg, hdr);
11593
11594         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11595                                 NL80211_MCGRP_MLME, gfp);
11596         return;
11597
11598  nla_put_failure:
11599         genlmsg_cancel(msg, hdr);
11600         nlmsg_free(msg);
11601 }
11602 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
11603
11604 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
11605                                  struct net_device *netdev, const u8 *addr,
11606                                  enum nl80211_key_type key_type, int key_id,
11607                                  const u8 *tsc, gfp_t gfp)
11608 {
11609         struct sk_buff *msg;
11610         void *hdr;
11611
11612         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11613         if (!msg)
11614                 return;
11615
11616         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
11617         if (!hdr) {
11618                 nlmsg_free(msg);
11619                 return;
11620         }
11621
11622         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11623             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11624             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
11625             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
11626             (key_id != -1 &&
11627              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
11628             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
11629                 goto nla_put_failure;
11630
11631         genlmsg_end(msg, hdr);
11632
11633         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11634                                 NL80211_MCGRP_MLME, gfp);
11635         return;
11636
11637  nla_put_failure:
11638         genlmsg_cancel(msg, hdr);
11639         nlmsg_free(msg);
11640 }
11641
11642 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
11643                                     struct ieee80211_channel *channel_before,
11644                                     struct ieee80211_channel *channel_after)
11645 {
11646         struct sk_buff *msg;
11647         void *hdr;
11648         struct nlattr *nl_freq;
11649
11650         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
11651         if (!msg)
11652                 return;
11653
11654         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
11655         if (!hdr) {
11656                 nlmsg_free(msg);
11657                 return;
11658         }
11659
11660         /*
11661          * Since we are applying the beacon hint to a wiphy we know its
11662          * wiphy_idx is valid
11663          */
11664         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
11665                 goto nla_put_failure;
11666
11667         /* Before */
11668         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
11669         if (!nl_freq)
11670                 goto nla_put_failure;
11671         if (nl80211_msg_put_channel(msg, channel_before, false))
11672                 goto nla_put_failure;
11673         nla_nest_end(msg, nl_freq);
11674
11675         /* After */
11676         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
11677         if (!nl_freq)
11678                 goto nla_put_failure;
11679         if (nl80211_msg_put_channel(msg, channel_after, false))
11680                 goto nla_put_failure;
11681         nla_nest_end(msg, nl_freq);
11682
11683         genlmsg_end(msg, hdr);
11684
11685         rcu_read_lock();
11686         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
11687                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
11688         rcu_read_unlock();
11689
11690         return;
11691
11692 nla_put_failure:
11693         genlmsg_cancel(msg, hdr);
11694         nlmsg_free(msg);
11695 }
11696
11697 static void nl80211_send_remain_on_chan_event(
11698         int cmd, struct cfg80211_registered_device *rdev,
11699         struct wireless_dev *wdev, u64 cookie,
11700         struct ieee80211_channel *chan,
11701         unsigned int duration, gfp_t gfp)
11702 {
11703         struct sk_buff *msg;
11704         void *hdr;
11705
11706         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11707         if (!msg)
11708                 return;
11709
11710         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
11711         if (!hdr) {
11712                 nlmsg_free(msg);
11713                 return;
11714         }
11715
11716         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11717             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11718                                          wdev->netdev->ifindex)) ||
11719             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
11720             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
11721             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
11722                         NL80211_CHAN_NO_HT) ||
11723             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
11724                 goto nla_put_failure;
11725
11726         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
11727             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
11728                 goto nla_put_failure;
11729
11730         genlmsg_end(msg, hdr);
11731
11732         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11733                                 NL80211_MCGRP_MLME, gfp);
11734         return;
11735
11736  nla_put_failure:
11737         genlmsg_cancel(msg, hdr);
11738         nlmsg_free(msg);
11739 }
11740
11741 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
11742                                struct ieee80211_channel *chan,
11743                                unsigned int duration, gfp_t gfp)
11744 {
11745         struct wiphy *wiphy = wdev->wiphy;
11746         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11747
11748         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
11749         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
11750                                           rdev, wdev, cookie, chan,
11751                                           duration, gfp);
11752 }
11753 EXPORT_SYMBOL(cfg80211_ready_on_channel);
11754
11755 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
11756                                         struct ieee80211_channel *chan,
