net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  * Copyright 2013-2014  Intel Mobile Communications GmbH
   6  * Copyright 2015       Intel Deutschland GmbH
   7  */
   8
   9 #include <linux/if.h>
  10 #include <linux/module.h>
  11 #include <linux/err.h>
  12 #include <linux/slab.h>
  13 #include <linux/list.h>
  14 #include <linux/if_ether.h>
  15 #include <linux/ieee80211.h>
  16 #include <linux/nl80211.h>
  17 #include <linux/rtnetlink.h>
  18 #include <linux/netlink.h>
  19 #include <linux/etherdevice.h>
  20 #include <net/net_namespace.h>
  21 #include <net/genetlink.h>
  22 #include <net/cfg80211.h>
  23 #include <net/sock.h>
  24 #include <net/inet_connection_sock.h>
  25 #include "core.h"
  26 #include "nl80211.h"
  27 #include "reg.h"
  28 #include "rdev-ops.h"
  29
  30 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  31                                    struct genl_info *info,
  32                                    struct cfg80211_crypto_settings *settings,
  33                                    int cipher_limit);
  34
  35 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
  36                             struct genl_info *info);
  37 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
  38                               struct genl_info *info);
  39
  40 /* the netlink family */
  41 static struct genl_family nl80211_fam = {
  42         .id = GENL_ID_GENERATE,         /* don't bother with a hardcoded ID */
  43         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
  44         .hdrsize = 0,                   /* no private header */
  45         .version = 1,                   /* no particular meaning now */
  46         .maxattr = NL80211_ATTR_MAX,
  47         .netnsok = true,
  48         .pre_doit = nl80211_pre_doit,
  49         .post_doit = nl80211_post_doit,
  50 };
  51
  52 /* multicast groups */
  53 enum nl80211_multicast_groups {
  54         NL80211_MCGRP_CONFIG,
  55         NL80211_MCGRP_SCAN,
  56         NL80211_MCGRP_REGULATORY,
  57         NL80211_MCGRP_MLME,
  58         NL80211_MCGRP_VENDOR,
  59         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  60 };
  61
  62 static const struct genl_multicast_group nl80211_mcgrps[] = {
  63         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  64         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  65         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  66         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  67         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  68 #ifdef CONFIG_NL80211_TESTMODE
  69         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  70 #endif
  71 };
  72
  73 /* returns ERR_PTR values */
  74 static struct wireless_dev *
  75 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  76 {
  77         struct cfg80211_registered_device *rdev;
  78         struct wireless_dev *result = NULL;
  79         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  80         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  81         u64 wdev_id;
  82         int wiphy_idx = -1;
  83         int ifidx = -1;
  84
  85         ASSERT_RTNL();
  86
  87         if (!have_ifidx && !have_wdev_id)
  88                 return ERR_PTR(-EINVAL);
  89
  90         if (have_ifidx)
  91                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  92         if (have_wdev_id) {
  93                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  94                 wiphy_idx = wdev_id >> 32;
  95         }
  96
  97         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  98                 struct wireless_dev *wdev;
  99
 100                 if (wiphy_net(&rdev->wiphy) != netns)
 101                         continue;
 102
 103                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
 104                         continue;
 105
 106                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
 107                         if (have_ifidx && wdev->netdev &&
 108                             wdev->netdev->ifindex == ifidx) {
 109                                 result = wdev;
 110                                 break;
 111                         }
 112                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 113                                 result = wdev;
 114                                 break;
 115                         }
 116                 }
 117
 118                 if (result)
 119                         break;
 120         }
 121
 122         if (result)
 123                 return result;
 124         return ERR_PTR(-ENODEV);
 125 }
 126
 127 static struct cfg80211_registered_device *
 128 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 129 {
 130         struct cfg80211_registered_device *rdev = NULL, *tmp;
 131         struct net_device *netdev;
 132
 133         ASSERT_RTNL();
 134
 135         if (!attrs[NL80211_ATTR_WIPHY] &&
 136             !attrs[NL80211_ATTR_IFINDEX] &&
 137             !attrs[NL80211_ATTR_WDEV])
 138                 return ERR_PTR(-EINVAL);
 139
 140         if (attrs[NL80211_ATTR_WIPHY])
 141                 rdev = cfg80211_rdev_by_wiphy_idx(
 142                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 143
 144         if (attrs[NL80211_ATTR_WDEV]) {
 145                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 146                 struct wireless_dev *wdev;
 147                 bool found = false;
 148
 149                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 150                 if (tmp) {
 151                         /* make sure wdev exists */
 152                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 153                                 if (wdev->identifier != (u32)wdev_id)
 154                                         continue;
 155                                 found = true;
 156                                 break;
 157                         }
 158
 159                         if (!found)
 160                                 tmp = NULL;
 161
 162                         if (rdev && tmp != rdev)
 163                                 return ERR_PTR(-EINVAL);
 164                         rdev = tmp;
 165                 }
 166         }
 167
 168         if (attrs[NL80211_ATTR_IFINDEX]) {
 169                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 170                 netdev = __dev_get_by_index(netns, ifindex);
 171                 if (netdev) {
 172                         if (netdev->ieee80211_ptr)
 173                                 tmp = wiphy_to_rdev(
 174                                         netdev->ieee80211_ptr->wiphy);
 175                         else
 176                                 tmp = NULL;
 177
 178                         /* not wireless device -- return error */
 179                         if (!tmp)
 180                                 return ERR_PTR(-EINVAL);
 181
 182                         /* mismatch -- return error */
 183                         if (rdev && tmp != rdev)
 184                                 return ERR_PTR(-EINVAL);
 185
 186                         rdev = tmp;
 187                 }
 188         }
 189
 190         if (!rdev)
 191                 return ERR_PTR(-ENODEV);
 192
 193         if (netns != wiphy_net(&rdev->wiphy))
 194                 return ERR_PTR(-ENODEV);
 195
 196         return rdev;
 197 }
 198
 199 /*
 200  * This function returns a pointer to the driver
 201  * that the genl_info item that is passed refers to.
 202  *
 203  * The result of this can be a PTR_ERR and hence must
 204  * be checked with IS_ERR() for errors.
 205  */
 206 static struct cfg80211_registered_device *
 207 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 208 {
 209         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 210 }
 211
 212 /* policy for the attributes */
 213 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 214         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 215         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 216                                       .len = 20-1 },
 217         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 218
 219         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 220         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 221         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 222         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 223         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 224
 225         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 226         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 227         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 228         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 229         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 230         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 231
 232         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 233         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 234         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 235
 236         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 237         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 238
 239         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 240         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 241                                     .len = WLAN_MAX_KEY_LEN },
 242         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 243         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 244         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 245         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 246         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 247
 248         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 249         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 250         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 251                                        .len = IEEE80211_MAX_DATA_LEN },
 252         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 253                                        .len = IEEE80211_MAX_DATA_LEN },
 254         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 255         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 256         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 257         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 258                                                .len = NL80211_MAX_SUPP_RATES },
 259         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 260         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 261         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 262         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 263                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 264         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 265
 266         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 267         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 268
 269         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 270         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 271         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 272         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 273                                            .len = NL80211_MAX_SUPP_RATES },
 274         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 275
 276         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 277         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 278
 279         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 280
 281         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 282         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 283                               .len = IEEE80211_MAX_DATA_LEN },
 284         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 285         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 286
 287         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 288                                 .len = IEEE80211_MAX_SSID_LEN },
 289         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 290         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 291         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 292         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 293         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 294         [NL80211_ATTR_STA_FLAGS2] = {
 295                 .len = sizeof(struct nl80211_sta_flag_update),
 296         },
 297         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 298         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 299         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 300         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 301         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 302         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 303         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 304         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 305         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 306                                  .len = WLAN_PMKID_LEN },
 307         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 308         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 309         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 310         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 311                                  .len = IEEE80211_MAX_DATA_LEN },
 312         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 313         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 314         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 315         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 316         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 317         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 318         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 319         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 320         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 321         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 322         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 323         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 324         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 325         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 326         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 327         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 328         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 329         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 330         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 331         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 332                                          .len = IEEE80211_MAX_DATA_LEN },
 333         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 334                                          .len = IEEE80211_MAX_DATA_LEN },
 335         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 336         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 337         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 338         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 339         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 340         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 341         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 342         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 343         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 344         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 345         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 346                                       .len = IEEE80211_MAX_DATA_LEN },
 347         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 348         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 349         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 350                 .len = NL80211_HT_CAPABILITY_LEN
 351         },
 352         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 353         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 354         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 355         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 356         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 357         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 358         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 359         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 360         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 361         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 362         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 363         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 364         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 365         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 366         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 367         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 368         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 369                 .len = NL80211_VHT_CAPABILITY_LEN,
 370         },
 371         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 372         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 373                                   .len = IEEE80211_MAX_DATA_LEN },
 374         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 375         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 376         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 377         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 378         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
 379         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
 380         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 381         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 382         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 383         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 384         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 385         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 386         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 387         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 388                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 389         [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
 390         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 391         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 392         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 393         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 394         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 395         [NL80211_ATTR_TSID] = { .type = NLA_U8 },
 396         [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 },
 397         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 398         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 399         [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
 400         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 401         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 402         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 403         [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 404 };
 405
 406 /* policy for the key attributes */
 407 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 408         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 409         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 410         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 411         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 412         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 413         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 414         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 415         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 416 };
 417
 418 /* policy for the key default flags */
 419 static const struct nla_policy
 420 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 421         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 422         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 423 };
 424
 425 /* policy for WoWLAN attributes */
 426 static const struct nla_policy
 427 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 428         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 429         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 430         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 431         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 432         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 433         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 434         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 435         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 436         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 437         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 438 };
 439
 440 static const struct nla_policy
 441 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 442         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 443         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 444         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 445         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 446         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 447         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 448         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 449                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 450         },
 451         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 452                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 453         },
 454         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 455         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 456         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 457 };
 458
 459 /* policy for coalesce rule attributes */
 460 static const struct nla_policy
 461 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 462         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 463         [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
 464         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 465 };
 466
 467 /* policy for GTK rekey offload attributes */
 468 static const struct nla_policy
 469 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 470         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 471         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 472         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 473 };
 474
 475 static const struct nla_policy
 476 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 477         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 478                                                  .len = IEEE80211_MAX_SSID_LEN },
 479         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 480 };
 481
 482 static const struct nla_policy
 483 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 484         [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 485         [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 486 };
 487
 488 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 489                                      struct netlink_callback *cb,
 490                                      struct cfg80211_registered_device **rdev,
 491                                      struct wireless_dev **wdev)
 492 {
 493         int err;
 494
 495         rtnl_lock();
 496
 497         if (!cb->args[0]) {
 498                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 499                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
 500                                   nl80211_policy);
 501                 if (err)
 502                         goto out_unlock;
 503
 504                 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
 505                                                    nl80211_fam.attrbuf);
 506                 if (IS_ERR(*wdev)) {
 507                         err = PTR_ERR(*wdev);
 508                         goto out_unlock;
 509                 }
 510                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 511                 /* 0 is the first index - add 1 to parse only once */
 512                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 513                 cb->args[1] = (*wdev)->identifier;
 514         } else {
 515                 /* subtract the 1 again here */
 516                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 517                 struct wireless_dev *tmp;
 518
 519                 if (!wiphy) {
 520                         err = -ENODEV;
 521                         goto out_unlock;
 522                 }
 523                 *rdev = wiphy_to_rdev(wiphy);
 524                 *wdev = NULL;
 525
 526                 list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
 527                         if (tmp->identifier == cb->args[1]) {
 528                                 *wdev = tmp;
 529                                 break;
 530                         }
 531                 }
 532
 533                 if (!*wdev) {
 534                         err = -ENODEV;
 535                         goto out_unlock;
 536                 }
 537         }
 538
 539         return 0;
 540  out_unlock:
 541         rtnl_unlock();
 542         return err;
 543 }
 544
 545 static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
 546 {
 547         rtnl_unlock();
 548 }
 549
 550 /* IE validation */
 551 static bool is_valid_ie_attr(const struct nlattr *attr)
 552 {
 553         const u8 *pos;
 554         int len;
 555
 556         if (!attr)
 557                 return true;
 558
 559         pos = nla_data(attr);
 560         len = nla_len(attr);
 561
 562         while (len) {
 563                 u8 elemlen;
 564
 565                 if (len < 2)
 566                         return false;
 567                 len -= 2;
 568
 569                 elemlen = pos[1];
 570                 if (elemlen > len)
 571                         return false;
 572
 573                 len -= elemlen;
 574                 pos += 2 + elemlen;
 575         }
 576
 577         return true;
 578 }
 579
 580 /* message building helper */
 581 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 582                                    int flags, u8 cmd)
 583 {
 584         /* since there is no private header just add the generic one */
 585         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 586 }
 587
 588 static int nl80211_msg_put_channel(struct sk_buff *msg,
 589                                    struct ieee80211_channel *chan,
 590                                    bool large)
 591 {
 592         /* Some channels must be completely excluded from the
 593          * list to protect old user-space tools from breaking
 594          */
 595         if (!large && chan->flags &
 596             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 597                 return 0;
 598
 599         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 600                         chan->center_freq))
 601                 goto nla_put_failure;
 602
 603         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 604             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 605                 goto nla_put_failure;
 606         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 607                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 608                         goto nla_put_failure;
 609                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 610                         goto nla_put_failure;
 611         }
 612         if (chan->flags & IEEE80211_CHAN_RADAR) {
 613                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 614                         goto nla_put_failure;
 615                 if (large) {
 616                         u32 time;
 617
 618                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 619
 620                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 621                                         chan->dfs_state))
 622                                 goto nla_put_failure;
 623                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 624                                         time))
 625                                 goto nla_put_failure;
 626                         if (nla_put_u32(msg,
 627                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 628                                         chan->dfs_cac_ms))
 629                                 goto nla_put_failure;
 630                 }
 631         }
 632
 633         if (large) {
 634                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 635                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 636                         goto nla_put_failure;
 637                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 638                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 639                         goto nla_put_failure;
 640                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 641                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 642                         goto nla_put_failure;
 643                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 644                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 645                         goto nla_put_failure;
 646                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 647                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 648                         goto nla_put_failure;
 649                 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
 650                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
 651                         goto nla_put_failure;
 652                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 653                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 654                         goto nla_put_failure;
 655                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 656                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 657                         goto nla_put_failure;
 658         }
 659
 660         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 661                         DBM_TO_MBM(chan->max_power)))
 662                 goto nla_put_failure;
 663
 664         return 0;
 665
 666  nla_put_failure:
 667         return -ENOBUFS;
 668 }
 669
 670 /* netlink command implementations */
 671
 672 struct key_parse {
 673         struct key_params p;
 674         int idx;
 675         int type;
 676         bool def, defmgmt;
 677         bool def_uni, def_multi;
 678 };
 679
 680 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 681 {
 682         struct nlattr *tb[NL80211_KEY_MAX + 1];
 683         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 684                                    nl80211_key_policy);
 685         if (err)
 686                 return err;
 687
 688         k->def = !!tb[NL80211_KEY_DEFAULT];
 689         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 690
 691         if (k->def) {
 692                 k->def_uni = true;
 693                 k->def_multi = true;
 694         }
 695         if (k->defmgmt)
 696                 k->def_multi = true;
 697
 698         if (tb[NL80211_KEY_IDX])
 699                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 700
 701         if (tb[NL80211_KEY_DATA]) {
 702                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 703                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 704         }
 705
 706         if (tb[NL80211_KEY_SEQ]) {
 707                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 708                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 709         }
 710
 711         if (tb[NL80211_KEY_CIPHER])
 712                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 713
 714         if (tb[NL80211_KEY_TYPE]) {
 715                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 716                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 717                         return -EINVAL;
 718         }
 719
 720         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 721                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 722                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 723                                        tb[NL80211_KEY_DEFAULT_TYPES],
 724                                        nl80211_key_default_policy);
 725                 if (err)
 726                         return err;
 727
 728                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 729                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 730         }
 731
 732         return 0;
 733 }
 734
 735 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 736 {
 737         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 738                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 739                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 740         }
 741
 742         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 743                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 744                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 745         }
 746
 747         if (info->attrs[NL80211_ATTR_KEY_IDX])
 748                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 749
 750         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 751                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 752
 753         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 754         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 755
 756         if (k->def) {
 757                 k->def_uni = true;
 758                 k->def_multi = true;
 759         }
 760         if (k->defmgmt)
 761                 k->def_multi = true;
 762
 763         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 764                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 765                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 766                         return -EINVAL;
 767         }
 768
 769         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 770                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 771                 int err = nla_parse_nested(
 772                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 773                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 774                                 nl80211_key_default_policy);
 775                 if (err)
 776                         return err;
 777
 778                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 779                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 780         }
 781
 782         return 0;
 783 }
 784
 785 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 786 {
 787         int err;
 788
 789         memset(k, 0, sizeof(*k));
 790         k->idx = -1;
 791         k->type = -1;
 792
 793         if (info->attrs[NL80211_ATTR_KEY])
 794                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 795         else
 796                 err = nl80211_parse_key_old(info, k);
 797
 798         if (err)
 799                 return err;
 800
 801         if (k->def && k->defmgmt)