11757                                         gfp_t gfp)
11758 {
11759         struct wiphy *wiphy = wdev->wiphy;
11760         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11761
11762         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
11763         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
11764                                           rdev, wdev, cookie, chan, 0, gfp);
11765 }
11766 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
11767
11768 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
11769                       struct station_info *sinfo, gfp_t gfp)
11770 {
11771         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
11772         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11773         struct sk_buff *msg;
11774
11775         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
11776
11777         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11778         if (!msg)
11779                 return;
11780
11781         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
11782                                  rdev, dev, mac_addr, sinfo) < 0) {
11783                 nlmsg_free(msg);
11784                 return;
11785         }
11786
11787         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11788                                 NL80211_MCGRP_MLME, gfp);
11789 }
11790 EXPORT_SYMBOL(cfg80211_new_sta);
11791
11792 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
11793                             struct station_info *sinfo, gfp_t gfp)
11794 {
11795         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
11796         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11797         struct sk_buff *msg;
11798         struct station_info empty_sinfo = {};
11799
11800         if (!sinfo)
11801                 sinfo = &empty_sinfo;
11802
11803         trace_cfg80211_del_sta(dev, mac_addr);
11804
11805         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11806         if (!msg)
11807                 return;
11808
11809         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
11810                                  rdev, dev, mac_addr, sinfo) < 0) {
11811                 nlmsg_free(msg);
11812                 return;
11813         }
11814
11815         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11816                                 NL80211_MCGRP_MLME, gfp);
11817 }
11818 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
11819
11820 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
11821                           enum nl80211_connect_failed_reason reason,
11822                           gfp_t gfp)
11823 {
11824         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
11825         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11826         struct sk_buff *msg;
11827         void *hdr;
11828
11829         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
11830         if (!msg)
11831                 return;
11832
11833         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
11834         if (!hdr) {
11835                 nlmsg_free(msg);
11836                 return;
11837         }
11838
11839         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11840             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
11841             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
11842                 goto nla_put_failure;
11843
11844         genlmsg_end(msg, hdr);
11845
11846         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11847                                 NL80211_MCGRP_MLME, gfp);
11848         return;
11849
11850  nla_put_failure:
11851         genlmsg_cancel(msg, hdr);
11852         nlmsg_free(msg);
11853 }
11854 EXPORT_SYMBOL(cfg80211_conn_failed);
11855
11856 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
11857                                        const u8 *addr, gfp_t gfp)
11858 {
11859         struct wireless_dev *wdev = dev->ieee80211_ptr;
11860         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
11861         struct sk_buff *msg;
11862         void *hdr;
11863         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
11864
11865         if (!nlportid)
11866                 return false;
11867
11868         msg = nlmsg_new(100, gfp);
11869         if (!msg)
11870                 return true;
11871
11872         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
11873         if (!hdr) {
11874                 nlmsg_free(msg);
11875                 return true;
11876         }
11877
11878         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11879             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11880             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
11881                 goto nla_put_failure;
11882
11883         genlmsg_end(msg, hdr);
11884         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
11885         return true;
11886
11887  nla_put_failure:
11888         genlmsg_cancel(msg, hdr);
11889         nlmsg_free(msg);
11890         return true;
11891 }
11892
11893 bool cfg80211_rx_spurious_frame(struct net_device *dev,
11894                                 const u8 *addr, gfp_t gfp)
11895 {
11896         struct wireless_dev *wdev = dev->ieee80211_ptr;
11897         bool ret;
11898
11899         trace_cfg80211_rx_spurious_frame(dev, addr);
11900
11901         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
11902                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
11903                 trace_cfg80211_return_bool(false);
11904                 return false;
11905         }
11906         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
11907                                          addr, gfp);
11908         trace_cfg80211_return_bool(ret);
11909         return ret;
11910 }
11911 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
11912
11913 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
11914                                         const u8 *addr, gfp_t gfp)
11915 {
11916         struct wireless_dev *wdev = dev->ieee80211_ptr;
11917         bool ret;
11918
11919         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
11920
11921         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
11922                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