 802                 return -EINVAL;
 803
 804         if (k->defmgmt) {
 805                 if (k->def_uni || !k->def_multi)
 806                         return -EINVAL;
 807         }
 808
 809         if (k->idx != -1) {
 810                 if (k->defmgmt) {
 811                         if (k->idx < 4 || k->idx > 5)
 812                                 return -EINVAL;
 813                 } else if (k->def) {
 814                         if (k->idx < 0 || k->idx > 3)
 815                                 return -EINVAL;
 816                 } else {
 817                         if (k->idx < 0 || k->idx > 5)
 818                                 return -EINVAL;
 819                 }
 820         }
 821
 822         return 0;
 823 }
 824
 825 static struct cfg80211_cached_keys *
 826 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 827                        struct nlattr *keys, bool *no_ht)
 828 {
 829         struct key_parse parse;
 830         struct nlattr *key;
 831         struct cfg80211_cached_keys *result;
 832         int rem, err, def = 0;
 833
 834         result = kzalloc(sizeof(*result), GFP_KERNEL);
 835         if (!result)
 836                 return ERR_PTR(-ENOMEM);
 837
 838         result->def = -1;
 839         result->defmgmt = -1;
 840
 841         nla_for_each_nested(key, keys, rem) {
 842                 memset(&parse, 0, sizeof(parse));
 843                 parse.idx = -1;
 844
 845                 err = nl80211_parse_key_new(key, &parse);
 846                 if (err)
 847                         goto error;
 848                 err = -EINVAL;
 849                 if (!parse.p.key)
 850                         goto error;
 851                 if (parse.idx < 0 || parse.idx > 4)
 852                         goto error;
 853                 if (parse.def) {
 854                         if (def)
 855                                 goto error;
 856                         def = 1;
 857                         result->def = parse.idx;
 858                         if (!parse.def_uni || !parse.def_multi)
 859                                 goto error;
 860                 } else if (parse.defmgmt)
 861                         goto error;
 862                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 863                                                      parse.idx, false, NULL);
 864                 if (err)
 865                         goto error;
 866                 result->params[parse.idx].cipher = parse.p.cipher;
 867                 result->params[parse.idx].key_len = parse.p.key_len;
 868                 result->params[parse.idx].key = result->data[parse.idx];
 869                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 870
 871                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 872                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 873                         if (no_ht)
 874                                 *no_ht = true;
 875                 }
 876         }
 877
 878         return result;
 879  error:
 880         kfree(result);
 881         return ERR_PTR(err);
 882 }
 883
 884 static int nl80211_key_allowed(struct wireless_dev *wdev)
 885 {
 886         ASSERT_WDEV_LOCK(wdev);
 887
 888         switch (wdev->iftype) {
 889         case NL80211_IFTYPE_AP:
 890         case NL80211_IFTYPE_AP_VLAN:
 891         case NL80211_IFTYPE_P2P_GO:
 892         case NL80211_IFTYPE_MESH_POINT:
 893                 break;
 894         case NL80211_IFTYPE_ADHOC:
 895         case NL80211_IFTYPE_STATION:
 896         case NL80211_IFTYPE_P2P_CLIENT:
 897                 if (!wdev->current_bss)
 898                         return -ENOLINK;
 899                 break;
 900         case NL80211_IFTYPE_UNSPECIFIED:
 901         case NL80211_IFTYPE_OCB:
 902         case NL80211_IFTYPE_MONITOR:
 903         case NL80211_IFTYPE_P2P_DEVICE:
 904         case NL80211_IFTYPE_WDS:
 905         case NUM_NL80211_IFTYPES:
 906                 return -EINVAL;
 907         }
 908
 909         return 0;
 910 }
 911
 912 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
 913                                                         struct nlattr *tb)
 914 {
 915         struct ieee80211_channel *chan;
 916
 917         if (tb == NULL)
 918                 return NULL;
 919         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
 920         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 921                 return NULL;
 922         return chan;
 923 }
 924
 925 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 926 {
 927         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 928         int i;
 929
 930         if (!nl_modes)
 931                 goto nla_put_failure;
 932
 933         i = 0;
 934         while (ifmodes) {
 935                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 936                         goto nla_put_failure;
 937                 ifmodes >>= 1;
 938                 i++;
 939         }
 940
 941         nla_nest_end(msg, nl_modes);
 942         return 0;
 943
 944 nla_put_failure:
 945         return -ENOBUFS;
 946 }
 947
 948 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 949                                           struct sk_buff *msg,
 950                                           bool large)
 951 {
 952         struct nlattr *nl_combis;
 953         int i, j;
 954
 955         nl_combis = nla_nest_start(msg,
 956                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 957         if (!nl_combis)
 958                 goto nla_put_failure;
 959
 960         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 961                 const struct ieee80211_iface_combination *c;
 962                 struct nlattr *nl_combi, *nl_limits;
 963
 964                 c = &wiphy->iface_combinations[i];
 965
 966                 nl_combi = nla_nest_start(msg, i + 1);
 967                 if (!nl_combi)
 968                         goto nla_put_failure;
 969
 970                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 971                 if (!nl_limits)
 972                         goto nla_put_failure;
 973
 974                 for (j = 0; j < c->n_limits; j++) {
 975                         struct nlattr *nl_limit;
 976
 977                         nl_limit = nla_nest_start(msg, j + 1);
 978                         if (!nl_limit)
 979                                 goto nla_put_failure;
 980                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 981                                         c->limits[j].max))
 982                                 goto nla_put_failure;
 983                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 984                                                 c->limits[j].types))
 985                                 goto nla_put_failure;
 986                         nla_nest_end(msg, nl_limit);
 987                 }
 988
 989                 nla_nest_end(msg, nl_limits);
 990
 991                 if (c->beacon_int_infra_match &&
 992                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 993                         goto nla_put_failure;
 994                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 995                                 c->num_different_channels) ||
 996                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 997                                 c->max_interfaces))
 998                         goto nla_put_failure;
 999                 if (large &&
1000                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1001                                 c->radar_detect_widths) ||
1002                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1003                                 c->radar_detect_regions)))
1004                         goto nla_put_failure;
1005
1006                 nla_nest_end(msg, nl_combi);
1007         }
1008
1009         nla_nest_end(msg, nl_combis);
1010
1011         return 0;
1012 nla_put_failure:
1013         return -ENOBUFS;
1014 }
1015
1016 #ifdef CONFIG_PM
1017 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1018                                         struct sk_buff *msg)
1019 {
1020         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1021         struct nlattr *nl_tcp;
1022
1023         if (!tcp)
1024                 return 0;
1025
1026         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1027         if (!nl_tcp)
1028                 return -ENOBUFS;
1029
1030         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1031                         tcp->data_payload_max))
1032                 return -ENOBUFS;
1033
1034         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1035                         tcp->data_payload_max))
1036                 return -ENOBUFS;
1037
1038         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1039                 return -ENOBUFS;
1040
1041         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1042                                 sizeof(*tcp->tok), tcp->tok))
1043                 return -ENOBUFS;
1044
1045         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1046                         tcp->data_interval_max))
1047                 return -ENOBUFS;
1048
1049         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1050                         tcp->wake_payload_max))
1051                 return -ENOBUFS;
1052
1053         nla_nest_end(msg, nl_tcp);
1054         return 0;
1055 }
1056
1057 static int nl80211_send_wowlan(struct sk_buff *msg,
1058                                struct cfg80211_registered_device *rdev,
1059                                bool large)
1060 {
1061         struct nlattr *nl_wowlan;
1062
1063         if (!rdev->wiphy.wowlan)
1064                 return 0;
1065
1066         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1067         if (!nl_wowlan)
1068                 return -ENOBUFS;
1069
1070         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1071              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1072             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1073              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1074             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1075              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1076             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1077              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1078             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1079              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1080             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1081              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1082             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1083              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1084             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1085              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1086                 return -ENOBUFS;
1087
1088         if (rdev->wiphy.wowlan->n_patterns) {
1089                 struct nl80211_pattern_support pat = {
1090                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1091                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1092                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1093                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1094                 };
1095
1096                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1097                             sizeof(pat), &pat))
1098                         return -ENOBUFS;
1099         }
1100
1101         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1102             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1103                         rdev->wiphy.wowlan->max_nd_match_sets))
1104                 return -ENOBUFS;
1105
1106         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1107                 return -ENOBUFS;
1108
1109         nla_nest_end(msg, nl_wowlan);
1110
1111         return 0;
1112 }
1113 #endif
1114
1115 static int nl80211_send_coalesce(struct sk_buff *msg,
1116                                  struct cfg80211_registered_device *rdev)
1117 {
1118         struct nl80211_coalesce_rule_support rule;
1119
1120         if (!rdev->wiphy.coalesce)
1121                 return 0;
1122
1123         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1124         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1125         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1126         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1127         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1128         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1129
1130         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1131                 return -ENOBUFS;
1132
1133         return 0;
1134 }
1135
1136 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1137                                       struct ieee80211_supported_band *sband)
1138 {
1139         struct nlattr *nl_rates, *nl_rate;
1140         struct ieee80211_rate *rate;
1141         int i;
1142
1143         /* add HT info */
1144         if (sband->ht_cap.ht_supported &&
1145             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1146                      sizeof(sband->ht_cap.mcs),
1147                      &sband->ht_cap.mcs) ||
1148              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1149                          sband->ht_cap.cap) ||
1150              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1151                         sband->ht_cap.ampdu_factor) ||
1152              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1153                         sband->ht_cap.ampdu_density)))
1154                 return -ENOBUFS;
1155
1156         /* add VHT info */
1157         if (sband->vht_cap.vht_supported &&
1158             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1159                      sizeof(sband->vht_cap.vht_mcs),
1160                      &sband->vht_cap.vht_mcs) ||
1161              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1162                          sband->vht_cap.cap)))
1163                 return -ENOBUFS;
1164
1165         /* add bitrates */
1166         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1167         if (!nl_rates)
1168                 return -ENOBUFS;
1169
1170         for (i = 0; i < sband->n_bitrates; i++) {
1171                 nl_rate = nla_nest_start(msg, i);
1172                 if (!nl_rate)
1173                         return -ENOBUFS;
1174
1175                 rate = &sband->bitrates[i];
1176                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1177                                 rate->bitrate))
1178                         return -ENOBUFS;
1179                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1180                     nla_put_flag(msg,
1181                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1182                         return -ENOBUFS;
1183
1184                 nla_nest_end(msg, nl_rate);
1185         }
1186
1187         nla_nest_end(msg, nl_rates);
1188
1189         return 0;
1190 }
1191
1192 static int
1193 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1194                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1195 {
1196         u16 stypes;
1197         struct nlattr *nl_ftypes, *nl_ifs;
1198         enum nl80211_iftype ift;
1199         int i;
1200
1201         if (!mgmt_stypes)
1202                 return 0;
1203
1204         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1205         if (!nl_ifs)
1206                 return -ENOBUFS;
1207
1208         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1209                 nl_ftypes = nla_nest_start(msg, ift);
1210                 if (!nl_ftypes)
1211                         return -ENOBUFS;
1212                 i = 0;
1213                 stypes = mgmt_stypes[ift].tx;
1214                 while (stypes) {
1215                         if ((stypes & 1) &&
1216                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1217                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1218                                 return -ENOBUFS;
1219                         stypes >>= 1;
1220                         i++;
1221                 }
1222                 nla_nest_end(msg, nl_ftypes);
1223         }
1224
1225         nla_nest_end(msg, nl_ifs);
1226
1227         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1228         if (!nl_ifs)
1229                 return -ENOBUFS;
1230
1231         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1232                 nl_ftypes = nla_nest_start(msg, ift);
1233                 if (!nl_ftypes)
1234                         return -ENOBUFS;
1235                 i = 0;
1236                 stypes = mgmt_stypes[ift].rx;
1237                 while (stypes) {
1238                         if ((stypes & 1) &&
1239                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1240                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1241                                 return -ENOBUFS;
1242                         stypes >>= 1;
1243                         i++;
1244                 }
1245                 nla_nest_end(msg, nl_ftypes);
1246         }
1247         nla_nest_end(msg, nl_ifs);
1248
1249         return 0;
1250 }
1251
1252 struct nl80211_dump_wiphy_state {
1253         s64 filter_wiphy;
1254         long start;
1255         long split_start, band_start, chan_start;
1256         bool split;
1257 };
1258
1259 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1260                               enum nl80211_commands cmd,
1261                               struct sk_buff *msg, u32 portid, u32 seq,
1262                               int flags, struct nl80211_dump_wiphy_state *state)
1263 {
1264         void *hdr;
1265         struct nlattr *nl_bands, *nl_band;
1266         struct nlattr *nl_freqs, *nl_freq;
1267         struct nlattr *nl_cmds;
1268         enum ieee80211_band band;
1269         struct ieee80211_channel *chan;
1270         int i;
1271         const struct ieee80211_txrx_stypes *mgmt_stypes =
1272                                 rdev->wiphy.mgmt_stypes;
1273         u32 features;
1274
1275         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1276         if (!hdr)
1277                 return -ENOBUFS;
1278
1279         if (WARN_ON(!state))
1280                 return -EINVAL;
1281
1282         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1283             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1284                            wiphy_name(&rdev->wiphy)) ||
1285             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1286                         cfg80211_rdev_list_generation))
1287                 goto nla_put_failure;
1288
1289         if (cmd != NL80211_CMD_NEW_WIPHY)
1290                 goto finish;
1291
1292         switch (state->split_start) {
1293         case 0:
1294                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1295                                rdev->wiphy.retry_short) ||
1296                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1297                                rdev->wiphy.retry_long) ||
1298                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1299                                 rdev->wiphy.frag_threshold) ||
1300                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1301                                 rdev->wiphy.rts_threshold) ||
1302                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1303                                rdev->wiphy.coverage_class) ||
1304                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1305                                rdev->wiphy.max_scan_ssids) ||
1306                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1307                                rdev->wiphy.max_sched_scan_ssids) ||
1308                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1309                                 rdev->wiphy.max_scan_ie_len) ||
1310                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1311                                 rdev->wiphy.max_sched_scan_ie_len) ||
1312                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1313                                rdev->wiphy.max_match_sets) ||
1314                     nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
1315                                 rdev->wiphy.max_sched_scan_plans) ||
1316                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
1317                                 rdev->wiphy.max_sched_scan_plan_interval) ||
1318                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
1319                                 rdev->wiphy.max_sched_scan_plan_iterations))
1320                         goto nla_put_failure;
1321
1322                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1323                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1324                         goto nla_put_failure;
1325                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1326                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1327                         goto nla_put_failure;
1328                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1329                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1330                         goto nla_put_failure;
1331                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1332                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1333                         goto nla_put_failure;
1334                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1335                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1336                         goto nla_put_failure;
1337                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1338                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1339                         goto nla_put_failure;
1340                 state->split_start++;
1341                 if (state->split)
1342                         break;
1343         case 1:
1344                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1345                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1346                             rdev->wiphy.cipher_suites))
1347                         goto nla_put_failure;
1348
1349                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1350                                rdev->wiphy.max_num_pmkids))
1351                         goto nla_put_failure;
1352
1353                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1354                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1355                         goto nla_put_failure;
1356
1357                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1358                                 rdev->wiphy.available_antennas_tx) ||
1359                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1360                                 rdev->wiphy.available_antennas_rx))
1361                         goto nla_put_failure;
1362
1363                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1364                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1365                                 rdev->wiphy.probe_resp_offload))
1366                         goto nla_put_failure;
1367
1368                 if ((rdev->wiphy.available_antennas_tx ||
1369                      rdev->wiphy.available_antennas_rx) &&
1370                     rdev->ops->get_antenna) {
1371                         u32 tx_ant = 0, rx_ant = 0;
1372                         int res;
1373                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1374                         if (!res) {
1375                                 if (nla_put_u32(msg,
1376                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1377                                                 tx_ant) ||
1378                                     nla_put_u32(msg,
1379                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1380                                                 rx_ant))
1381                                         goto nla_put_failure;
1382                         }
1383                 }
1384
1385                 state->split_start++;
1386                 if (state->split)
1387                         break;
1388         case 2:
1389                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1390                                         rdev->wiphy.interface_modes))
1391                                 goto nla_put_failure;
1392                 state->split_start++;
1393                 if (state->split)
1394                         break;
1395         case 3:
1396                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1397                 if (!nl_bands)
1398                         goto nla_put_failure;
1399
1400                 for (band = state->band_start;
1401                      band < IEEE80211_NUM_BANDS; band++) {
1402                         struct ieee80211_supported_band *sband;
1403
1404                         sband = rdev->wiphy.bands[band];
1405
1406                         if (!sband)
1407                                 continue;
1408
1409                         nl_band = nla_nest_start(msg, band);
1410                         if (!nl_band)
1411                                 goto nla_put_failure;
1412
1413                         switch (state->chan_start) {
1414                         case 0:
1415                                 if (nl80211_send_band_rateinfo(msg, sband))
1416                                         goto nla_put_failure;
1417                                 state->chan_start++;
1418                                 if (state->split)
1419                                         break;
1420                         default:
1421                                 /* add frequencies */
1422                                 nl_freqs = nla_nest_start(
1423                                         msg, NL80211_BAND_ATTR_FREQS);
1424                                 if (!nl_freqs)
1425                                         goto nla_put_failure;
1426
1427                                 for (i = state->chan_start - 1;
1428                                      i < sband->n_channels;
1429                                      i++) {
1430                                         nl_freq = nla_nest_start(msg, i);
1431                                         if (!nl_freq)
1432                                                 goto nla_put_failure;
1433
1434                                         chan = &sband->channels[i];
1435
1436                                         if (nl80211_msg_put_channel(
1437                                                         msg, chan,
1438                                                         state->split))
1439                                                 goto nla_put_failure;
1440
1441                                         nla_nest_end(msg, nl_freq);
1442                                         if (state->split)
1443                                                 break;
1444                                 }
1445                                 if (i < sband->n_channels)
1446                                         state->chan_start = i + 2;
1447                                 else
1448                                         state->chan_start = 0;
1449                                 nla_nest_end(msg, nl_freqs);
1450                         }
1451
1452                         nla_nest_end(msg, nl_band);
1453
1454                         if (state->split) {
1455                                 /* start again here */
1456                                 if (state->chan_start)
1457                                         band--;
1458                                 break;
1459                         }
1460                 }
1461                 nla_nest_end(msg, nl_bands);
1462
1463                 if (band < IEEE80211_NUM_BANDS)
1464                         state->band_start = band + 1;
1465                 else
1466                         state->band_start = 0;
1467
1468                 /* if bands & channels are done, continue outside */
1469                 if (state->band_start == 0 && state->chan_start == 0)
1470                         state->split_start++;
1471                 if (state->split)
1472                         break;
1473         case 4:
1474                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1475                 if (!nl_cmds)
1476                         goto nla_put_failure;
1477
1478                 i = 0;
1479 #define CMD(op, n)                                                      \
1480                  do {                                                   \
1481                         if (rdev->ops->op) {                            \
1482                                 i++;                                    \
1483                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1484                                         goto nla_put_failure;           \
1485                         }                                               \
1486                 } while (0)
1487
1488                 CMD(add_virtual_intf, NEW_INTERFACE);
1489                 CMD(change_virtual_intf, SET_INTERFACE);
1490                 CMD(add_key, NEW_KEY);
1491                 CMD(start_ap, START_AP);
1492                 CMD(add_station, NEW_STATION);
1493                 CMD(add_mpath, NEW_MPATH);
1494                 CMD(update_mesh_config, SET_MESH_CONFIG);
1495                 CMD(change_bss, SET_BSS);
1496                 CMD(auth, AUTHENTICATE);
1497                 CMD(assoc, ASSOCIATE);
1498                 CMD(deauth, DEAUTHENTICATE);
1499                 CMD(disassoc, DISASSOCIATE);
1500                 CMD(join_ibss, JOIN_IBSS);
1501                 CMD(join_mesh, JOIN_MESH);
1502                 CMD(set_pmksa, SET_PMKSA);
1503                 CMD(del_pmksa, DEL_PMKSA);
1504                 CMD(flush_pmksa, FLUSH_PMKSA);
1505                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1506                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1507                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1508                 CMD(mgmt_tx, FRAME);
1509                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1510                 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1511                         i++;
1512                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1513                                 goto nla_put_failure;
1514                 }
1515                 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1516                     rdev->ops->join_mesh) {
1517                         i++;
1518                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1519                                 goto nla_put_failure;
1520                 }
1521                 CMD(set_wds_peer, SET_WDS_PEER);
1522                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1523                         CMD(tdls_mgmt, TDLS_MGMT);
1524                         CMD(tdls_oper, TDLS_OPER);
1525                 }
1526                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1527                         CMD(sched_scan_start, START_SCHED_SCAN);
1528                 CMD(probe_client, PROBE_CLIENT);
1529                 CMD(set_noack_map, SET_NOACK_MAP);
1530                 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1531                         i++;
1532                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1533                                 goto nla_put_failure;
1534                 }
1535                 CMD(start_p2p_device, START_P2P_DEVICE);
1536                 CMD(set_mcast_rate, SET_MCAST_RATE);
1537 #ifdef CONFIG_NL80211_TESTMODE
1538                 CMD(testmode_cmd, TESTMODE);
1539 #endif
1540                 if (state->split) {
1541                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1542                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1543                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1544                                 CMD(channel_switch, CHANNEL_SWITCH);
1545                         CMD(set_qos_map, SET_QOS_MAP);
1546                         if (rdev->wiphy.features &
1547                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
1548                                 CMD(add_tx_ts, ADD_TX_TS);
1549                 }
1550                 /* add into the if now */
1551 #undef CMD
1552
1553                 if (rdev->ops->connect || rdev->ops->auth) {
1554                         i++;
1555                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1556                                 goto nla_put_failure;
1557                 }
1558
1559                 if (rdev->ops->disconnect || rdev->ops->deauth) {
1560                         i++;
1561                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1562                                 goto nla_put_failure;
1563                 }
1564
1565                 nla_nest_end(msg, nl_cmds);
1566                 state->split_start++;
1567                 if (state->split)
1568                         break;
1569         case 5:
1570                 if (rdev->ops->remain_on_channel &&
1571                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1572                     nla_put_u32(msg,
1573                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1574                                 rdev->wiphy.max_remain_on_channel_duration))
1575                         goto nla_put_failure;
1576
1577                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1578                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1579                         goto nla_put_failure;
1580
1581                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1582                         goto nla_put_failure;
1583                 state->split_start++;
1584                 if (state->split)
1585                         break;
1586         case 6:
1587 #ifdef CONFIG_PM
1588                 if (nl80211_send_wowlan(msg, rdev, state->split))
1589                         goto nla_put_failure;
1590                 state->split_start++;
1591                 if (state->split)
1592                         break;
1593 #else
1594                 state->split_start++;
1595 #endif
1596         case 7:
1597                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1598                                         rdev->wiphy.software_iftypes))
1599                         goto nla_put_failure;
1600
1601                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1602                                                    state->split))
1603                         goto nla_put_failure;
1604
1605                 state->split_start++;
1606                 if (state->split)
1607                         break;
1608         case 8:
1609                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1610                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1611                                 rdev->wiphy.ap_sme_capa))
1612                         goto nla_put_failure;
1613
1614                 features = rdev->wiphy.features;
1615                 /*
1616                  * We can only add the per-channel limit information if the
1617                  * dump is split, otherwise it makes it too big. Therefore
1618                  * only advertise it in that case.