11923                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
11924                 trace_cfg80211_return_bool(false);
11925                 return false;
11926         }
11927         ret = __nl80211_unexpected_frame(dev,
11928                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
11929                                          addr, gfp);
11930         trace_cfg80211_return_bool(ret);
11931         return ret;
11932 }
11933 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
11934
11935 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
11936                       struct wireless_dev *wdev, u32 nlportid,
11937                       int freq, int sig_dbm,
11938                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
11939 {
11940         struct net_device *netdev = wdev->netdev;
11941         struct sk_buff *msg;
11942         void *hdr;
11943
11944         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11945         if (!msg)
11946                 return -ENOMEM;
11947
11948         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
11949         if (!hdr) {
11950                 nlmsg_free(msg);
11951                 return -ENOMEM;
11952         }
11953
11954         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11955             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11956                                         netdev->ifindex)) ||
11957             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
11958             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
11959             (sig_dbm &&
11960              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
11961             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
11962             (flags &&
11963              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
11964                 goto nla_put_failure;
11965
11966         genlmsg_end(msg, hdr);
11967
11968         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
11969
11970  nla_put_failure:
11971         genlmsg_cancel(msg, hdr);
11972         nlmsg_free(msg);
11973         return -ENOBUFS;
11974 }
11975
11976 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
11977                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
11978 {
11979         struct wiphy *wiphy = wdev->wiphy;
11980         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11981         struct net_device *netdev = wdev->netdev;
11982         struct sk_buff *msg;
11983         void *hdr;
11984
11985         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
11986
11987         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11988         if (!msg)
11989                 return;
11990
11991         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
11992         if (!hdr) {
11993                 nlmsg_free(msg);
11994                 return;
11995         }
11996
11997         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11998             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11999                                    netdev->ifindex)) ||
12000             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
12001             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
12002             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
12003             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
12004                 goto nla_put_failure;
12005
12006         genlmsg_end(msg, hdr);
12007
12008         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12009                                 NL80211_MCGRP_MLME, gfp);
12010         return;
12011
12012  nla_put_failure:
12013         genlmsg_cancel(msg, hdr);
12014         nlmsg_free(msg);
12015 }
12016 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
12017
12018 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
12019                                             const char *mac, gfp_t gfp)
12020 {
12021         struct wireless_dev *wdev = dev->ieee80211_ptr;
12022         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12023         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12024         void **cb;
12025
12026         if (!msg)
12027                 return NULL;
12028
12029         cb = (void **)msg->cb;
12030
12031         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
12032         if (!cb[0]) {
12033                 nlmsg_free(msg);
12034                 return NULL;
12035         }
12036
12037         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12038             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
12039                 goto nla_put_failure;
12040
12041         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
12042                 goto nla_put_failure;
12043
12044         cb[1] = nla_nest_start(msg, NL80211_ATTR_CQM);
12045         if (!cb[1])
12046                 goto nla_put_failure;
12047
12048         cb[2] = rdev;
12049
12050         return msg;
12051  nla_put_failure:
12052         nlmsg_free(msg);
12053         return NULL;
12054 }
12055
12056 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
12057 {
12058         void **cb = (void **)msg->cb;
12059         struct cfg80211_registered_device *rdev = cb[2];
12060
12061         nla_nest_end(msg, cb[1]);
12062         genlmsg_end(msg, cb[0]);
12063
12064         memset(msg->cb, 0, sizeof(msg->cb));
12065
12066         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12067                                 NL80211_MCGRP_MLME, gfp);
12068 }
12069
12070 void cfg80211_cqm_rssi_notify(struct net_device *dev,
12071                               enum nl80211_cqm_rssi_threshold_event rssi_event,
12072                               gfp_t gfp)
12073 {
12074         struct sk_buff *msg;
12075
12076         trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
12077
12078         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
12079                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
12080                 return;
12081
12082         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
12083         if (!msg)
12084                 return;
12085
12086         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
12087                         rssi_event))
12088                 goto nla_put_failure;
12089
12090         cfg80211_send_cqm(msg, gfp);
12091
12092         return;
12093
12094  nla_put_failure:
12095         nlmsg_free(msg);
12096 }
12097 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
12098
12099 void cfg80211_cqm_txe_notify(struct net_device *dev,
12100                              const u8 *peer, u32 num_packets,
12101                              u32 rate, u32 intvl, gfp_t gfp)
12102 {
12103         struct sk_buff *msg;
12104
12105         msg = cfg80211_prepare_cqm(dev, peer, gfp);
12106         if (!msg)
12107                 return;
12108
12109         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
12110                 goto nla_put_failure;
12111
12112         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
12113                 goto nla_put_failure;
12114
12115         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
12116                 goto nla_put_failure;
12117
12118         cfg80211_send_cqm(msg, gfp);
12119         return;
12120
12121  nla_put_failure:
12122         nlmsg_free(msg);
12123 }
12124 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
12125
12126 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
12127                                  const u8 *peer, u32 num_packets, gfp_t gfp)
12128 {
12129         struct sk_buff *msg;
12130
12131         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
12132
12133         msg = cfg80211_prepare_cqm(dev, peer, gfp);
12134         if (!msg)
12135                 return;
12136
12137         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
12138                 goto nla_put_failure;
12139
12140         cfg80211_send_cqm(msg, gfp);
12141         return;
12142
12143  nla_put_failure:
12144         nlmsg_free(msg);
12145 }
12146 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
12147
12148 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
12149 {
12150         struct sk_buff *msg;
12151
12152         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
12153         if (!msg)
12154                 return;
12155
12156         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
12157                 goto nla_put_failure;
12158
12159         cfg80211_send_cqm(msg, gfp);
12160         return;
12161
12162  nla_put_failure:
12163         nlmsg_free(msg);
12164 }
12165 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
12166
12167 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
12168                                      struct net_device *netdev, const u8 *bssid,
12169                                      const u8 *replay_ctr, gfp_t gfp)
12170 {
12171         struct sk_buff *msg;
12172         struct nlattr *rekey_attr;
12173         void *hdr;
12174
12175         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12176         if (!msg)
12177                 return;
12178
12179         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
12180         if (!hdr) {
12181                 nlmsg_free(msg);
12182                 return;
12183         }
12184
12185         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12186             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12187             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
12188                 goto nla_put_failure;
12189
12190         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
12191         if (!rekey_attr)
12192                 goto nla_put_failure;
12193
12194         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
12195                     NL80211_REPLAY_CTR_LEN, replay_ctr))
12196                 goto nla_put_failure;
12197
12198         nla_nest_end(msg, rekey_attr);
12199
12200         genlmsg_end(msg, hdr);
12201
12202         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12203                                 NL80211_MCGRP_MLME, gfp);
12204         return;
12205
12206  nla_put_failure:
12207         genlmsg_cancel(msg, hdr);
12208         nlmsg_free(msg);
12209 }
12210
12211 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
12212                                const u8 *replay_ctr, gfp_t gfp)
12213 {
12214         struct wireless_dev *wdev = dev->ieee80211_ptr;
12215         struct wiphy *wiphy = wdev->wiphy;
12216         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12217
12218         trace_cfg80211_gtk_rekey_notify(dev, bssid);
12219         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
12220 }
12221 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
12222
12223 static void
12224 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
12225                                struct net_device *netdev, int index,
12226                                const u8 *bssid, bool preauth, gfp_t gfp)
12227 {
12228         struct sk_buff *msg;
12229         struct nlattr *attr;
12230         void *hdr;
12231
12232         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12233         if (!msg)
12234                 return;
12235
12236         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
12237         if (!hdr) {
12238                 nlmsg_free(msg);
12239                 return;
12240         }
12241
12242         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12243             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
12244                 goto nla_put_failure;
12245
12246         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
12247         if (!attr)
12248                 goto nla_put_failure;
12249
12250         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
12251             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
12252             (preauth &&
12253              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
12254                 goto nla_put_failure;
12255
12256         nla_nest_end(msg, attr);
12257
12258         genlmsg_end(msg, hdr);
12259
12260         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12261                                 NL80211_MCGRP_MLME, gfp);
12262         return;
12263
12264  nla_put_failure:
12265         genlmsg_cancel(msg, hdr);
12266         nlmsg_free(msg);
12267 }
12268
12269 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
12270                                      const u8 *bssid, bool preauth, gfp_t gfp)
12271 {
12272         struct wireless_dev *wdev = dev->ieee80211_ptr;