1619                  */
1620                 if (state->split)
1621                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1622                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1623                         goto nla_put_failure;
1624
1625                 if (rdev->wiphy.ht_capa_mod_mask &&
1626                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1627                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
1628                             rdev->wiphy.ht_capa_mod_mask))
1629                         goto nla_put_failure;
1630
1631                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1632                     rdev->wiphy.max_acl_mac_addrs &&
1633                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1634                                 rdev->wiphy.max_acl_mac_addrs))
1635                         goto nla_put_failure;
1636
1637                 /*
1638                  * Any information below this point is only available to
1639                  * applications that can deal with it being split. This
1640                  * helps ensure that newly added capabilities don't break
1641                  * older tools by overrunning their buffers.
1642                  *
1643                  * We still increment split_start so that in the split
1644                  * case we'll continue with more data in the next round,
1645                  * but break unconditionally so unsplit data stops here.
1646                  */
1647                 state->split_start++;
1648                 break;
1649         case 9:
1650                 if (rdev->wiphy.extended_capabilities &&
1651                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1652                              rdev->wiphy.extended_capabilities_len,
1653                              rdev->wiphy.extended_capabilities) ||
1654                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1655                              rdev->wiphy.extended_capabilities_len,
1656                              rdev->wiphy.extended_capabilities_mask)))
1657                         goto nla_put_failure;
1658
1659                 if (rdev->wiphy.vht_capa_mod_mask &&
1660                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1661                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
1662                             rdev->wiphy.vht_capa_mod_mask))
1663                         goto nla_put_failure;
1664
1665                 state->split_start++;
1666                 break;
1667         case 10:
1668                 if (nl80211_send_coalesce(msg, rdev))
1669                         goto nla_put_failure;
1670
1671                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1672                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1673                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1674                         goto nla_put_failure;
1675
1676                 if (rdev->wiphy.max_ap_assoc_sta &&
1677                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1678                                 rdev->wiphy.max_ap_assoc_sta))
1679                         goto nla_put_failure;
1680
1681                 state->split_start++;
1682                 break;
1683         case 11:
1684                 if (rdev->wiphy.n_vendor_commands) {
1685                         const struct nl80211_vendor_cmd_info *info;
1686                         struct nlattr *nested;
1687
1688                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1689                         if (!nested)
1690                                 goto nla_put_failure;
1691
1692                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1693                                 info = &rdev->wiphy.vendor_commands[i].info;
1694                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1695                                         goto nla_put_failure;
1696                         }
1697                         nla_nest_end(msg, nested);
1698                 }
1699
1700                 if (rdev->wiphy.n_vendor_events) {
1701                         const struct nl80211_vendor_cmd_info *info;
1702                         struct nlattr *nested;
1703
1704                         nested = nla_nest_start(msg,
1705                                                 NL80211_ATTR_VENDOR_EVENTS);
1706                         if (!nested)
1707                                 goto nla_put_failure;
1708
1709                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
1710                                 info = &rdev->wiphy.vendor_events[i];
1711                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1712                                         goto nla_put_failure;
1713                         }
1714                         nla_nest_end(msg, nested);
1715                 }
1716                 state->split_start++;
1717                 break;
1718         case 12:
1719                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
1720                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
1721                                rdev->wiphy.max_num_csa_counters))
1722                         goto nla_put_failure;
1723
1724                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
1725                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
1726                         goto nla_put_failure;
1727
1728                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
1729                             sizeof(rdev->wiphy.ext_features),
1730                             rdev->wiphy.ext_features))
1731                         goto nla_put_failure;
1732
1733                 /* done */
1734                 state->split_start = 0;
1735                 break;
1736         }
1737  finish:
1738         genlmsg_end(msg, hdr);
1739         return 0;
1740
1741  nla_put_failure:
1742         genlmsg_cancel(msg, hdr);
1743         return -EMSGSIZE;
1744 }
1745
1746 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1747                                     struct netlink_callback *cb,
1748                                     struct nl80211_dump_wiphy_state *state)
1749 {
1750         struct nlattr **tb = nl80211_fam.attrbuf;
1751         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1752                               tb, nl80211_fam.maxattr, nl80211_policy);
1753         /* ignore parse errors for backward compatibility */
1754         if (ret)
1755                 return 0;
1756
1757         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1758         if (tb[NL80211_ATTR_WIPHY])
1759                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1760         if (tb[NL80211_ATTR_WDEV])
1761                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1762         if (tb[NL80211_ATTR_IFINDEX]) {
1763                 struct net_device *netdev;
1764                 struct cfg80211_registered_device *rdev;
1765                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1766
1767                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1768                 if (!netdev)
1769                         return -ENODEV;
1770                 if (netdev->ieee80211_ptr) {
1771                         rdev = wiphy_to_rdev(
1772                                 netdev->ieee80211_ptr->wiphy);
1773                         state->filter_wiphy = rdev->wiphy_idx;
1774                 }
1775         }
1776
1777         return 0;
1778 }
1779
1780 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1781 {
1782         int idx = 0, ret;
1783         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1784         struct cfg80211_registered_device *rdev;
1785
1786         rtnl_lock();
1787         if (!state) {
1788                 state = kzalloc(sizeof(*state), GFP_KERNEL);
1789                 if (!state) {
1790                         rtnl_unlock();
1791                         return -ENOMEM;
1792                 }
1793                 state->filter_wiphy = -1;
1794                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1795                 if (ret) {
1796                         kfree(state);
1797                         rtnl_unlock();
1798                         return ret;
1799                 }
1800                 cb->args[0] = (long)state;
1801         }
1802
1803         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1804                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1805                         continue;
1806                 if (++idx <= state->start)
1807                         continue;
1808                 if (state->filter_wiphy != -1 &&
1809                     state->filter_wiphy != rdev->wiphy_idx)
1810                         continue;
1811                 /* attempt to fit multiple wiphy data chunks into the skb */
1812                 do {
1813                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
1814                                                  skb,
1815                                                  NETLINK_CB(cb->skb).portid,
1816                                                  cb->nlh->nlmsg_seq,
1817                                                  NLM_F_MULTI, state);
1818                         if (ret < 0) {
1819                                 /*
1820                                  * If sending the wiphy data didn't fit (ENOBUFS
1821                                  * or EMSGSIZE returned), this SKB is still
1822                                  * empty (so it's not too big because another
1823                                  * wiphy dataset is already in the skb) and
1824                                  * we've not tried to adjust the dump allocation
1825                                  * yet ... then adjust the alloc size to be
1826                                  * bigger, and return 1 but with the empty skb.
1827                                  * This results in an empty message being RX'ed
1828                                  * in userspace, but that is ignored.
1829                                  *
1830                                  * We can then retry with the larger buffer.
1831                                  */
1832                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1833                                     !skb->len && !state->split &&
1834                                     cb->min_dump_alloc < 4096) {
1835                                         cb->min_dump_alloc = 4096;
1836                                         state->split_start = 0;
1837                                         rtnl_unlock();
1838                                         return 1;
1839                                 }
1840                                 idx--;
1841                                 break;
1842                         }
1843                 } while (state->split_start > 0);
1844                 break;
1845         }
1846         rtnl_unlock();
1847
1848         state->start = idx;
1849
1850         return skb->len;
1851 }
1852
1853 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
1854 {
1855         kfree((void *)cb->args[0]);
1856         return 0;
1857 }
1858
1859 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1860 {
1861         struct sk_buff *msg;
1862         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1863         struct nl80211_dump_wiphy_state state = {};
1864
1865         msg = nlmsg_new(4096, GFP_KERNEL);
1866         if (!msg)
1867                 return -ENOMEM;
1868
1869         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
1870                                info->snd_portid, info->snd_seq, 0,
1871                                &state) < 0) {
1872                 nlmsg_free(msg);
1873                 return -ENOBUFS;
1874         }
1875
1876         return genlmsg_reply(msg, info);
1877 }
1878
1879 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1880         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1881         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1882         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1883         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1884         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1885 };
1886
1887 static int parse_txq_params(struct nlattr *tb[],
1888                             struct ieee80211_txq_params *txq_params)
1889 {
1890         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1891             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1892             !tb[NL80211_TXQ_ATTR_AIFS])
1893                 return -EINVAL;
1894
1895         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1896         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1897         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1898         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1899         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1900
1901         if (txq_params->ac >= NL80211_NUM_ACS)
1902                 return -EINVAL;
1903
1904         return 0;
1905 }
1906
1907 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1908 {
1909         /*
1910          * You can only set the channel explicitly for WDS interfaces,
1911          * all others have their channel managed via their respective
1912          * "establish a connection" command (connect, join, ...)
1913          *
1914          * For AP/GO and mesh mode, the channel can be set with the
1915          * channel userspace API, but is only stored and passed to the
1916          * low-level driver when the AP starts or the mesh is joined.
1917          * This is for backward compatibility, userspace can also give
1918          * the channel in the start-ap or join-mesh commands instead.
1919          *
1920          * Monitors are special as they are normally slaved to
1921          * whatever else is going on, so they have their own special
1922          * operation to set the monitor channel if possible.
1923          */
1924         return !wdev ||
1925                 wdev->iftype == NL80211_IFTYPE_AP ||
1926                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1927                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1928                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1929 }
1930
1931 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1932                                  struct genl_info *info,
1933                                  struct cfg80211_chan_def *chandef)
1934 {
1935         u32 control_freq;
1936
1937         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1938                 return -EINVAL;
1939
1940         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1941
1942         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1943         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1944         chandef->center_freq1 = control_freq;
1945         chandef->center_freq2 = 0;
1946
1947         /* Primary channel not allowed */
1948         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1949                 return -EINVAL;
1950
1951         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1952                 enum nl80211_channel_type chantype;
1953
1954                 chantype = nla_get_u32(
1955                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1956
1957                 switch (chantype) {
1958                 case NL80211_CHAN_NO_HT:
1959                 case NL80211_CHAN_HT20:
1960                 case NL80211_CHAN_HT40PLUS:
1961                 case NL80211_CHAN_HT40MINUS:
1962                         cfg80211_chandef_create(chandef, chandef->chan,
1963                                                 chantype);
1964                         break;
1965                 default:
1966                         return -EINVAL;
1967                 }
1968         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1969                 chandef->width =
1970                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1971                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1972                         chandef->center_freq1 =
1973                                 nla_get_u32(
1974                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1975                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1976                         chandef->center_freq2 =
1977                                 nla_get_u32(
1978                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1979         }
1980
1981         if (!cfg80211_chandef_valid(chandef))
1982                 return -EINVAL;
1983
1984         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1985                                      IEEE80211_CHAN_DISABLED))
1986                 return -EINVAL;
1987
1988         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
1989              chandef->width == NL80211_CHAN_WIDTH_10) &&
1990             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
1991                 return -EINVAL;
1992
1993         return 0;
1994 }
1995
1996 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1997                                  struct net_device *dev,
1998                                  struct genl_info *info)
1999 {
2000         struct cfg80211_chan_def chandef;
2001         int result;
2002         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
2003         struct wireless_dev *wdev = NULL;
2004
2005         if (dev)
2006                 wdev = dev->ieee80211_ptr;
2007         if (!nl80211_can_set_dev_channel(wdev))
2008                 return -EOPNOTSUPP;
2009         if (wdev)
2010                 iftype = wdev->iftype;
2011
2012         result = nl80211_parse_chandef(rdev, info, &chandef);
2013         if (result)
2014                 return result;
2015
2016         switch (iftype) {
2017         case NL80211_IFTYPE_AP:
2018         case NL80211_IFTYPE_P2P_GO:
2019                 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
2020                                                    iftype)) {
2021                         result = -EINVAL;
2022                         break;
2023                 }
2024                 if (wdev->beacon_interval) {
2025                         if (!dev || !rdev->ops->set_ap_chanwidth ||
2026                             !(rdev->wiphy.features &
2027                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2028                                 result = -EBUSY;
2029                                 break;
2030                         }
2031
2032                         /* Only allow dynamic channel width changes */
2033                         if (chandef.chan != wdev->preset_chandef.chan) {
2034                                 result = -EBUSY;
2035                                 break;
2036                         }
2037                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2038                         if (result)
2039                                 break;
2040                 }
2041                 wdev->preset_chandef = chandef;
2042                 result = 0;
2043                 break;
2044         case NL80211_IFTYPE_MESH_POINT:
2045                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2046                 break;
2047         case NL80211_IFTYPE_MONITOR:
2048                 result = cfg80211_set_monitor_channel(rdev, &chandef);
2049                 break;
2050         default:
2051                 result = -EINVAL;
2052         }
2053
2054         return result;
2055 }
2056
2057 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2058 {
2059         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2060         struct net_device *netdev = info->user_ptr[1];
2061
2062         return __nl80211_set_channel(rdev, netdev, info);
2063 }
2064
2065 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2066 {
2067         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2068         struct net_device *dev = info->user_ptr[1];
2069         struct wireless_dev *wdev = dev->ieee80211_ptr;
2070         const u8 *bssid;
2071
2072         if (!info->attrs[NL80211_ATTR_MAC])
2073                 return -EINVAL;
2074
2075         if (netif_running(dev))
2076                 return -EBUSY;
2077
2078         if (!rdev->ops->set_wds_peer)
2079                 return -EOPNOTSUPP;
2080
2081         if (wdev->iftype != NL80211_IFTYPE_WDS)
2082                 return -EOPNOTSUPP;
2083
2084         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2085         return rdev_set_wds_peer(rdev, dev, bssid);
2086 }
2087
2088
2089 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2090 {
2091         struct cfg80211_registered_device *rdev;
2092         struct net_device *netdev = NULL;
2093         struct wireless_dev *wdev;
2094         int result = 0, rem_txq_params = 0;
2095         struct nlattr *nl_txq_params;
2096         u32 changed;
2097         u8 retry_short = 0, retry_long = 0;
2098         u32 frag_threshold = 0, rts_threshold = 0;
2099         u8 coverage_class = 0;
2100
2101         ASSERT_RTNL();
2102
2103         /*
2104          * Try to find the wiphy and netdev. Normally this
2105          * function shouldn't need the netdev, but this is
2106          * done for backward compatibility -- previously
2107          * setting the channel was done per wiphy, but now
2108          * it is per netdev. Previous userland like hostapd
2109          * also passed a netdev to set_wiphy, so that it is
2110          * possible to let that go to the right netdev!