12273         struct wiphy *wiphy = wdev->wiphy;
12274         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12275
12276         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
12277         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
12278 }
12279 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
12280
12281 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
12282                                      struct net_device *netdev,
12283                                      struct cfg80211_chan_def *chandef,
12284                                      gfp_t gfp,
12285                                      enum nl80211_commands notif,
12286                                      u8 count)
12287 {
12288         struct sk_buff *msg;
12289         void *hdr;
12290
12291         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12292         if (!msg)
12293                 return;
12294
12295         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
12296         if (!hdr) {
12297                 nlmsg_free(msg);
12298                 return;
12299         }
12300
12301         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
12302                 goto nla_put_failure;
12303
12304         if (nl80211_send_chandef(msg, chandef))
12305                 goto nla_put_failure;
12306
12307         if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
12308             (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
12309                         goto nla_put_failure;
12310
12311         genlmsg_end(msg, hdr);
12312
12313         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12314                                 NL80211_MCGRP_MLME, gfp);
12315         return;
12316
12317  nla_put_failure:
12318         genlmsg_cancel(msg, hdr);
12319         nlmsg_free(msg);
12320 }
12321
12322 void cfg80211_ch_switch_notify(struct net_device *dev,
12323                                struct cfg80211_chan_def *chandef)
12324 {
12325         struct wireless_dev *wdev = dev->ieee80211_ptr;
12326         struct wiphy *wiphy = wdev->wiphy;
12327         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12328
12329         ASSERT_WDEV_LOCK(wdev);
12330
12331         trace_cfg80211_ch_switch_notify(dev, chandef);
12332
12333         wdev->chandef = *chandef;
12334         wdev->preset_chandef = *chandef;
12335         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
12336                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0);
12337 }
12338 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
12339
12340 void cfg80211_ch_switch_started_notify(struct net_device *dev,
12341                                        struct cfg80211_chan_def *chandef,
12342                                        u8 count)
12343 {
12344         struct wireless_dev *wdev = dev->ieee80211_ptr;
12345         struct wiphy *wiphy = wdev->wiphy;
12346         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12347
12348         trace_cfg80211_ch_switch_started_notify(dev, chandef);
12349
12350         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
12351                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
12352 }
12353 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
12354
12355 void
12356 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
12357                      const struct cfg80211_chan_def *chandef,
12358                      enum nl80211_radar_event event,
12359                      struct net_device *netdev, gfp_t gfp)
12360 {
12361         struct sk_buff *msg;
12362         void *hdr;
12363
12364         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12365         if (!msg)
12366                 return;
12367
12368         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
12369         if (!hdr) {
12370                 nlmsg_free(msg);
12371                 return;
12372         }
12373
12374         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
12375                 goto nla_put_failure;
12376
12377         /* NOP and radar events don't need a netdev parameter */
12378         if (netdev) {
12379                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
12380
12381                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12382                     nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
12383                         goto nla_put_failure;
12384         }
12385
12386         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
12387                 goto nla_put_failure;
12388
12389         if (nl80211_send_chandef(msg, chandef))
12390                 goto nla_put_failure;
12391
12392         genlmsg_end(msg, hdr);
12393
12394         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12395                                 NL80211_MCGRP_MLME, gfp);
12396         return;
12397
12398  nla_put_failure:
12399         genlmsg_cancel(msg, hdr);
12400         nlmsg_free(msg);
12401 }
12402
12403 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
12404                            u64 cookie, bool acked, gfp_t gfp)
12405 {
12406         struct wireless_dev *wdev = dev->ieee80211_ptr;
12407         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12408         struct sk_buff *msg;
12409         void *hdr;
12410
12411         trace_cfg80211_probe_status(dev, addr, cookie, acked);
12412
12413         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12414
12415         if (!msg)
12416                 return;
12417
12418         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
12419         if (!hdr) {
12420                 nlmsg_free(msg);
12421                 return;
12422         }
12423
12424         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12425             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
12426             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
12427             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
12428             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
12429                 goto nla_put_failure;
12430
12431         genlmsg_end(msg, hdr);
12432
12433         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12434                                 NL80211_MCGRP_MLME, gfp);
12435         return;
12436
12437  nla_put_failure:
12438         genlmsg_cancel(msg, hdr);