2111          */
2112
2113         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2114                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2115
2116                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2117                 if (netdev && netdev->ieee80211_ptr)
2118                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2119                 else
2120                         netdev = NULL;
2121         }
2122
2123         if (!netdev) {
2124                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2125                                                   info->attrs);
2126                 if (IS_ERR(rdev))
2127                         return PTR_ERR(rdev);
2128                 wdev = NULL;
2129                 netdev = NULL;
2130                 result = 0;
2131         } else
2132                 wdev = netdev->ieee80211_ptr;
2133
2134         /*
2135          * end workaround code, by now the rdev is available
2136          * and locked, and wdev may or may not be NULL.
2137          */
2138
2139         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2140                 result = cfg80211_dev_rename(
2141                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2142
2143         if (result)
2144                 return result;
2145
2146         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2147                 struct ieee80211_txq_params txq_params;
2148                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2149
2150                 if (!rdev->ops->set_txq_params)
2151                         return -EOPNOTSUPP;
2152
2153                 if (!netdev)
2154                         return -EINVAL;
2155
2156                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2157                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2158                         return -EINVAL;
2159
2160                 if (!netif_running(netdev))
2161                         return -ENETDOWN;
2162
2163                 nla_for_each_nested(nl_txq_params,
2164                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2165                                     rem_txq_params) {
2166                         result = nla_parse(tb, NL80211_TXQ_ATTR_MAX,
2167                                            nla_data(nl_txq_params),
2168                                            nla_len(nl_txq_params),
2169                                            txq_params_policy);
2170                         if (result)
2171                                 return result;
2172                         result = parse_txq_params(tb, &txq_params);
2173                         if (result)
2174                                 return result;
2175
2176                         result = rdev_set_txq_params(rdev, netdev,
2177                                                      &txq_params);
2178                         if (result)
2179                                 return result;
2180                 }
2181         }
2182
2183         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2184                 result = __nl80211_set_channel(
2185                         rdev,
2186                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2187                         info);
2188                 if (result)
2189                         return result;
2190         }
2191
2192         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2193                 struct wireless_dev *txp_wdev = wdev;
2194                 enum nl80211_tx_power_setting type;
2195                 int idx, mbm = 0;
2196
2197                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2198                         txp_wdev = NULL;
2199
2200                 if (!rdev->ops->set_tx_power)
2201                         return -EOPNOTSUPP;
2202
2203                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2204                 type = nla_get_u32(info->attrs[idx]);
2205
2206                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2207                     (type != NL80211_TX_POWER_AUTOMATIC))
2208                         return -EINVAL;
2209
2210                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2211                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2212                         mbm = nla_get_u32(info->attrs[idx]);
2213                 }
2214
2215                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2216                 if (result)
2217                         return result;
2218         }
2219
2220         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2221             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2222                 u32 tx_ant, rx_ant;
2223                 if ((!rdev->wiphy.available_antennas_tx &&
2224                      !rdev->wiphy.available_antennas_rx) ||
2225                     !rdev->ops->set_antenna)
2226                         return -EOPNOTSUPP;
2227
2228                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2229                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2230
2231                 /* reject antenna configurations which don't match the
2232                  * available antenna masks, except for the "all" mask */
2233                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2234                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2235                         return -EINVAL;
2236
2237                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2238                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2239
2240                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2241                 if (result)
2242                         return result;
2243         }
2244
2245         changed = 0;
2246
2247         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2248                 retry_short = nla_get_u8(
2249                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2250                 if (retry_short == 0)
2251                         return -EINVAL;
2252
2253                 changed |= WIPHY_PARAM_RETRY_SHORT;
2254         }
2255
2256         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2257                 retry_long = nla_get_u8(
2258                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2259                 if (retry_long == 0)
2260                         return -EINVAL;
2261
2262                 changed |= WIPHY_PARAM_RETRY_LONG;
2263         }
2264
2265         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2266                 frag_threshold = nla_get_u32(
2267                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2268                 if (frag_threshold < 256)
2269                         return -EINVAL;
2270
2271                 if (frag_threshold != (u32) -1) {
2272                         /*
2273                          * Fragments (apart from the last one) are required to
2274                          * have even length. Make the fragmentation code
2275                          * simpler by stripping LSB should someone try to use
2276                          * odd threshold value.
2277                          */
2278                         frag_threshold &= ~0x1;
2279                 }
2280                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2281         }
2282
2283         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2284                 rts_threshold = nla_get_u32(
2285                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2286                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2287         }
2288
2289         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2290                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2291                         return -EINVAL;
2292
2293                 coverage_class = nla_get_u8(
2294                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2295                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2296         }
2297
2298         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2299                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2300                         return -EOPNOTSUPP;
2301
2302                 changed |= WIPHY_PARAM_DYN_ACK;
2303         }
2304
2305         if (changed) {
2306                 u8 old_retry_short, old_retry_long;
2307                 u32 old_frag_threshold, old_rts_threshold;
2308                 u8 old_coverage_class;
2309
2310                 if (!rdev->ops->set_wiphy_params)
2311                         return -EOPNOTSUPP;
2312
2313                 old_retry_short = rdev->wiphy.retry_short;
2314                 old_retry_long = rdev->wiphy.retry_long;
2315                 old_frag_threshold = rdev->wiphy.frag_threshold;
2316                 old_rts_threshold = rdev->wiphy.rts_threshold;
2317                 old_coverage_class = rdev->wiphy.coverage_class;
2318
2319                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2320                         rdev->wiphy.retry_short = retry_short;
2321                 if (changed & WIPHY_PARAM_RETRY_LONG)
2322                         rdev->wiphy.retry_long = retry_long;
2323                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2324                         rdev->wiphy.frag_threshold = frag_threshold;
2325                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2326                         rdev->wiphy.rts_threshold = rts_threshold;
2327                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2328                         rdev->wiphy.coverage_class = coverage_class;
2329
2330                 result = rdev_set_wiphy_params(rdev, changed);
2331                 if (result) {
2332                         rdev->wiphy.retry_short = old_retry_short;
2333                         rdev->wiphy.retry_long = old_retry_long;
2334                         rdev->wiphy.frag_threshold = old_frag_threshold;
2335                         rdev->wiphy.rts_threshold = old_rts_threshold;
2336                         rdev->wiphy.coverage_class = old_coverage_class;
2337                         return result;
2338                 }
2339         }
2340         return 0;
2341 }
2342
2343 static inline u64 wdev_id(struct wireless_dev *wdev)
2344 {
2345         return (u64)wdev->identifier |
2346                ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2347 }
2348
2349 static int nl80211_send_chandef(struct sk_buff *msg,
2350                                 const struct cfg80211_chan_def *chandef)
2351 {
2352         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
2353                 return -EINVAL;
2354
2355         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2356                         chandef->chan->center_freq))
2357                 return -ENOBUFS;
2358         switch (chandef->width) {
2359         case NL80211_CHAN_WIDTH_20_NOHT:
2360         case NL80211_CHAN_WIDTH_20:
2361         case NL80211_CHAN_WIDTH_40:
2362                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2363                                 cfg80211_get_chandef_type(chandef)))
2364                         return -ENOBUFS;
2365                 break;
2366         default:
2367                 break;
2368         }
2369         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2370                 return -ENOBUFS;
2371         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2372                 return -ENOBUFS;
2373         if (chandef->center_freq2 &&
2374             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2375                 return -ENOBUFS;
2376         return 0;
2377 }
2378
2379 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2380                               struct cfg80211_registered_device *rdev,
2381                               struct wireless_dev *wdev, bool removal)
2382 {
2383         struct net_device *dev = wdev->netdev;
2384         u8 cmd = NL80211_CMD_NEW_INTERFACE;
2385         void *hdr;
2386
2387         if (removal)
2388                 cmd = NL80211_CMD_DEL_INTERFACE;
2389
2390         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2391         if (!hdr)
2392                 return -1;
2393
2394         if (dev &&
2395             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2396              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2397                 goto nla_put_failure;
2398
2399         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2400             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2401             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2402             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2403             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2404                         rdev->devlist_generation ^
2405                         (cfg80211_rdev_list_generation << 2)))
2406                 goto nla_put_failure;
2407
2408         if (rdev->ops->get_channel) {
2409                 int ret;
2410                 struct cfg80211_chan_def chandef;
2411
2412                 ret = rdev_get_channel(rdev, wdev, &chandef);
2413                 if (ret == 0) {
2414                         if (nl80211_send_chandef(msg, &chandef))
2415                                 goto nla_put_failure;
2416                 }
2417         }
2418
2419         if (rdev->ops->get_tx_power) {
2420                 int dbm, ret;
2421
2422                 ret = rdev_get_tx_power(rdev, wdev, &dbm);
2423                 if (ret == 0 &&
2424                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
2425                                 DBM_TO_MBM(dbm)))
2426                         goto nla_put_failure;
2427         }
2428
2429         if (wdev->ssid_len) {
2430                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2431                         goto nla_put_failure;
2432         }
2433
2434         genlmsg_end(msg, hdr);
2435         return 0;
2436
2437  nla_put_failure:
2438         genlmsg_cancel(msg, hdr);
2439         return -EMSGSIZE;
2440 }
2441
2442 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2443 {
2444         int wp_idx = 0;
2445         int if_idx = 0;
2446         int wp_start = cb->args[0];
2447         int if_start = cb->args[1];
2448         struct cfg80211_registered_device *rdev;
2449         struct wireless_dev *wdev;
2450
2451         rtnl_lock();
2452         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2453                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2454                         continue;
2455                 if (wp_idx < wp_start) {
2456                         wp_idx++;
2457                         continue;
2458                 }
2459                 if_idx = 0;
2460
2461                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
2462                         if (if_idx < if_start) {
2463                                 if_idx++;
2464                                 continue;
2465                         }
2466                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2467                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2468                                                rdev, wdev, false) < 0) {
2469                                 goto out;
2470                         }
2471                         if_idx++;
2472                 }
2473
2474                 wp_idx++;
2475         }
2476  out:
2477         rtnl_unlock();
2478
2479         cb->args[0] = wp_idx;
2480         cb->args[1] = if_idx;
2481
2482         return skb->len;
2483 }
2484
2485 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2486 {
2487         struct sk_buff *msg;
2488         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2489         struct wireless_dev *wdev = info->user_ptr[1];
2490
2491         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2492         if (!msg)
2493                 return -ENOMEM;
2494
2495         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2496                                rdev, wdev, false) < 0) {
2497                 nlmsg_free(msg);
2498                 return -ENOBUFS;
2499         }
2500
2501         return genlmsg_reply(msg, info);
2502 }
2503
2504 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2505         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2506         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2507         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2508         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2509         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2510         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2511 };
2512
2513 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2514 {
2515         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2516         int flag;
2517
2518         *mntrflags = 0;
2519
2520         if (!nla)
2521                 return -EINVAL;
2522
2523         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2524                              nla, mntr_flags_policy))
2525                 return -EINVAL;
2526
2527         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2528                 if (flags[flag])
2529                         *mntrflags |= (1<<flag);
2530
2531         return 0;
2532 }
2533
2534 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2535                                struct net_device *netdev, u8 use_4addr,
2536                                enum nl80211_iftype iftype)
2537 {
2538         if (!use_4addr) {
2539                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2540                         return -EBUSY;
2541                 return 0;
2542         }
2543
2544         switch (iftype) {
2545         case NL80211_IFTYPE_AP_VLAN:
2546                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2547                         return 0;
2548                 break;
2549         case NL80211_IFTYPE_STATION:
2550                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2551                         return 0;
2552                 break;
2553         default:
2554                 break;
2555         }
2556
2557         return -EOPNOTSUPP;
2558 }
2559
2560 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2561 {
2562         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2563         struct vif_params params;
2564         int err;
2565         enum nl80211_iftype otype, ntype;
2566         struct net_device *dev = info->user_ptr[1];
2567         u32 _flags, *flags = NULL;
2568         bool change = false;
2569
2570         memset(&params, 0, sizeof(params));
2571
2572         otype = ntype = dev->ieee80211_ptr->iftype;
2573
2574         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2575                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2576                 if (otype != ntype)
2577                         change = true;
2578                 if (ntype > NL80211_IFTYPE_MAX)
2579                         return -EINVAL;
2580         }
2581
2582         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2583                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2584
2585                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2586                         return -EINVAL;
2587                 if (netif_running(dev))
2588                         return -EBUSY;
2589
2590                 wdev_lock(wdev);
2591                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2592                              IEEE80211_MAX_MESH_ID_LEN);
2593                 wdev->mesh_id_up_len =
2594                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2595                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2596                        wdev->mesh_id_up_len);
2597                 wdev_unlock(wdev);
2598         }
2599
2600         if (info->attrs[NL80211_ATTR_4ADDR]) {
2601                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2602                 change = true;
2603                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2604                 if (err)
2605                         return err;
2606         } else {
2607                 params.use_4addr = -1;
2608         }
2609
2610         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2611                 if (ntype != NL80211_IFTYPE_MONITOR)
2612                         return -EINVAL;
2613                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2614                                           &_flags);
2615                 if (err)
2616                         return err;
2617
2618                 flags = &_flags;
2619                 change = true;
2620         }
2621
2622         if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
2623             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2624                 return -EOPNOTSUPP;
2625
2626         if (change)
2627                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2628         else
2629                 err = 0;
2630
2631         if (!err && params.use_4addr != -1)
2632                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2633
2634         return err;
2635 }
2636
2637 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2638 {
2639         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2640         struct vif_params params;
2641         struct wireless_dev *wdev;
2642         struct sk_buff *msg, *event;
2643         int err;
2644         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2645         u32 flags;
2646
2647         /* to avoid failing a new interface creation due to pending removal */
2648         cfg80211_destroy_ifaces(rdev);
2649
2650         memset(&params, 0, sizeof(params));
2651
2652         if (!info->attrs[NL80211_ATTR_IFNAME])
2653                 return -EINVAL;
2654
2655         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2656                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2657                 if (type > NL80211_IFTYPE_MAX)
2658                         return -EINVAL;
2659         }
2660
2661         if (!rdev->ops->add_virtual_intf ||
2662             !(rdev->wiphy.interface_modes & (1 << type)))
2663                 return -EOPNOTSUPP;
2664
2665         if ((type == NL80211_IFTYPE_P2P_DEVICE ||
2666              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
2667             info->attrs[NL80211_ATTR_MAC]) {
2668                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2669                            ETH_ALEN);
2670                 if (!is_valid_ether_addr(params.macaddr))
2671                         return -EADDRNOTAVAIL;
2672         }
2673
2674         if (info->attrs[NL80211_ATTR_4ADDR]) {
2675                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2676                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2677                 if (err)
2678                         return err;
2679         }
2680
2681         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2682                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2683                                   &flags);
2684
2685         if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
2686             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2687                 return -EOPNOTSUPP;
2688
2689         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2690         if (!msg)
2691                 return -ENOMEM;
2692
2693         wdev = rdev_add_virtual_intf(rdev,
2694                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2695                                 NET_NAME_USER, type, err ? NULL : &flags,
2696                                 &params);
2697         if (WARN_ON(!wdev)) {
2698                 nlmsg_free(msg);
2699                 return -EPROTO;
2700         } else if (IS_ERR(wdev)) {
2701                 nlmsg_free(msg);
2702                 return PTR_ERR(wdev);
2703         }
2704
2705         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
2706                 wdev->owner_nlportid = info->snd_portid;
2707
2708         switch (type) {
2709         case NL80211_IFTYPE_MESH_POINT:
2710                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2711                         break;
2712                 wdev_lock(wdev);
2713                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2714                              IEEE80211_MAX_MESH_ID_LEN);
2715                 wdev->mesh_id_up_len =
2716                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2717                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2718                        wdev->mesh_id_up_len);
2719                 wdev_unlock(wdev);
2720                 break;
2721         case NL80211_IFTYPE_P2P_DEVICE:
2722                 /*
2723                  * P2P Device doesn't have a netdev, so doesn't go
2724                  * through the netdev notifier and must be added here
2725                  */
2726                 mutex_init(&wdev->mtx);
2727                 INIT_LIST_HEAD(&wdev->event_list);
2728                 spin_lock_init(&wdev->event_lock);
2729                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2730                 spin_lock_init(&wdev->mgmt_registrations_lock);
2731
2732                 wdev->identifier = ++rdev->wdev_id;
2733                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2734                 rdev->devlist_generation++;
2735                 break;
2736         default:
2737                 break;
2738         }
2739
2740         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2741                                rdev, wdev, false) < 0) {
2742                 nlmsg_free(msg);
2743                 return -ENOBUFS;
2744         }
2745
2746         event = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2747         if (event) {
2748                 if (nl80211_send_iface(event, 0, 0, 0,
2749                                        rdev, wdev, false) < 0) {
2750                         nlmsg_free(event);
2751                         goto out;
2752                 }
2753
2754                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
2755                                         event, 0, NL80211_MCGRP_CONFIG,
2756                                         GFP_KERNEL);
2757         }
2758
2759 out:
2760         return genlmsg_reply(msg, info);
2761 }
2762
2763 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2764 {
2765         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2766         struct wireless_dev *wdev = info->user_ptr[1];
2767         struct sk_buff *msg;
2768         int status;
2769
2770         if (!rdev->ops->del_virtual_intf)
2771                 return -EOPNOTSUPP;
2772
2773         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2774         if (msg && nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, true) < 0) {
2775                 nlmsg_free(msg);
2776                 msg = NULL;
2777         }
2778
2779         /*
2780          * If we remove a wireless device without a netdev then clear
2781          * user_ptr[1] so that nl80211_post_doit won't dereference it
2782          * to check if it needs to do dev_put(). Otherwise it crashes
2783          * since the wdev has been freed, unlike with a netdev where
2784          * we need the dev_put() for the netdev to really be freed.