12439         nlmsg_free(msg);
12440 }
12441 EXPORT_SYMBOL(cfg80211_probe_status);
12442
12443 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
12444                                  const u8 *frame, size_t len,
12445                                  int freq, int sig_dbm)
12446 {
12447         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12448         struct sk_buff *msg;
12449         void *hdr;
12450         struct cfg80211_beacon_registration *reg;
12451
12452         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
12453
12454         spin_lock_bh(&rdev->beacon_registrations_lock);
12455         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
12456                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
12457                 if (!msg) {
12458                         spin_unlock_bh(&rdev->beacon_registrations_lock);
12459                         return;
12460                 }
12461
12462                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
12463                 if (!hdr)
12464                         goto nla_put_failure;
12465
12466                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12467                     (freq &&
12468                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
12469                     (sig_dbm &&
12470                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
12471                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
12472                         goto nla_put_failure;
12473
12474                 genlmsg_end(msg, hdr);
12475
12476                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
12477         }
12478         spin_unlock_bh(&rdev->beacon_registrations_lock);
12479         return;
12480
12481  nla_put_failure:
12482         spin_unlock_bh(&rdev->beacon_registrations_lock);
12483         if (hdr)
12484                 genlmsg_cancel(msg, hdr);
12485         nlmsg_free(msg);
12486 }
12487 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
12488
12489 #ifdef CONFIG_PM
12490 static int cfg80211_net_detect_results(struct sk_buff *msg,
12491                                        struct cfg80211_wowlan_wakeup *wakeup)
12492 {
12493         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
12494         struct nlattr *nl_results, *nl_match, *nl_freqs;
12495         int i, j;
12496
12497         nl_results = nla_nest_start(
12498                 msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
12499         if (!nl_results)
12500                 return -EMSGSIZE;
12501
12502         for (i = 0; i < nd->n_matches; i++) {
12503                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
12504
12505                 nl_match = nla_nest_start(msg, i);
12506                 if (!nl_match)
12507                         break;
12508
12509                 /* The SSID attribute is optional in nl80211, but for
12510                  * simplicity reasons it's always present in the
12511                  * cfg80211 structure.  If a driver can't pass the
12512                  * SSID, that needs to be changed.  A zero length SSID
12513                  * is still a valid SSID (wildcard), so it cannot be
12514                  * used for this purpose.
12515                  */
12516                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
12517                             match->ssid.ssid)) {
12518                         nla_nest_cancel(msg, nl_match);
12519                         goto out;
12520                 }
12521
12522                 if (match->n_channels) {
12523                         nl_freqs = nla_nest_start(
12524                                 msg, NL80211_ATTR_SCAN_FREQUENCIES);
12525                         if (!nl_freqs) {
12526                                 nla_nest_cancel(msg, nl_match);
12527                                 goto out;
12528                         }
12529
12530                         for (j = 0; j < match->n_channels; j++) {
12531                                 if (nla_put_u32(msg,
12532                                                 NL80211_ATTR_WIPHY_FREQ,
12533                                                 match->channels[j])) {
12534                                         nla_nest_cancel(msg, nl_freqs);
12535                                         nla_nest_cancel(msg, nl_match);
12536                                         goto out;
12537                                 }
12538                         }
12539
12540                         nla_nest_end(msg, nl_freqs);
12541                 }
12542
12543                 nla_nest_end(msg, nl_match);
12544         }
12545
12546 out:
12547         nla_nest_end(msg, nl_results);
12548         return 0;
12549 }
12550
12551 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
12552                                    struct cfg80211_wowlan_wakeup *wakeup,
12553                                    gfp_t gfp)
12554 {
12555         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12556         struct sk_buff *msg;
12557         void *hdr;
12558         int size = 200;
12559
12560         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
12561
12562         if (wakeup)
12563                 size += wakeup->packet_present_len;
12564
12565         msg = nlmsg_new(size, gfp);
12566         if (!msg)
12567                 return;
12568
12569         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
12570         if (!hdr)
12571                 goto free_msg;
12572
12573         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12574             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
12575                 goto free_msg;
12576
12577         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12578                                         wdev->netdev->ifindex))
12579                 goto free_msg;
12580
12581         if (wakeup) {
12582                 struct nlattr *reasons;
12583
12584                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
12585                 if (!reasons)
12586                         goto free_msg;
12587
12588                 if (wakeup->disconnect &&
12589                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
12590                         goto free_msg;
12591                 if (wakeup->magic_pkt &&