2785          */
2786         if (!wdev->netdev)
2787                 info->user_ptr[1] = NULL;
2788
2789         status = rdev_del_virtual_intf(rdev, wdev);
2790         if (status >= 0 && msg)
2791                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
2792                                         msg, 0, NL80211_MCGRP_CONFIG,
2793                                         GFP_KERNEL);
2794         else
2795                 nlmsg_free(msg);
2796
2797         return status;
2798 }
2799
2800 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2801 {
2802         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2803         struct net_device *dev = info->user_ptr[1];
2804         u16 noack_map;
2805
2806         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2807                 return -EINVAL;
2808
2809         if (!rdev->ops->set_noack_map)
2810                 return -EOPNOTSUPP;
2811
2812         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2813
2814         return rdev_set_noack_map(rdev, dev, noack_map);
2815 }
2816
2817 struct get_key_cookie {
2818         struct sk_buff *msg;
2819         int error;
2820         int idx;
2821 };
2822
2823 static void get_key_callback(void *c, struct key_params *params)
2824 {
2825         struct nlattr *key;
2826         struct get_key_cookie *cookie = c;
2827
2828         if ((params->key &&
2829              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2830                      params->key_len, params->key)) ||
2831             (params->seq &&
2832              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2833                      params->seq_len, params->seq)) ||
2834             (params->cipher &&
2835              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2836                          params->cipher)))
2837                 goto nla_put_failure;
2838
2839         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2840         if (!key)
2841                 goto nla_put_failure;
2842
2843         if ((params->key &&
2844              nla_put(cookie->msg, NL80211_KEY_DATA,
2845                      params->key_len, params->key)) ||
2846             (params->seq &&
2847              nla_put(cookie->msg, NL80211_KEY_SEQ,
2848                      params->seq_len, params->seq)) ||
2849             (params->cipher &&
2850              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2851                          params->cipher)))
2852                 goto nla_put_failure;
2853
2854         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2855                 goto nla_put_failure;
2856
2857         nla_nest_end(cookie->msg, key);
2858
2859         return;
2860  nla_put_failure:
2861         cookie->error = 1;
2862 }
2863
2864 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2865 {
2866         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2867         int err;
2868         struct net_device *dev = info->user_ptr[1];
2869         u8 key_idx = 0;
2870         const u8 *mac_addr = NULL;
2871         bool pairwise;
2872         struct get_key_cookie cookie = {
2873                 .error = 0,
2874         };
2875         void *hdr;
2876         struct sk_buff *msg;
2877
2878         if (info->attrs[NL80211_ATTR_KEY_IDX])
2879                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2880
2881         if (key_idx > 5)
2882                 return -EINVAL;
2883
2884         if (info->attrs[NL80211_ATTR_MAC])
2885                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2886
2887         pairwise = !!mac_addr;
2888         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2889                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2890                 if (kt >= NUM_NL80211_KEYTYPES)
2891                         return -EINVAL;
2892                 if (kt != NL80211_KEYTYPE_GROUP &&
2893                     kt != NL80211_KEYTYPE_PAIRWISE)
2894                         return -EINVAL;
2895                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2896         }
2897
2898         if (!rdev->ops->get_key)
2899                 return -EOPNOTSUPP;
2900
2901         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2902                 return -ENOENT;
2903
2904         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2905         if (!msg)
2906                 return -ENOMEM;
2907
2908         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2909                              NL80211_CMD_NEW_KEY);
2910         if (!hdr)
2911                 goto nla_put_failure;
2912
2913         cookie.msg = msg;
2914         cookie.idx = key_idx;
2915
2916         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2917             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2918                 goto nla_put_failure;
2919         if (mac_addr &&
2920             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2921                 goto nla_put_failure;
2922
2923         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2924                            get_key_callback);
2925
2926         if (err)
2927                 goto free_msg;
2928
2929         if (cookie.error)
2930                 goto nla_put_failure;
2931
2932         genlmsg_end(msg, hdr);
2933         return genlmsg_reply(msg, info);
2934
2935  nla_put_failure:
2936         err = -ENOBUFS;
2937  free_msg:
2938         nlmsg_free(msg);
2939         return err;
2940 }
2941
2942 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2943 {
2944         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2945         struct key_parse key;
2946         int err;
2947         struct net_device *dev = info->user_ptr[1];
2948
2949         err = nl80211_parse_key(info, &key);
2950         if (err)
2951                 return err;
2952
2953         if (key.idx < 0)
2954                 return -EINVAL;
2955
2956         /* only support setting default key */
2957         if (!key.def && !key.defmgmt)
2958                 return -EINVAL;
2959
2960         wdev_lock(dev->ieee80211_ptr);
2961
2962         if (key.def) {
2963                 if (!rdev->ops->set_default_key) {
2964                         err = -EOPNOTSUPP;
2965                         goto out;
2966                 }
2967
2968                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2969                 if (err)
2970                         goto out;
2971
2972                 err = rdev_set_default_key(rdev, dev, key.idx,
2973                                                  key.def_uni, key.def_multi);
2974
2975                 if (err)
2976                         goto out;
2977
2978 #ifdef CONFIG_CFG80211_WEXT
2979                 dev->ieee80211_ptr->wext.default_key = key.idx;
2980 #endif
2981         } else {
2982                 if (key.def_uni || !key.def_multi) {
2983                         err = -EINVAL;
2984                         goto out;
2985                 }
2986
2987                 if (!rdev->ops->set_default_mgmt_key) {
2988                         err = -EOPNOTSUPP;
2989                         goto out;
2990                 }
2991
2992                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2993                 if (err)
2994                         goto out;
2995
2996                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2997                 if (err)
2998                         goto out;
2999
3000 #ifdef CONFIG_CFG80211_WEXT
3001                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
3002 #endif
3003         }
3004
3005  out:
3006         wdev_unlock(dev->ieee80211_ptr);
3007
3008         return err;
3009 }
3010
3011 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
3012 {
3013         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3014         int err;
3015         struct net_device *dev = info->user_ptr[1];
3016         struct key_parse key;
3017         const u8 *mac_addr = NULL;
3018
3019         err = nl80211_parse_key(info, &key);
3020         if (err)
3021                 return err;
3022
3023         if (!key.p.key)
3024                 return -EINVAL;
3025
3026         if (info->attrs[NL80211_ATTR_MAC])
3027                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3028
3029         if (key.type == -1) {
3030                 if (mac_addr)
3031                         key.type = NL80211_KEYTYPE_PAIRWISE;
3032                 else
3033                         key.type = NL80211_KEYTYPE_GROUP;
3034         }
3035
3036         /* for now */
3037         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3038             key.type != NL80211_KEYTYPE_GROUP)
3039                 return -EINVAL;
3040
3041         if (!rdev->ops->add_key)
3042                 return -EOPNOTSUPP;
3043
3044         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3045                                            key.type == NL80211_KEYTYPE_PAIRWISE,
3046                                            mac_addr))
3047                 return -EINVAL;
3048
3049         wdev_lock(dev->ieee80211_ptr);
3050         err = nl80211_key_allowed(dev->ieee80211_ptr);
3051         if (!err)
3052                 err = rdev_add_key(rdev, dev, key.idx,
3053                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3054                                     mac_addr, &key.p);
3055         wdev_unlock(dev->ieee80211_ptr);
3056
3057         return err;
3058 }
3059
3060 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3061 {
3062         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3063         int err;
3064         struct net_device *dev = info->user_ptr[1];
3065         u8 *mac_addr = NULL;
3066         struct key_parse key;
3067
3068         err = nl80211_parse_key(info, &key);
3069         if (err)
3070                 return err;
3071
3072         if (info->attrs[NL80211_ATTR_MAC])
3073                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3074
3075         if (key.type == -1) {
3076                 if (mac_addr)
3077                         key.type = NL80211_KEYTYPE_PAIRWISE;
3078                 else
3079                         key.type = NL80211_KEYTYPE_GROUP;
3080         }
3081
3082         /* for now */
3083         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3084             key.type != NL80211_KEYTYPE_GROUP)
3085                 return -EINVAL;
3086
3087         if (!rdev->ops->del_key)
3088                 return -EOPNOTSUPP;
3089
3090         wdev_lock(dev->ieee80211_ptr);
3091         err = nl80211_key_allowed(dev->ieee80211_ptr);
3092
3093         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
3094             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3095                 err = -ENOENT;
3096
3097         if (!err)
3098                 err = rdev_del_key(rdev, dev, key.idx,
3099                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3100                                    mac_addr);
3101
3102 #ifdef CONFIG_CFG80211_WEXT
3103         if (!err) {
3104                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
3105                         dev->ieee80211_ptr->wext.default_key = -1;
3106                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3107                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3108         }
3109 #endif
3110         wdev_unlock(dev->ieee80211_ptr);
3111
3112         return err;
3113 }
3114
3115 /* This function returns an error or the number of nested attributes */
3116 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3117 {
3118         struct nlattr *attr;
3119         int n_entries = 0, tmp;
3120
3121         nla_for_each_nested(attr, nl_attr, tmp) {
3122                 if (nla_len(attr) != ETH_ALEN)
3123                         return -EINVAL;
3124
3125                 n_entries++;
3126         }
3127
3128         return n_entries;
3129 }
3130
3131 /*
3132  * This function parses ACL information and allocates memory for ACL data.
3133  * On successful return, the calling function is responsible to free the
3134  * ACL buffer returned by this function.
3135  */
3136 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3137                                                 struct genl_info *info)
3138 {
3139         enum nl80211_acl_policy acl_policy;
3140         struct nlattr *attr;
3141         struct cfg80211_acl_data *acl;
3142         int i = 0, n_entries, tmp;
3143
3144         if (!wiphy->max_acl_mac_addrs)
3145                 return ERR_PTR(-EOPNOTSUPP);
3146
3147         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3148                 return ERR_PTR(-EINVAL);
3149
3150         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3151         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3152             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3153                 return ERR_PTR(-EINVAL);
3154
3155         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3156                 return ERR_PTR(-EINVAL);
3157
3158         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3159         if (n_entries < 0)
3160                 return ERR_PTR(n_entries);
3161
3162         if (n_entries > wiphy->max_acl_mac_addrs)
3163                 return ERR_PTR(-ENOTSUPP);
3164
3165         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3166                       GFP_KERNEL);
3167         if (!acl)
3168                 return ERR_PTR(-ENOMEM);
3169
3170         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3171                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3172                 i++;
3173         }
3174
3175         acl->n_acl_entries = n_entries;
3176         acl->acl_policy = acl_policy;
3177
3178         return acl;
3179 }
3180
3181 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3182 {
3183         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3184         struct net_device *dev = info->user_ptr[1];
3185         struct cfg80211_acl_data *acl;
3186         int err;
3187
3188         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3189             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3190                 return -EOPNOTSUPP;
3191
3192         if (!dev->ieee80211_ptr->beacon_interval)
3193                 return -EINVAL;
3194
3195         acl = parse_acl_data(&rdev->wiphy, info);
3196         if (IS_ERR(acl))
3197                 return PTR_ERR(acl);
3198
3199         err = rdev_set_mac_acl(rdev, dev, acl);
3200
3201         kfree(acl);
3202
3203         return err;
3204 }
3205
3206 static int nl80211_parse_beacon(struct nlattr *attrs[],
3207                                 struct cfg80211_beacon_data *bcn)
3208 {
3209         bool haveinfo = false;
3210
3211         if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
3212             !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
3213             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
3214             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
3215                 return -EINVAL;
3216
3217         memset(bcn, 0, sizeof(*bcn));
3218
3219         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
3220                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
3221                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
3222                 if (!bcn->head_len)
3223                         return -EINVAL;
3224                 haveinfo = true;
3225         }
3226
3227         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
3228                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
3229                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
3230                 haveinfo = true;
3231         }
3232
3233         if (!haveinfo)
3234                 return -EINVAL;
3235
3236         if (attrs[NL80211_ATTR_IE]) {
3237                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
3238                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3239         }
3240
3241         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3242                 bcn->proberesp_ies =
3243                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3244                 bcn->proberesp_ies_len =
3245                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3246         }
3247
3248         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3249                 bcn->assocresp_ies =
3250                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3251                 bcn->assocresp_ies_len =
3252                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3253         }
3254
3255         if (attrs[NL80211_ATTR_PROBE_RESP]) {
3256                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
3257                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3258         }
3259
3260         return 0;
3261 }
3262
3263 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
3264                                    struct cfg80211_ap_settings *params)
3265 {
3266         struct wireless_dev *wdev;
3267         bool ret = false;
3268
3269         list_for_each_entry(wdev, &rdev->wdev_list, list) {
3270                 if (wdev->iftype != NL80211_IFTYPE_AP &&
3271                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
3272                         continue;
3273
3274                 if (!wdev->preset_chandef.chan)
3275                         continue;
3276
3277                 params->chandef = wdev->preset_chandef;
3278                 ret = true;
3279                 break;
3280         }
3281
3282         return ret;
3283 }
3284
3285 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3286                                     enum nl80211_auth_type auth_type,
3287                                     enum nl80211_commands cmd)
3288 {
3289         if (auth_type > NL80211_AUTHTYPE_MAX)
3290                 return false;
3291
3292         switch (cmd) {
3293         case NL80211_CMD_AUTHENTICATE:
3294                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3295                     auth_type == NL80211_AUTHTYPE_SAE)
3296                         return false;
3297                 return true;
3298         case NL80211_CMD_CONNECT:
3299         case NL80211_CMD_START_AP:
3300                 /* SAE not supported yet */
3301                 if (auth_type == NL80211_AUTHTYPE_SAE)
3302                         return false;
3303                 return true;
3304         default:
3305                 return false;
3306         }
3307 }
3308
3309 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3310 {
3311         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3312         struct net_device *dev = info->user_ptr[1];
3313         struct wireless_dev *wdev = dev->ieee80211_ptr;
3314         struct cfg80211_ap_settings params;
3315         int err;
3316
3317         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3318             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3319                 return -EOPNOTSUPP;
3320
3321         if (!rdev->ops->start_ap)
3322                 return -EOPNOTSUPP;
3323
3324         if (wdev->beacon_interval)
3325                 return -EALREADY;
3326
3327         memset(&params, 0, sizeof(params));
3328
3329         /* these are required for START_AP */
3330         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3331             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3332             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3333                 return -EINVAL;
3334
3335         err = nl80211_parse_beacon(info->attrs, &params.beacon);
3336         if (err)
3337                 return err;
3338
3339         params.beacon_interval =
3340                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3341         params.dtim_period =
3342                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3343
3344         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
3345         if (err)
3346                 return err;
3347
3348         /*
3349          * In theory, some of these attributes should be required here
3350          * but since they were not used when the command was originally
3351          * added, keep them optional for old user space programs to let
3352          * them continue to work with drivers that do not need the
3353          * additional information -- drivers must check!
3354          */
3355         if (info->attrs[NL80211_ATTR_SSID]) {
3356                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3357                 params.ssid_len =
3358                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3359                 if (params.ssid_len == 0 ||
3360                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3361                         return -EINVAL;
3362         }
3363
3364         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3365                 params.hidden_ssid = nla_get_u32(
3366                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3367                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3368                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3369                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3370                         return -EINVAL;
3371         }
3372
3373         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3374
3375         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3376                 params.auth_type = nla_get_u32(
3377                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3378                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3379                                              NL80211_CMD_START_AP))
3380                         return -EINVAL;
3381         } else
3382                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3383
3384         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3385                                       NL80211_MAX_NR_CIPHER_SUITES);
3386         if (err)
3387                 return err;
3388
3389         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3390                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3391                         return -EOPNOTSUPP;
3392                 params.inactivity_timeout = nla_get_u16(
3393                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3394         }
3395
3396         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3397                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3398                         return -EINVAL;
3399                 params.p2p_ctwindow =
3400                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3401                 if (params.p2p_ctwindow > 127)
3402                         return -EINVAL;
3403                 if (params.p2p_ctwindow != 0 &&
3404                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3405                         return -EINVAL;
3406         }
3407
3408         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3409                 u8 tmp;
3410
3411                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3412                         return -EINVAL;
3413                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3414                 if (tmp > 1)
3415                         return -EINVAL;
3416                 params.p2p_opp_ps = tmp;
3417                 if (params.p2p_opp_ps != 0 &&
3418                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3419                         return -EINVAL;
3420         }
3421
3422         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3423                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
3424                 if (err)
3425                         return err;
3426         } else if (wdev->preset_chandef.chan) {
3427                 params.chandef = wdev->preset_chandef;
3428         } else if (!nl80211_get_ap_channel(rdev, &params))
3429                 return -EINVAL;
3430
3431         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
3432                                            wdev->iftype))
3433                 return -EINVAL;
3434
3435         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
3436                 params.smps_mode =
3437                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
3438                 switch (params.smps_mode) {
3439                 case NL80211_SMPS_OFF:
3440                         break;
3441                 case NL80211_SMPS_STATIC:
3442                         if (!(rdev->wiphy.features &
3443                               NL80211_FEATURE_STATIC_SMPS))
3444                                 return -EINVAL;
3445                         break;
3446                 case NL80211_SMPS_DYNAMIC:
3447                         if (!(rdev->wiphy.features &
3448                               NL80211_FEATURE_DYNAMIC_SMPS))
3449                                 return -EINVAL;
3450                         break;
3451                 default:
3452                         return -EINVAL;
3453                 }
3454         } else {
3455                 params.smps_mode = NL80211_SMPS_OFF;
3456         }
3457
3458         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3459                 params.acl = parse_acl_data(&rdev->wiphy, info);
3460                 if (IS_ERR(params.acl))
3461                         return PTR_ERR(params.acl);
3462         }
3463
3464         wdev_lock(wdev);
3465         err = rdev_start_ap(rdev, dev, &params);
3466         if (!err) {
3467                 wdev->preset_chandef = params.chandef;
3468                 wdev->beacon_interval = params.beacon_interval;
3469                 wdev->chandef = params.chandef;
3470                 wdev->ssid_len = params.ssid_len;
3471                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3472         }
3473         wdev_unlock(wdev);
3474
3475         kfree(params.acl);
3476
3477         return err;
3478 }
3479
3480 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3481 {
3482         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3483         struct net_device *dev = info->user_ptr[1];
3484         struct wireless_dev *wdev = dev->ieee80211_ptr;
3485         struct cfg80211_beacon_data params;
3486         int err;
3487
3488         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3489             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3490                 return -EOPNOTSUPP;
3491
3492         if (!rdev->ops->change_beacon)
3493                 return -EOPNOTSUPP;
3494
3495         if (!wdev->beacon_interval)
3496                 return -EINVAL;
3497
3498         err = nl80211_parse_beacon(info->attrs, &params);
3499         if (err)
3500                 return err;
3501
3502         wdev_lock(wdev);
3503         err = rdev_change_beacon(rdev, dev, &params);
3504         wdev_unlock(wdev);
3505
3506         return err;
3507 }
3508
3509 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3510 {
3511         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3512         struct net_device *dev = info->user_ptr[1];
3513
3514         return cfg80211_stop_ap(rdev, dev, false);
3515 }
3516
3517 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3518         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3519         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3520         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3521         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3522         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3523         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3524 };
3525
3526 static int parse_station_flags(struct genl_info *info,
3527                                enum nl80211_iftype iftype,
3528                                struct station_parameters *params)
3529 {
3530         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3531         struct nlattr *nla;
3532         int flag;
3533
3534         /*
3535          * Try parsing the new attribute first so userspace
3536          * can specify both for older kernels.