12592                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
12593                         goto free_msg;
12594                 if (wakeup->gtk_rekey_failure &&
12595                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
12596                         goto free_msg;
12597                 if (wakeup->eap_identity_req &&
12598                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
12599                         goto free_msg;
12600                 if (wakeup->four_way_handshake &&
12601                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
12602                         goto free_msg;
12603                 if (wakeup->rfkill_release &&
12604                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
12605                         goto free_msg;
12606
12607                 if (wakeup->pattern_idx >= 0 &&
12608                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
12609                                 wakeup->pattern_idx))
12610                         goto free_msg;
12611
12612                 if (wakeup->tcp_match &&
12613                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
12614                         goto free_msg;
12615
12616                 if (wakeup->tcp_connlost &&
12617                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
12618                         goto free_msg;
12619
12620                 if (wakeup->tcp_nomoretokens &&
12621                     nla_put_flag(msg,
12622                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
12623                         goto free_msg;
12624
12625                 if (wakeup->packet) {
12626                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
12627                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
12628
12629                         if (!wakeup->packet_80211) {
12630                                 pkt_attr =
12631                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
12632                                 len_attr =
12633                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
12634                         }
12635
12636                         if (wakeup->packet_len &&
12637                             nla_put_u32(msg, len_attr, wakeup->packet_len))
12638                                 goto free_msg;
12639
12640                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
12641                                     wakeup->packet))
12642                                 goto free_msg;
12643                 }
12644
12645                 if (wakeup->net_detect &&
12646                     cfg80211_net_detect_results(msg, wakeup))
12647                                 goto free_msg;
12648
12649                 nla_nest_end(msg, reasons);
12650         }
12651
12652         genlmsg_end(msg, hdr);
12653
12654         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12655                                 NL80211_MCGRP_MLME, gfp);
12656         return;
12657
12658  free_msg:
12659         nlmsg_free(msg);
12660 }
12661 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
12662 #endif
12663
12664 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
12665                                 enum nl80211_tdls_operation oper,
12666                                 u16 reason_code, gfp_t gfp)
12667 {
12668         struct wireless_dev *wdev = dev->ieee80211_ptr;
12669         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12670         struct sk_buff *msg;
12671         void *hdr;
12672
12673         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
12674                                          reason_code);
12675
12676         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12677         if (!msg)
12678                 return;
12679
12680         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
12681         if (!hdr) {
12682                 nlmsg_free(msg);
12683                 return;
12684         }
12685
12686         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12687             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
12688             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
12689             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
12690             (reason_code > 0 &&
12691              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
12692                 goto nla_put_failure;
12693
12694         genlmsg_end(msg, hdr);
12695
12696         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12697                                 NL80211_MCGRP_MLME, gfp);
12698         return;
12699
12700  nla_put_failure:
12701         genlmsg_cancel(msg, hdr);
12702         nlmsg_free(msg);
12703 }
12704 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
12705
12706 static int nl80211_netlink_notify(struct notifier_block * nb,
12707                                   unsigned long state,
12708                                   void *_notify)
12709 {
12710         struct netlink_notify *notify = _notify;
12711         struct cfg80211_registered_device *rdev;
12712         struct wireless_dev *wdev;
12713         struct cfg80211_beacon_registration *reg, *tmp;
12714
12715         if (state != NETLINK_URELEASE)
12716                 return NOTIFY_DONE;
12717
12718         rcu_read_lock();
12719
12720         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
12721                 bool schedule_destroy_work = false;
12722                 bool schedule_scan_stop = false;
12723                 struct cfg80211_sched_scan_request *sched_scan_req =
12724                         rcu_dereference(rdev->sched_scan_req);
12725
12726                 if (sched_scan_req && notify->portid &&
12727                     sched_scan_req->owner_nlportid == notify->portid)
12728                         schedule_scan_stop = true;
12729
12730                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list) {
12731                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
12732
12733                         if (wdev->owner_nlportid == notify->portid)
12734                                 schedule_destroy_work = true;
12735                 }
12736
12737                 spin_lock_bh(&rdev->beacon_registrations_lock);
12738                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