3537          */
3538         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3539         if (nla) {
3540                 struct nl80211_sta_flag_update *sta_flags;
3541
3542                 sta_flags = nla_data(nla);
3543                 params->sta_flags_mask = sta_flags->mask;
3544                 params->sta_flags_set = sta_flags->set;
3545                 params->sta_flags_set &= params->sta_flags_mask;
3546                 if ((params->sta_flags_mask |
3547                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3548                         return -EINVAL;
3549                 return 0;
3550         }
3551
3552         /* if present, parse the old attribute */
3553
3554         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3555         if (!nla)
3556                 return 0;
3557
3558         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3559                              nla, sta_flags_policy))
3560                 return -EINVAL;
3561
3562         /*
3563          * Only allow certain flags for interface types so that
3564          * other attributes are silently ignored. Remember that
3565          * this is backward compatibility code with old userspace
3566          * and shouldn't be hit in other cases anyway.
3567          */
3568         switch (iftype) {
3569         case NL80211_IFTYPE_AP:
3570         case NL80211_IFTYPE_AP_VLAN:
3571         case NL80211_IFTYPE_P2P_GO:
3572                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3573                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3574                                          BIT(NL80211_STA_FLAG_WME) |
3575                                          BIT(NL80211_STA_FLAG_MFP);
3576                 break;
3577         case NL80211_IFTYPE_P2P_CLIENT:
3578         case NL80211_IFTYPE_STATION:
3579                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3580                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3581                 break;
3582         case NL80211_IFTYPE_MESH_POINT:
3583                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3584                                          BIT(NL80211_STA_FLAG_MFP) |
3585                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3586         default:
3587                 return -EINVAL;
3588         }
3589
3590         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3591                 if (flags[flag]) {
3592                         params->sta_flags_set |= (1<<flag);
3593
3594                         /* no longer support new API additions in old API */
3595                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3596                                 return -EINVAL;
3597                 }
3598         }
3599
3600         return 0;
3601 }
3602
3603 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3604                                  int attr)
3605 {
3606         struct nlattr *rate;
3607         u32 bitrate;
3608         u16 bitrate_compat;
3609         enum nl80211_attrs rate_flg;
3610
3611         rate = nla_nest_start(msg, attr);
3612         if (!rate)
3613                 return false;
3614
3615         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3616         bitrate = cfg80211_calculate_bitrate(info);
3617         /* report 16-bit bitrate only if we can */
3618         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3619         if (bitrate > 0 &&
3620             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3621                 return false;
3622         if (bitrate_compat > 0 &&
3623             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3624                 return false;
3625
3626         switch (info->bw) {
3627         case RATE_INFO_BW_5:
3628                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
3629                 break;
3630         case RATE_INFO_BW_10:
3631                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
3632                 break;
3633         default:
3634                 WARN_ON(1);
3635                 /* fall through */
3636         case RATE_INFO_BW_20:
3637                 rate_flg = 0;
3638                 break;
3639         case RATE_INFO_BW_40:
3640                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
3641                 break;
3642         case RATE_INFO_BW_80:
3643                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
3644                 break;
3645         case RATE_INFO_BW_160:
3646                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
3647                 break;
3648         }
3649
3650         if (rate_flg && nla_put_flag(msg, rate_flg))
3651                 return false;
3652
3653         if (info->flags & RATE_INFO_FLAGS_MCS) {
3654                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3655                         return false;
3656                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3657                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3658                         return false;
3659         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3660                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3661                         return false;
3662                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3663                         return false;
3664                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3665                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3666                         return false;
3667         }
3668
3669         nla_nest_end(msg, rate);
3670         return true;
3671 }
3672
3673 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
3674                                int id)
3675 {
3676         void *attr;
3677         int i = 0;
3678
3679         if (!mask)
3680                 return true;
3681
3682         attr = nla_nest_start(msg, id);
3683         if (!attr)
3684                 return false;
3685
3686         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
3687                 if (!(mask & BIT(i)))
3688                         continue;
3689
3690                 if (nla_put_u8(msg, i, signal[i]))
3691                         return false;
3692         }
3693
3694         nla_nest_end(msg, attr);
3695
3696         return true;
3697 }
3698
3699 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
3700                                 u32 seq, int flags,
3701                                 struct cfg80211_registered_device *rdev,
3702                                 struct net_device *dev,
3703                                 const u8 *mac_addr, struct station_info *sinfo)
3704 {
3705         void *hdr;
3706         struct nlattr *sinfoattr, *bss_param;
3707
3708         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
3709         if (!hdr)
3710                 return -1;
3711
3712         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3713             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3714             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3715                 goto nla_put_failure;
3716
3717         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3718         if (!sinfoattr)
3719                 goto nla_put_failure;
3720
3721 #define PUT_SINFO(attr, memb, type) do {                                \
3722         if (sinfo->filled & BIT(NL80211_STA_INFO_ ## attr) &&           \
3723             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
3724                              sinfo->memb))                              \
3725                 goto nla_put_failure;                                   \
3726         } while (0)
3727
3728         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
3729         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
3730
3731         if (sinfo->filled & (BIT(NL80211_STA_INFO_RX_BYTES) |
3732                              BIT(NL80211_STA_INFO_RX_BYTES64)) &&
3733             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3734                         (u32)sinfo->rx_bytes))
3735                 goto nla_put_failure;
3736
3737         if (sinfo->filled & (BIT(NL80211_STA_INFO_TX_BYTES) |
3738                              BIT(NL80211_STA_INFO_TX_BYTES64)) &&
3739             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3740                         (u32)sinfo->tx_bytes))
3741                 goto nla_put_failure;
3742
3743         PUT_SINFO(RX_BYTES64, rx_bytes, u64);
3744         PUT_SINFO(TX_BYTES64, tx_bytes, u64);
3745         PUT_SINFO(LLID, llid, u16);
3746         PUT_SINFO(PLID, plid, u16);
3747         PUT_SINFO(PLINK_STATE, plink_state, u8);
3748
3749         switch (rdev->wiphy.signal_type) {
3750         case CFG80211_SIGNAL_TYPE_MBM:
3751                 PUT_SINFO(SIGNAL, signal, u8);
3752                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
3753                 break;
3754         default:
3755                 break;
3756         }
3757         if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL)) {
3758                 if (!nl80211_put_signal(msg, sinfo->chains,
3759                                         sinfo->chain_signal,
3760                                         NL80211_STA_INFO_CHAIN_SIGNAL))
3761                         goto nla_put_failure;
3762         }
3763         if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
3764                 if (!nl80211_put_signal(msg, sinfo->chains,
3765                                         sinfo->chain_signal_avg,
3766                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
3767                         goto nla_put_failure;
3768         }
3769         if (sinfo->filled & BIT(NL80211_STA_INFO_TX_BITRATE)) {
3770                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3771                                           NL80211_STA_INFO_TX_BITRATE))
3772                         goto nla_put_failure;
3773         }
3774         if (sinfo->filled & BIT(NL80211_STA_INFO_RX_BITRATE)) {
3775                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3776                                           NL80211_STA_INFO_RX_BITRATE))
3777                         goto nla_put_failure;
3778         }
3779
3780         PUT_SINFO(RX_PACKETS, rx_packets, u32);
3781         PUT_SINFO(TX_PACKETS, tx_packets, u32);
3782         PUT_SINFO(TX_RETRIES, tx_retries, u32);
3783         PUT_SINFO(TX_FAILED, tx_failed, u32);
3784         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
3785         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
3786         PUT_SINFO(LOCAL_PM, local_pm, u32);
3787         PUT_SINFO(PEER_PM, peer_pm, u32);
3788         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
3789
3790         if (sinfo->filled & BIT(NL80211_STA_INFO_BSS_PARAM)) {
3791                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3792                 if (!bss_param)
3793                         goto nla_put_failure;
3794
3795                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3796                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3797                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3798                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3799                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3800                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3801                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3802                                sinfo->bss_param.dtim_period) ||
3803                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3804                                 sinfo->bss_param.beacon_interval))
3805                         goto nla_put_failure;
3806
3807                 nla_nest_end(msg, bss_param);
3808         }
3809         if ((sinfo->filled & BIT(NL80211_STA_INFO_STA_FLAGS)) &&
3810             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3811                     sizeof(struct nl80211_sta_flag_update),
3812                     &sinfo->sta_flags))
3813                 goto nla_put_failure;
3814
3815         PUT_SINFO(T_OFFSET, t_offset, u64);
3816         PUT_SINFO(RX_DROP_MISC, rx_dropped_misc, u64);
3817         PUT_SINFO(BEACON_RX, rx_beacon, u64);
3818         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
3819
3820 #undef PUT_SINFO
3821
3822         if (sinfo->filled & BIT(NL80211_STA_INFO_TID_STATS)) {
3823                 struct nlattr *tidsattr;
3824                 int tid;
3825
3826                 tidsattr = nla_nest_start(msg, NL80211_STA_INFO_TID_STATS);
3827                 if (!tidsattr)
3828                         goto nla_put_failure;
3829
3830                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
3831                         struct cfg80211_tid_stats *tidstats;
3832                         struct nlattr *tidattr;
3833
3834                         tidstats = &sinfo->pertid[tid];
3835
3836                         if (!tidstats->filled)
3837                                 continue;
3838
3839                         tidattr = nla_nest_start(msg, tid + 1);
3840                         if (!tidattr)
3841                                 goto nla_put_failure;
3842
3843 #define PUT_TIDVAL(attr, memb, type) do {                               \
3844         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
3845             nla_put_ ## type(msg, NL80211_TID_STATS_ ## attr,           \
3846                              tidstats->memb))                           \
3847                 goto nla_put_failure;                                   \
3848         } while (0)
3849
3850                         PUT_TIDVAL(RX_MSDU, rx_msdu, u64);
3851                         PUT_TIDVAL(TX_MSDU, tx_msdu, u64);
3852                         PUT_TIDVAL(TX_MSDU_RETRIES, tx_msdu_retries, u64);
3853                         PUT_TIDVAL(TX_MSDU_FAILED, tx_msdu_failed, u64);
3854
3855 #undef PUT_TIDVAL
3856                         nla_nest_end(msg, tidattr);
3857                 }
3858
3859                 nla_nest_end(msg, tidsattr);
3860         }
3861
3862         nla_nest_end(msg, sinfoattr);
3863
3864         if (sinfo->assoc_req_ies_len &&
3865             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3866                     sinfo->assoc_req_ies))
3867                 goto nla_put_failure;
3868
3869         genlmsg_end(msg, hdr);
3870         return 0;
3871
3872  nla_put_failure:
3873         genlmsg_cancel(msg, hdr);
3874         return -EMSGSIZE;
3875 }
3876
3877 static int nl80211_dump_station(struct sk_buff *skb,
3878                                 struct netlink_callback *cb)
3879 {
3880         struct station_info sinfo;
3881         struct cfg80211_registered_device *rdev;
3882         struct wireless_dev *wdev;
3883         u8 mac_addr[ETH_ALEN];
3884         int sta_idx = cb->args[2];
3885         int err;
3886
3887         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
3888         if (err)
3889                 return err;
3890
3891         if (!wdev->netdev) {
3892                 err = -EINVAL;
3893                 goto out_err;
3894         }
3895
3896         if (!rdev->ops->dump_station) {
3897                 err = -EOPNOTSUPP;
3898                 goto out_err;
3899         }
3900
3901         while (1) {
3902                 memset(&sinfo, 0, sizeof(sinfo));
3903                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
3904                                         mac_addr, &sinfo);
3905                 if (err == -ENOENT)
3906                         break;
3907                 if (err)
3908                         goto out_err;
3909
3910                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
3911                                 NETLINK_CB(cb->skb).portid,
3912                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3913                                 rdev, wdev->netdev, mac_addr,
3914                                 &sinfo) < 0)
3915                         goto out;
3916
3917                 sta_idx++;
3918         }
3919
3920
3921  out:
3922         cb->args[2] = sta_idx;
3923         err = skb->len;
3924  out_err:
3925         nl80211_finish_wdev_dump(rdev);
3926
3927         return err;
3928 }
3929
3930 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3931 {
3932         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3933         struct net_device *dev = info->user_ptr[1];
3934         struct station_info sinfo;
3935         struct sk_buff *msg;
3936         u8 *mac_addr = NULL;
3937         int err;
3938
3939         memset(&sinfo, 0, sizeof(sinfo));
3940
3941         if (!info->attrs[NL80211_ATTR_MAC])
3942                 return -EINVAL;
3943
3944         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3945
3946         if (!rdev->ops->get_station)
3947                 return -EOPNOTSUPP;
3948
3949         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3950         if (err)
3951                 return err;
3952
3953         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3954         if (!msg)
3955                 return -ENOMEM;
3956
3957         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
3958                                  info->snd_portid, info->snd_seq, 0,
3959                                  rdev, dev, mac_addr, &sinfo) < 0) {
3960                 nlmsg_free(msg);
3961                 return -ENOBUFS;
3962         }
3963
3964         return genlmsg_reply(msg, info);
3965 }
3966
3967 int cfg80211_check_station_change(struct wiphy *wiphy,
3968                                   struct station_parameters *params,
3969                                   enum cfg80211_station_type statype)
3970 {
3971         if (params->listen_interval != -1 &&
3972             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
3973                 return -EINVAL;
3974
3975         if (params->aid &&
3976             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
3977             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
3978                 return -EINVAL;
3979
3980         /* When you run into this, adjust the code below for the new flag */
3981         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
3982
3983         switch (statype) {
3984         case CFG80211_STA_MESH_PEER_KERNEL:
3985         case CFG80211_STA_MESH_PEER_USER:
3986                 /*
3987                  * No ignoring the TDLS flag here -- the userspace mesh
3988                  * code doesn't have the bug of including TDLS in the
3989                  * mask everywhere.
3990                  */
3991                 if (params->sta_flags_mask &
3992                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3993                                   BIT(NL80211_STA_FLAG_MFP) |
3994                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3995                         return -EINVAL;
3996                 break;
3997         case CFG80211_STA_TDLS_PEER_SETUP:
3998         case CFG80211_STA_TDLS_PEER_ACTIVE:
3999                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4000                         return -EINVAL;
4001                 /* ignore since it can't change */
4002                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4003                 break;
4004         default:
4005                 /* disallow mesh-specific things */
4006                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
4007                         return -EINVAL;
4008                 if (params->local_pm)
4009                         return -EINVAL;
4010                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4011                         return -EINVAL;
4012         }
4013
4014         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4015             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
4016                 /* TDLS can't be set, ... */
4017                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4018                         return -EINVAL;
4019                 /*
4020                  * ... but don't bother the driver with it. This works around
4021                  * a hostapd/wpa_supplicant issue -- it always includes the
4022                  * TLDS_PEER flag in the mask even for AP mode.
4023                  */
4024                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4025         }
4026
4027         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4028             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4029                 /* reject other things that can't change */
4030                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
4031                         return -EINVAL;
4032                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
4033                         return -EINVAL;
4034                 if (params->supported_rates)
4035                         return -EINVAL;
4036                 if (params->ext_capab || params->ht_capa || params->vht_capa)
4037                         return -EINVAL;
4038         }
4039
4040         if (statype != CFG80211_STA_AP_CLIENT &&
4041             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4042                 if (params->vlan)
4043                         return -EINVAL;
4044         }
4045
4046         switch (statype) {
4047         case CFG80211_STA_AP_MLME_CLIENT:
4048                 /* Use this only for authorizing/unauthorizing a station */
4049                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
4050                         return -EOPNOTSUPP;
4051                 break;
4052         case CFG80211_STA_AP_CLIENT:
4053         case CFG80211_STA_AP_CLIENT_UNASSOC:
4054                 /* accept only the listed bits */
4055                 if (params->sta_flags_mask &
4056                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4057                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4058                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
4059                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4060                                   BIT(NL80211_STA_FLAG_WME) |
4061                                   BIT(NL80211_STA_FLAG_MFP)))
4062                         return -EINVAL;
4063
4064                 /* but authenticated/associated only if driver handles it */
4065                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4066                     params->sta_flags_mask &
4067                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4068                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4069                         return -EINVAL;
4070                 break;
4071         case CFG80211_STA_IBSS:
4072         case CFG80211_STA_AP_STA:
4073                 /* reject any changes other than AUTHORIZED */
4074                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
4075                         return -EINVAL;
4076                 break;
4077         case CFG80211_STA_TDLS_PEER_SETUP:
4078                 /* reject any changes other than AUTHORIZED or WME */
4079                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4080                                                BIT(NL80211_STA_FLAG_WME)))
4081                         return -EINVAL;
4082                 /* force (at least) rates when authorizing */
4083                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
4084                     !params->supported_rates)
4085                         return -EINVAL;
4086                 break;
4087         case CFG80211_STA_TDLS_PEER_ACTIVE:
4088                 /* reject any changes */
4089                 return -EINVAL;
4090         case CFG80211_STA_MESH_PEER_KERNEL:
4091                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4092                         return -EINVAL;
4093                 break;
4094         case CFG80211_STA_MESH_PEER_USER:
4095                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
4096                     params->plink_action != NL80211_PLINK_ACTION_BLOCK)
4097                         return -EINVAL;
4098                 break;
4099         }
4100
4101         return 0;
4102 }
4103 EXPORT_SYMBOL(cfg80211_check_station_change);
4104
4105 /*
4106  * Get vlan interface making sure it is running and on the right wiphy.