12739                                          list) {
12740                         if (reg->nlportid == notify->portid) {
12741                                 list_del(&reg->list);
12742                                 kfree(reg);
12743                                 break;
12744                         }
12745                 }
12746                 spin_unlock_bh(&rdev->beacon_registrations_lock);
12747
12748                 if (schedule_destroy_work) {
12749                         struct cfg80211_iface_destroy *destroy;
12750
12751                         destroy = kzalloc(sizeof(*destroy), GFP_ATOMIC);
12752                         if (destroy) {
12753                                 destroy->nlportid = notify->portid;
12754                                 spin_lock(&rdev->destroy_list_lock);
12755                                 list_add(&destroy->list, &rdev->destroy_list);
12756                                 spin_unlock(&rdev->destroy_list_lock);
12757                                 schedule_work(&rdev->destroy_work);
12758                         }
12759                 } else if (schedule_scan_stop) {
12760                         sched_scan_req->owner_nlportid = 0;
12761
12762                         if (rdev->ops->sched_scan_stop &&
12763                             rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
12764                                 schedule_work(&rdev->sched_scan_stop_wk);
12765                 }
12766         }
12767
12768         rcu_read_unlock();
12769
12770         return NOTIFY_OK;
12771 }
12772
12773 static struct notifier_block nl80211_netlink_notifier = {
12774         .notifier_call = nl80211_netlink_notify,
12775 };
12776
12777 void cfg80211_ft_event(struct net_device *netdev,
12778                        struct cfg80211_ft_event_params *ft_event)
12779 {
12780         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
12781         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12782         struct sk_buff *msg;
12783         void *hdr;
12784
12785         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
12786
12787         if (!ft_event->target_ap)
12788                 return;
12789
12790         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12791         if (!msg)
12792                 return;
12793
12794         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
12795         if (!hdr)
12796                 goto out;
12797
12798         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12799             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12800             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
12801                 goto out;
12802
12803         if (ft_event->ies &&
12804             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
12805                 goto out;
12806         if (ft_event->ric_ies &&
12807             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
12808                     ft_event->ric_ies))
12809                 goto out;
12810
12811         genlmsg_end(msg, hdr);
12812
12813         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12814                                 NL80211_MCGRP_MLME, GFP_KERNEL);
12815         return;
12816  out:
12817         nlmsg_free(msg);
12818 }
12819 EXPORT_SYMBOL(cfg80211_ft_event);
12820
12821 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
12822 {
12823         struct cfg80211_registered_device *rdev;
12824         struct sk_buff *msg;
12825         void *hdr;
12826         u32 nlportid;
12827
12828         rdev = wiphy_to_rdev(wdev->wiphy);
12829         if (!rdev->crit_proto_nlportid)
12830                 return;
12831
12832         nlportid = rdev->crit_proto_nlportid;
12833         rdev->crit_proto_nlportid = 0;
12834
12835         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12836         if (!msg)
12837                 return;
12838
12839         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
12840         if (!hdr)
12841                 goto nla_put_failure;
12842
12843         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12844             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
12845                 goto nla_put_failure;
12846
12847         genlmsg_end(msg, hdr);
12848
12849         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
12850         return;
12851
12852  nla_put_failure:
12853         if (hdr)
12854                 genlmsg_cancel(msg, hdr);
12855         nlmsg_free(msg);
12856
12857 }
12858 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
12859
12860 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
12861 {
12862         struct wiphy *wiphy = wdev->wiphy;
12863         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12864         struct sk_buff *msg;
12865         void *hdr;
12866
12867         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12868         if (!msg)
12869                 return;
12870
12871         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
12872         if (!hdr)
12873                 goto out;
12874
12875         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12876             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
12877             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
12878                 goto out;
12879
12880         genlmsg_end(msg, hdr);
12881
12882         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
12883                                 NL80211_MCGRP_MLME, GFP_KERNEL);
12884         return;
12885  out:
12886         nlmsg_free(msg);
12887 }
12888
12889 /* initialisation/exit functions */
12890
12891 int nl80211_init(void)
12892 {
12893         int err;
12894
12895         err = genl_register_family_with_ops_groups(&nl80211_fam, nl80211_ops,
12896                                                    nl80211_mcgrps);
12897         if (err)
12898                 return err;
12899
12900         err = netlink_register_notifier(&nl80211_netlink_notifier);
12901         if (err)
12902                 goto err_out;
12903
12904         return 0;
12905  err_out:
12906         genl_unregister_family(&nl80211_fam);
12907         return err;
12908 }
12909
12910 void nl80211_exit(void)
12911 {
12912         netlink_unregister_notifier(&nl80211_netlink_notifier);
12913         genl_unregister_family(&nl80211_fam);
12914 }