4107  */
4108 static struct net_device *get_vlan(struct genl_info *info,
4109                                    struct cfg80211_registered_device *rdev)
4110 {
4111         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
4112         struct net_device *v;
4113         int ret;
4114
4115         if (!vlanattr)
4116                 return NULL;
4117
4118         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
4119         if (!v)
4120                 return ERR_PTR(-ENODEV);
4121
4122         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
4123                 ret = -EINVAL;
4124                 goto error;
4125         }
4126
4127         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4128             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4129             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
4130                 ret = -EINVAL;
4131                 goto error;
4132         }
4133
4134         if (!netif_running(v)) {
4135                 ret = -ENETDOWN;
4136                 goto error;
4137         }
4138
4139         return v;
4140  error:
4141         dev_put(v);
4142         return ERR_PTR(ret);
4143 }
4144
4145 static const struct nla_policy
4146 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
4147         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
4148         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
4149 };
4150
4151 static int nl80211_parse_sta_wme(struct genl_info *info,
4152                                  struct station_parameters *params)
4153 {
4154         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
4155         struct nlattr *nla;
4156         int err;
4157
4158         /* parse WME attributes if present */
4159         if (!info->attrs[NL80211_ATTR_STA_WME])
4160                 return 0;
4161
4162         nla = info->attrs[NL80211_ATTR_STA_WME];
4163         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
4164                                nl80211_sta_wme_policy);
4165         if (err)
4166                 return err;
4167
4168         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
4169                 params->uapsd_queues = nla_get_u8(
4170                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
4171         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
4172                 return -EINVAL;
4173
4174         if (tb[NL80211_STA_WME_MAX_SP])
4175                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
4176
4177         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
4178                 return -EINVAL;
4179
4180         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
4181
4182         return 0;
4183 }
4184
4185 static int nl80211_parse_sta_channel_info(struct genl_info *info,
4186                                       struct station_parameters *params)
4187 {
4188         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
4189                 params->supported_channels =
4190                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4191                 params->supported_channels_len =
4192                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4193                 /*
4194                  * Need to include at least one (first channel, number of
4195                  * channels) tuple for each subband, and must have proper
4196                  * tuples for the rest of the data as well.
4197                  */
4198                 if (params->supported_channels_len < 2)
4199                         return -EINVAL;
4200                 if (params->supported_channels_len % 2)
4201                         return -EINVAL;
4202         }
4203
4204         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
4205                 params->supported_oper_classes =
4206                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4207                 params->supported_oper_classes_len =
4208                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4209                 /*
4210                  * The value of the Length field of the Supported Operating
4211                  * Classes element is between 2 and 253.
4212                  */
4213                 if (params->supported_oper_classes_len < 2 ||
4214                     params->supported_oper_classes_len > 253)
4215                         return -EINVAL;
4216         }
4217         return 0;
4218 }
4219
4220 static int nl80211_set_station_tdls(struct genl_info *info,
4221                                     struct station_parameters *params)
4222 {
4223         int err;
4224         /* Dummy STA entry gets updated once the peer capabilities are known */
4225         if (info->attrs[NL80211_ATTR_PEER_AID])
4226                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4227         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4228                 params->ht_capa =
4229                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4230         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4231                 params->vht_capa =
4232                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4233
4234         err = nl80211_parse_sta_channel_info(info, params);
4235         if (err)
4236                 return err;
4237
4238         return nl80211_parse_sta_wme(info, params);
4239 }
4240
4241 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
4242 {
4243         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4244         struct net_device *dev = info->user_ptr[1];
4245         struct station_parameters params;
4246         u8 *mac_addr;
4247         int err;
4248
4249         memset(&params, 0, sizeof(params));
4250
4251         if (!rdev->ops->change_station)
4252                 return -EOPNOTSUPP;
4253
4254         /*
4255          * AID and listen_interval properties can be set only for unassociated
4256          * station. Include these parameters here and will check them in
4257          * cfg80211_check_station_change().
4258          */
4259         if (info->attrs[NL80211_ATTR_STA_AID])
4260                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4261
4262         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4263                 params.listen_interval =
4264                      nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4265         else
4266                 params.listen_interval = -1;
4267
4268         if (!info->attrs[NL80211_ATTR_MAC])
4269                 return -EINVAL;
4270
4271         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4272
4273         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
4274                 params.supported_rates =
4275                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4276                 params.supported_rates_len =
4277                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4278         }
4279
4280         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4281                 params.capability =
4282                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4283                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4284         }
4285
4286         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4287                 params.ext_capab =
4288                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4289                 params.ext_capab_len =
4290                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4291         }
4292
4293         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4294                 return -EINVAL;
4295
4296         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4297                 params.plink_action =
4298                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4299                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4300                         return -EINVAL;
4301         }
4302
4303         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
4304                 params.plink_state =
4305                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
4306                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
4307                         return -EINVAL;
4308                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
4309         }
4310
4311         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
4312                 enum nl80211_mesh_power_mode pm = nla_get_u32(
4313                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
4314
4315                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
4316                     pm > NL80211_MESH_POWER_MAX)
4317                         return -EINVAL;
4318
4319                 params.local_pm = pm;
4320         }
4321
4322         /* Include parameters for TDLS peer (will check later) */
4323         err = nl80211_set_station_tdls(info, &params);
4324         if (err)
4325                 return err;
4326
4327         params.vlan = get_vlan(info, rdev);
4328         if (IS_ERR(params.vlan))
4329                 return PTR_ERR(params.vlan);
4330
4331         switch (dev->ieee80211_ptr->iftype) {
4332         case NL80211_IFTYPE_AP:
4333         case NL80211_IFTYPE_AP_VLAN:
4334         case NL80211_IFTYPE_P2P_GO:
4335         case NL80211_IFTYPE_P2P_CLIENT:
4336         case NL80211_IFTYPE_STATION:
4337         case NL80211_IFTYPE_ADHOC:
4338         case NL80211_IFTYPE_MESH_POINT:
4339                 break;
4340         default:
4341                 err = -EOPNOTSUPP;
4342                 goto out_put_vlan;
4343         }
4344
4345         /* driver will call cfg80211_check_station_change() */
4346         err = rdev_change_station(rdev, dev, mac_addr, &params);
4347
4348  out_put_vlan:
4349         if (params.vlan)
4350                 dev_put(params.vlan);
4351
4352         return err;
4353 }
4354
4355 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
4356 {
4357         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4358         int err;
4359         struct net_device *dev = info->user_ptr[1];
4360         struct station_parameters params;
4361         u8 *mac_addr = NULL;
4362         u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4363                          BIT(NL80211_STA_FLAG_ASSOCIATED);
4364
4365         memset(&params, 0, sizeof(params));
4366
4367         if (!rdev->ops->add_station)
4368                 return -EOPNOTSUPP;
4369
4370         if (!info->attrs[NL80211_ATTR_MAC])
4371                 return -EINVAL;
4372
4373         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4374                 return -EINVAL;
4375
4376         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
4377                 return -EINVAL;
4378
4379         if (!info->attrs[NL80211_ATTR_STA_AID] &&
4380             !info->attrs[NL80211_ATTR_PEER_AID])
4381                 return -EINVAL;
4382
4383         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4384         params.supported_rates =
4385                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4386         params.supported_rates_len =
4387                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4388         params.listen_interval =
4389                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4390
4391         if (info->attrs[NL80211_ATTR_PEER_AID])
4392                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4393         else
4394                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4395         if (!params.aid || params.aid > IEEE80211_MAX_AID)
4396                 return -EINVAL;
4397
4398         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4399                 params.capability =
4400                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4401                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4402         }
4403
4404         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4405                 params.ext_capab =
4406                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4407                 params.ext_capab_len =
4408                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4409         }
4410
4411         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4412                 params.ht_capa =
4413                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4414
4415         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4416                 params.vht_capa =
4417                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4418
4419         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
4420                 params.opmode_notif_used = true;
4421                 params.opmode_notif =
4422                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
4423         }
4424
4425         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4426                 params.plink_action =
4427                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4428                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4429                         return -EINVAL;
4430         }
4431
4432         err = nl80211_parse_sta_channel_info(info, &params);
4433         if (err)
4434                 return err;
4435
4436         err = nl80211_parse_sta_wme(info, &params);
4437         if (err)
4438                 return err;
4439
4440         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4441                 return -EINVAL;
4442
4443         /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
4444          * as userspace might just pass through the capabilities from the IEs
4445          * directly, rather than enforcing this restriction and returning an
4446          * error in this case.
4447          */
4448         if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
4449                 params.ht_capa = NULL;
4450                 params.vht_capa = NULL;
4451         }
4452
4453         /* When you run into this, adjust the code below for the new flag */
4454         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4455
4456         switch (dev->ieee80211_ptr->iftype) {
4457         case NL80211_IFTYPE_AP:
4458         case NL80211_IFTYPE_AP_VLAN:
4459         case NL80211_IFTYPE_P2P_GO:
4460                 /* ignore WME attributes if iface/sta is not capable */
4461                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
4462                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
4463                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4464
4465                 /* TDLS peers cannot be added */
4466                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4467                     info->attrs[NL80211_ATTR_PEER_AID])
4468                         return -EINVAL;
4469                 /* but don't bother the driver with it */
4470                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4471
4472                 /* allow authenticated/associated only if driver handles it */
4473                 if (!(rdev->wiphy.features &
4474                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4475                     params.sta_flags_mask & auth_assoc)
4476                         return -EINVAL;
4477
4478                 /* Older userspace, or userspace wanting to be compatible with
4479                  * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
4480                  * and assoc flags in the mask, but assumes the station will be
4481                  * added as associated anyway since this was the required driver
4482                  * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
4483                  * introduced.
4484                  * In order to not bother drivers with this quirk in the API
4485                  * set the flags in both the mask and set for new stations in
4486                  * this case.
4487                  */
4488                 if (!(params.sta_flags_mask & auth_assoc)) {
4489                         params.sta_flags_mask |= auth_assoc;
4490                         params.sta_flags_set |= auth_assoc;
4491                 }
4492
4493                 /* must be last in here for error handling */
4494                 params.vlan = get_vlan(info, rdev);
4495                 if (IS_ERR(params.vlan))
4496                         return PTR_ERR(params.vlan);
4497                 break;
4498         case NL80211_IFTYPE_MESH_POINT:
4499                 /* ignore uAPSD data */
4500                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4501
4502                 /* associated is disallowed */
4503                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
4504                         return -EINVAL;
4505                 /* TDLS peers cannot be added */
4506                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4507                     info->attrs[NL80211_ATTR_PEER_AID])
4508                         return -EINVAL;
4509                 break;
4510         case NL80211_IFTYPE_STATION:
4511         case NL80211_IFTYPE_P2P_CLIENT:
4512                 /* ignore uAPSD data */
4513                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4514
4515                 /* these are disallowed */
4516                 if (params.sta_flags_mask &
4517                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
4518                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4519                         return -EINVAL;
4520                 /* Only TDLS peers can be added */
4521                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4522                         return -EINVAL;
4523                 /* Can only add if TDLS ... */
4524                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
4525                         return -EOPNOTSUPP;
4526                 /* ... with external setup is supported */
4527                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
4528                         return -EOPNOTSUPP;
4529                 /*
4530                  * Older wpa_supplicant versions always mark the TDLS peer
4531                  * as authorized, but it shouldn't yet be.
4532                  */
4533                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4534                 break;
4535         default:
4536                 return -EOPNOTSUPP;
4537         }
4538
4539         /* be aware of params.vlan when changing code here */
4540
4541         err = rdev_add_station(rdev, dev, mac_addr, &params);
4542
4543         if (params.vlan)
4544                 dev_put(params.vlan);
4545         return err;
4546 }
4547
4548 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
4549 {
4550         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4551         struct net_device *dev = info->user_ptr[1];
4552         struct station_del_parameters params;
4553
4554         memset(&params, 0, sizeof(params));
4555
4556         if (info->attrs[NL80211_ATTR_MAC])
4557                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
4558
4559         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4560             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4561             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4562             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4563                 return -EINVAL;
4564
4565         if (!rdev->ops->del_station)
4566                 return -EOPNOTSUPP;
4567
4568         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
4569                 params.subtype =
4570                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
4571                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
4572                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
4573                         return -EINVAL;
4574         } else {
4575                 /* Default to Deauthentication frame */
4576                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
4577         }
4578
4579         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
4580                 params.reason_code =
4581                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4582                 if (params.reason_code == 0)
4583                         return -EINVAL; /* 0 is reserved */
4584         } else {
4585                 /* Default to reason code 2 */
4586                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
4587         }
4588
4589         return rdev_del_station(rdev, dev, &params);
4590 }
4591
4592 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4593                                 int flags, struct net_device *dev,
4594                                 u8 *dst, u8 *next_hop,
4595                                 struct mpath_info *pinfo)
4596 {
4597         void *hdr;
4598         struct nlattr *pinfoattr;
4599
4600         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
4601         if (!hdr)
4602                 return -1;
4603
4604         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4605             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
4606             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
4607             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
4608                 goto nla_put_failure;
4609
4610         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
4611         if (!pinfoattr)
4612                 goto nla_put_failure;
4613         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
4614             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
4615                         pinfo->frame_qlen))
4616                 goto nla_put_failure;
4617         if (((pinfo->filled & MPATH_INFO_SN) &&
4618              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
4619             ((pinfo->filled & MPATH_INFO_METRIC) &&
4620              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
4621                          pinfo->metric)) ||
4622             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
4623              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
4624                          pinfo->exptime)) ||
4625             ((pinfo->filled & MPATH_INFO_FLAGS) &&
4626              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
4627                         pinfo->flags)) ||
4628             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
4629              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
4630                          pinfo->discovery_timeout)) ||
4631             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
4632              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
4633                         pinfo->discovery_retries)))
4634                 goto nla_put_failure;
4635
4636         nla_nest_end(msg, pinfoattr);
4637
4638         genlmsg_end(msg, hdr);
4639         return 0;
4640
4641  nla_put_failure:
4642         genlmsg_cancel(msg, hdr);
4643         return -EMSGSIZE;
4644 }
4645
4646 static int nl80211_dump_mpath(struct sk_buff *skb,
4647                               struct netlink_callback *cb)
4648 {
4649         struct mpath_info pinfo;
4650         struct cfg80211_registered_device *rdev;
4651         struct wireless_dev *wdev;
4652         u8 dst[ETH_ALEN];
4653         u8 next_hop[ETH_ALEN];
4654         int path_idx = cb->args[2];
4655         int err;
4656
4657         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4658         if (err)
4659                 return err;
4660
4661         if (!rdev->ops->dump_mpath) {
4662                 err = -EOPNOTSUPP;
4663                 goto out_err;
4664         }
4665
4666         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4667                 err = -EOPNOTSUPP;
4668                 goto out_err;
4669         }
4670
4671         while (1) {
4672                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
4673                                       next_hop, &pinfo);
4674                 if (err == -ENOENT)
4675                         break;
4676                 if (err)
4677                         goto out_err;
4678
4679                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4680                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4681                                        wdev->netdev, dst, next_hop,
4682                                        &pinfo) < 0)
4683                         goto out;
4684
4685                 path_idx++;
4686         }
4687
4688
4689  out:
4690         cb->args[2] = path_idx;
4691         err = skb->len;
4692  out_err:
4693         nl80211_finish_wdev_dump(rdev);
4694         return err;
4695 }
4696
4697 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
4698 {
4699         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4700         int err;
4701         struct net_device *dev = info->user_ptr[1];
4702         struct mpath_info pinfo;
4703         struct sk_buff *msg;
4704         u8 *dst = NULL;
4705         u8 next_hop[ETH_ALEN];
4706
4707         memset(&pinfo, 0, sizeof(pinfo));
4708
4709         if (!info->attrs[NL80211_ATTR_MAC])
4710                 return -EINVAL;
4711
4712         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4713
4714         if (!rdev->ops->get_mpath)
4715                 return -EOPNOTSUPP;
4716
4717         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4718                 return -EOPNOTSUPP;
4719
4720         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4721         if (err)
4722                 return err;
4723
4724         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4725         if (!msg)
4726                 return -ENOMEM;
4727
4728         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4729                                  dev, dst, next_hop, &pinfo) < 0) {
4730                 nlmsg_free(msg);
4731                 return -ENOBUFS;
4732         }
4733
4734         return genlmsg_reply(msg, info);
4735 }
4736
4737 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
4738 {
4739         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4740         struct net_device *dev = info->user_ptr[1];
4741         u8 *dst = NULL;
4742         u8 *next_hop = NULL;
4743
4744         if (!info->attrs[NL80211_ATTR_MAC])
4745                 return -EINVAL;
4746
4747         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4748                 return -EINVAL;
4749
4750         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4751         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4752
4753         if (!rdev->ops->change_mpath)
4754                 return -EOPNOTSUPP;
4755
4756         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4757                 return -EOPNOTSUPP;
4758
4759         return rdev_change_mpath(rdev, dev, dst, next_hop);
4760 }
4761
4762 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
4763 {
4764         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4765         struct net_device *dev = info->user_ptr[1];
4766         u8 *dst = NULL;
4767         u8 *next_hop = NULL;
4768
4769         if (!info->attrs[NL80211_ATTR_MAC])
4770                 return -EINVAL;
4771
4772         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4773                 return -EINVAL;
4774
4775         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4776         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4777
4778         if (!rdev->ops->add_mpath)
4779                 return -EOPNOTSUPP;
4780
4781         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4782                 return -EOPNOTSUPP;
4783
4784         return rdev_add_mpath(rdev, dev, dst, next_hop);
4785 }
4786
4787 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
4788 {
4789         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4790         struct net_device *dev = info->user_ptr[1];
4791         u8 *dst = NULL;
4792
4793         if (info->attrs[NL80211_ATTR_MAC])
4794                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4795
4796         if (!rdev->ops->del_mpath)
4797                 return -EOPNOTSUPP;
4798
4799         return rdev_del_mpath(rdev, dev, dst);
4800 }
4801
4802 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
4803 {
4804         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4805         int err;
4806         struct net_device *dev = info->user_ptr[1];
4807         struct mpath_info pinfo;
4808         struct sk_buff *msg;
4809         u8 *dst = NULL;
4810         u8 mpp[ETH_ALEN];
4811
4812         memset(&pinfo, 0, sizeof(pinfo));
4813
4814         if (!info->attrs[NL80211_ATTR_MAC])
4815                 return -EINVAL;
4816
4817         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4818
4819         if (!rdev->ops->get_mpp)
4820                 return -EOPNOTSUPP;
4821
4822         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4823                 return -EOPNOTSUPP;
4824
4825         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
4826         if (err)
4827                 return err;
4828
4829         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4830         if (!msg)
4831                 return -ENOMEM;
4832
4833         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4834                                dev, dst, mpp, &pinfo) < 0) {
4835                 nlmsg_free(msg);
4836                 return -ENOBUFS;
4837         }
4838
4839         return genlmsg_reply(msg, info);
4840 }
4841
4842 static int nl80211_dump_mpp(struct sk_buff *skb,
4843                             struct netlink_callback *cb)
4844 {
4845         struct mpath_info pinfo;
4846         struct cfg80211_registered_device *rdev;
4847         struct wireless_dev *wdev;
4848         u8 dst[ETH_ALEN];
4849         u8 mpp[ETH_ALEN];
4850         int path_idx = cb->args[2];
4851         int err;
4852
4853         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4854         if (err)
4855                 return err;
4856
4857         if (!rdev->ops->dump_mpp) {
4858                 err = -EOPNOTSUPP;
4859                 goto out_err;
4860         }
4861
4862         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4863                 err = -EOPNOTSUPP;
4864                 goto out_err;
4865         }
4866
4867         while (1) {
4868                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
4869                                     mpp, &pinfo);
4870                 if (err == -ENOENT)
4871                         break;
4872                 if (err)
4873                         goto out_err;
4874
4875                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4876                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4877                                        wdev->netdev, dst, mpp,
4878                                        &pinfo) < 0)
4879                         goto out;
4880
4881                 path_idx++;
4882         }
4883
4884  out:
4885         cb->args[2] = path_idx;
4886         err = skb->len;
4887  out_err:
4888         nl80211_finish_wdev_dump(rdev);
4889         return err;
4890 }
4891
4892 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
4893 {
4894         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4895         struct net_device *dev = info->user_ptr[1];
4896         struct wireless_dev *wdev = dev->ieee80211_ptr;
4897         struct bss_parameters params;
4898         int err;
4899
4900         memset(&params, 0, sizeof(params));
4901         /* default to not changing parameters */
4902         params.use_cts_prot = -1;
4903         params.use_short_preamble = -1;
4904         params.use_short_slot_time = -1;
4905         params.ap_isolate = -1;
4906         params.ht_opmode = -1;
4907         params.p2p_ctwindow = -1;
4908         params.p2p_opp_ps = -1;
4909
4910         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
4911                 params.use_cts_prot =
4912                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
4913         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
4914                 params.use_short_preamble =
4915                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
4916         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
4917                 params.use_short_slot_time =
4918                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4919         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4920                 params.basic_rates =
4921                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4922                 params.basic_rates_len =
4923                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4924         }
4925         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
4926                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4927         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
4928                 params.ht_opmode =
4929                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4930
4931         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4932                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4933                         return -EINVAL;
4934                 params.p2p_ctwindow =
4935                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4936                 if (params.p2p_ctwindow < 0)
4937                         return -EINVAL;
4938                 if (params.p2p_ctwindow != 0 &&
4939                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4940                         return -EINVAL;
4941         }
4942
4943         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4944                 u8 tmp;
4945
4946                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4947                         return -EINVAL;
4948                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4949                 if (tmp > 1)
4950                         return -EINVAL;
4951                 params.p2p_opp_ps = tmp;
4952                 if (params.p2p_opp_ps &&
4953                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4954                         return -EINVAL;
4955         }
4956
4957         if (!rdev->ops->change_bss)
4958                 return -EOPNOTSUPP;
4959
4960         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4961             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4962                 return -EOPNOTSUPP;
4963
4964         wdev_lock(wdev);
4965         err = rdev_change_bss(rdev, dev, &params);
4966         wdev_unlock(wdev);
4967
4968         return err;
4969 }
4970
4971 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
4972 {
4973         char *data = NULL;
4974         bool is_indoor;
4975         enum nl80211_user_reg_hint_type user_reg_hint_type;
4976         u32 owner_nlportid;
4977
4978
4979         /*
4980          * You should only get this when cfg80211 hasn't yet initialized
4981          * completely when built-in to the kernel right between the time
4982          * window between nl80211_init() and regulatory_init(), if that is
4983          * even possible.
4984          */
4985         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4986                 return -EINPROGRESS;
4987
4988         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
4989                 user_reg_hint_type =
4990                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
4991         else
4992                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
4993
4994         switch (user_reg_hint_type) {
4995         case NL80211_USER_REG_HINT_USER:
4996         case NL80211_USER_REG_HINT_CELL_BASE:
4997                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4998                         return -EINVAL;
4999
5000                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5001                 return regulatory_hint_user(data, user_reg_hint_type);
5002         case NL80211_USER_REG_HINT_INDOOR:
5003                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
5004                         owner_nlportid = info->snd_portid;
5005                         is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
5006                 } else {
5007                         owner_nlportid = 0;
5008                         is_indoor = true;
5009                 }
5010
5011                 return regulatory_hint_indoor(is_indoor, owner_nlportid);
5012         default:
5013                 return -EINVAL;
5014         }
5015 }
5016
5017 static int nl80211_get_mesh_config(struct sk_buff *skb,
5018                                    struct genl_info *info)
5019 {
5020         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5021         struct net_device *dev = info->user_ptr[1];
5022         struct wireless_dev *wdev = dev->ieee80211_ptr;
5023         struct mesh_config cur_params;
5024         int err = 0;
5025         void *hdr;
5026         struct nlattr *pinfoattr;
5027         struct sk_buff *msg;
5028
5029         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5030                 return -EOPNOTSUPP;
5031
5032         if (!rdev->ops->get_mesh_config)
5033                 return -EOPNOTSUPP;
5034
5035         wdev_lock(wdev);
5036         /* If not connected, get default parameters */
5037         if (!wdev->mesh_id_len)
5038                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
5039         else
5040                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
5041         wdev_unlock(wdev);
5042
5043         if (err)
5044                 return err;
5045
5046         /* Draw up a netlink message to send back */
5047         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5048         if (!msg)
5049                 return -ENOMEM;
5050         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5051                              NL80211_CMD_GET_MESH_CONFIG);
5052         if (!hdr)
5053                 goto out;
5054         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
5055         if (!pinfoattr)
5056                 goto nla_put_failure;
5057         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5058             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
5059                         cur_params.dot11MeshRetryTimeout) ||
5060             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5061                         cur_params.dot11MeshConfirmTimeout) ||
5062             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
5063                         cur_params.dot11MeshHoldingTimeout) ||
5064             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
5065                         cur_params.dot11MeshMaxPeerLinks) ||
5066             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
5067                        cur_params.dot11MeshMaxRetries) ||
5068             nla_put_u8(msg, NL80211_MESHCONF_TTL,
5069                        cur_params.dot11MeshTTL) ||
5070             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
5071                        cur_params.element_ttl) ||
5072             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5073                        cur_params.auto_open_plinks) ||
5074             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5075                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
5076             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5077                        cur_params.dot11MeshHWMPmaxPREQretries) ||
5078             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
5079                         cur_params.path_refresh_time) ||
5080             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5081                         cur_params.min_discovery_timeout) ||
5082             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5083                         cur_params.dot11MeshHWMPactivePathTimeout) ||
5084             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5085                         cur_params.dot11MeshHWMPpreqMinInterval) ||
5086             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5087                         cur_params.dot11MeshHWMPperrMinInterval) ||
5088             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5089                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
5090             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
5091                        cur_params.dot11MeshHWMPRootMode) ||
5092             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5093                         cur_params.dot11MeshHWMPRannInterval) ||
5094             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5095                        cur_params.dot11MeshGateAnnouncementProtocol) ||
5096             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
5097                        cur_params.dot11MeshForwarding) ||
5098             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
5099                         cur_params.rssi_threshold) ||
5100             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
5101                         cur_params.ht_opmode) ||
5102             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5103                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
5104             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5105                         cur_params.dot11MeshHWMProotInterval) ||
5106             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5107                         cur_params.dot11MeshHWMPconfirmationInterval) ||
5108             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
5109                         cur_params.power_mode) ||
5110             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
5111                         cur_params.dot11MeshAwakeWindowDuration) ||
5112             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
5113                         cur_params.plink_timeout))
5114                 goto nla_put_failure;
5115         nla_nest_end(msg, pinfoattr);
5116         genlmsg_end(msg, hdr);
5117         return genlmsg_reply(msg, info);
5118
5119  nla_put_failure:
5120         genlmsg_cancel(msg, hdr);
5121  out:
5122         nlmsg_free(msg);
5123         return -ENOBUFS;
5124 }
5125
5126 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
5127         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
5128         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
5129         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
5130         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
5131         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
5132         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
5133         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
5134         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
5135         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
5136         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
5137         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
5138         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
5139         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
5140         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
5141         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
5142         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
5143         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
5144         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
5145         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
5146         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
5147         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
5148         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
5149         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
5150         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
5151         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
5152         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
5153         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
5154         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
5155 };
5156
5157 static const struct nla_policy
5158         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
5159         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
5160         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
5161         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
5162         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
5163         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
5164         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
5165         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
5166                                     .len = IEEE80211_MAX_DATA_LEN },
5167         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
5168 };
5169
5170 static int nl80211_parse_mesh_config(struct genl_info *info,
5171                                      struct mesh_config *cfg,
5172                                      u32 *mask_out)
5173 {
5174         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
5175         u32 mask = 0;
5176
5177 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
5178 do {                                                                        \
5179         if (tb[attr]) {                                                     \
5180                 if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
5181                         return -EINVAL;                                     \
5182                 cfg->param = fn(tb[attr]);                                  \
5183                 mask |= (1 << (attr - 1));                                  \
5184         }                                                                   \
5185 } while (0)
5186
5187
5188         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
5189                 return -EINVAL;
5190         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
5191                              info->attrs[NL80211_ATTR_MESH_CONFIG],
5192                              nl80211_meshconf_params_policy))
5193                 return -EINVAL;
5194
5195         /* This makes sure that there aren't more than 32 mesh config
5196          * parameters (otherwise our bitfield scheme would not work.) */
5197         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
5198
5199         /* Fill in the params struct */
5200         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
5201                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
5202                                   nla_get_u16);
5203         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
5204                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5205                                   nla_get_u16);
5206         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
5207                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
5208                                   nla_get_u16);
5209         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
5210                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
5211                                   nla_get_u16);
5212         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
5213                                   mask, NL80211_MESHCONF_MAX_RETRIES,
5214                                   nla_get_u8);
5215         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
5216                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
5217         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
5218                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
5219                                   nla_get_u8);
5220         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
5221                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5222                                   nla_get_u8);
5223         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
5224                                   1, 255, mask,
5225                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5226                                   nla_get_u32);
5227         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
5228                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5229                                   nla_get_u8);
5230         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
5231                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
5232                                   nla_get_u32);
5233         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
5234                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5235                                   nla_get_u16);
5236         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
5237                                   1, 65535, mask,
5238                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5239                                   nla_get_u32);
5240         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
5241                                   1, 65535, mask,
5242                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5243                                   nla_get_u16);
5244         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
5245                                   1, 65535, mask,
5246                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5247                                   nla_get_u16);
5248         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5249                                   dot11MeshHWMPnetDiameterTraversalTime,
5250                                   1, 65535, mask,
5251                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5252                                   nla_get_u16);
5253         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
5254                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
5255                                   nla_get_u8);
5256         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
5257                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5258                                   nla_get_u16);
5259         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5260                                   dot11MeshGateAnnouncementProtocol, 0, 1,
5261                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5262                                   nla_get_u8);
5263         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
5264                                   mask, NL80211_MESHCONF_FORWARDING,
5265                                   nla_get_u8);
5266         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
5267                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
5268                                   nla_get_s32);
5269         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
5270                                   mask, NL80211_MESHCONF_HT_OPMODE,
5271                                   nla_get_u16);
5272         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
5273                                   1, 65535, mask,
5274                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5275                                   nla_get_u32);
5276         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
5277                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5278                                   nla_get_u16);
5279         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5280                                   dot11MeshHWMPconfirmationInterval,
5281                                   1, 65535, mask,
5282                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5283                                   nla_get_u16);
5284         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
5285                                   NL80211_MESH_POWER_ACTIVE,
5286                                   NL80211_MESH_POWER_MAX,
5287                                   mask, NL80211_MESHCONF_POWER_MODE,
5288                                   nla_get_u32);
5289         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
5290                                   0, 65535, mask,
5291                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
5292         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 0, 0xffffffff,
5293                                   mask, NL80211_MESHCONF_PLINK_TIMEOUT,
5294                                   nla_get_u32);
5295         if (mask_out)
5296                 *mask_out = mask;
5297
5298         return 0;
5299
5300 #undef FILL_IN_MESH_PARAM_IF_SET
5301 }
5302
5303 static int nl80211_parse_mesh_setup(struct genl_info *info,
5304                                      struct mesh_setup *setup)
5305 {
5306         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5307         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
5308
5309         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
5310                 return -EINVAL;
5311         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
5312                              info->attrs[NL80211_ATTR_MESH_SETUP],
5313                              nl80211_mesh_setup_params_policy))
5314                 return -EINVAL;
5315
5316         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
5317                 setup->sync_method =
5318                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
5319                  IEEE80211_SYNC_METHOD_VENDOR :
5320                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
5321
5322         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
5323                 setup->path_sel_proto =
5324                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
5325                  IEEE80211_PATH_PROTOCOL_VENDOR :
5326                  IEEE80211_PATH_PROTOCOL_HWMP;
5327
5328         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
5329                 setup->path_metric =
5330                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
5331                  IEEE80211_PATH_METRIC_VENDOR :
5332                  IEEE80211_PATH_METRIC_AIRTIME;
5333
5334
5335         if (tb[NL80211_MESH_SETUP_IE]) {
5336                 struct nlattr *ieattr =
5337                         tb[NL80211_MESH_SETUP_IE];
5338                 if (!is_valid_ie_attr(ieattr))
5339                         return -EINVAL;
5340                 setup->ie = nla_data(ieattr);
5341                 setup->ie_len = nla_len(ieattr);
5342         }
5343         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
5344             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
5345                 return -EINVAL;
5346         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
5347         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
5348         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
5349         if (setup->is_secure)
5350                 setup->user_mpm = true;
5351
5352         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
5353                 if (!setup->user_mpm)
5354                         return -EINVAL;
5355                 setup->auth_id =
5356                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
5357         }
5358
5359         return 0;
5360 }
5361
5362 static int nl80211_update_mesh_config(struct sk_buff *skb,
5363                                       struct genl_info *info)
5364 {
5365         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5366         struct net_device *dev = info->user_ptr[1];
5367         struct wireless_dev *wdev = dev->ieee80211_ptr;
5368         struct mesh_config cfg;
5369         u32 mask;
5370         int err;
5371
5372         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5373                 return -EOPNOTSUPP;
5374
5375         if (!rdev->ops->update_mesh_config)
5376                 return -EOPNOTSUPP;
5377
5378         err = nl80211_parse_mesh_config(info, &cfg, &mask);
5379         if (err)
5380                 return err;
5381
5382         wdev_lock(wdev);
5383         if (!wdev->mesh_id_len)
5384                 err = -ENOLINK;
5385
5386         if (!err)
5387                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
5388
5389         wdev_unlock(wdev);
5390
5391         return err;
5392 }
5393
5394 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
5395                               struct sk_buff *msg)
5396 {
5397         struct nlattr *nl_reg_rules;
5398         unsigned int i;
5399
5400         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
5401             (regdom->dfs_region &&
5402              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
5403                 goto nla_put_failure;
5404
5405         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
5406         if (!nl_reg_rules)
5407                 goto nla_put_failure;
5408
5409         for (i = 0; i < regdom->n_reg_rules; i++) {
5410                 struct nlattr *nl_reg_rule;
5411                 const struct ieee80211_reg_rule *reg_rule;
5412                 const struct ieee80211_freq_range *freq_range;
5413                 const struct ieee80211_power_rule *power_rule;
5414                 unsigned int max_bandwidth_khz;
5415
5416                 reg_rule = &regdom->reg_rules[i];
5417                 freq_range = &reg_rule->freq_range;
5418                 power_rule = &reg_rule->power_rule;
5419
5420                 nl_reg_rule = nla_nest_start(msg, i);
5421                 if (!nl_reg_rule)
5422                         goto nla_put_failure;
5423
5424                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
5425                 if (!max_bandwidth_khz)
5426                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
5427                                                                   reg_rule);
5428
5429                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
5430                                 reg_rule->flags) ||
5431                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
5432                                 freq_range->start_freq_khz) ||
5433                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
5434                                 freq_range->end_freq_khz) ||
5435                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
5436                                 max_bandwidth_khz) ||
5437                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
5438                                 power_rule->max_antenna_gain) ||
5439                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
5440                                 power_rule->max_eirp) ||
5441                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
5442                                 reg_rule->dfs_cac_ms))
5443                         goto nla_put_failure;
5444
5445                 nla_nest_end(msg, nl_reg_rule);
5446         }
5447
5448         nla_nest_end(msg, nl_reg_rules);
5449         return 0;
5450
5451 nla_put_failure:
5452         return -EMSGSIZE;
5453 }
5454
5455 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
5456 {
5457         const struct ieee80211_regdomain *regdom = NULL;
5458         struct cfg80211_registered_device *rdev;
5459         struct wiphy *wiphy = NULL;
5460         struct sk_buff *msg;
5461         void *hdr;
5462
5463         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5464         if (!msg)
5465                 return -ENOBUFS;
5466
5467         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5468                              NL80211_CMD_GET_REG);
5469         if (!hdr)
5470                 goto put_failure;
5471
5472         if (info->attrs[NL80211_ATTR_WIPHY]) {
5473                 bool self_managed;
5474
5475                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
5476                 if (IS_ERR(rdev)) {
5477                         nlmsg_free(msg);
5478                         return PTR_ERR(rdev);
5479                 }
5480
5481                 wiphy = &rdev->wiphy;
5482                 self_managed = wiphy->regulatory_flags &
5483                                REGULATORY_WIPHY_SELF_MANAGED;
5484                 regdom = get_wiphy_regdom(wiphy);
5485
5486                 /* a self-managed-reg device must have a private regdom */
5487                 if (WARN_ON(!regdom && self_managed)) {
5488                         nlmsg_free(msg);
5489                         return -EINVAL;
5490                 }
5491
5492                 if (regdom &&
5493                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
5494                         goto nla_put_failure;
5495         }
5496
5497         if (!wiphy && reg_last_request_cell_base() &&
5498             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
5499                         NL80211_USER_REG_HINT_CELL_BASE))
5500                 goto nla_put_failure;
5501
5502         rcu_read_lock();
5503
5504         if (!regdom)
5505                 regdom = rcu_dereference(cfg80211_regdomain);
5506
5507         if (nl80211_put_regdom(regdom, msg))
5508                 goto nla_put_failure_rcu;
5509
5510         rcu_read_unlock();
5511
5512         genlmsg_end(msg, hdr);
5513         return genlmsg_reply(msg, info);
5514
5515 nla_put_failure_rcu:
5516         rcu_read_unlock();
5517 nla_put_failure:
5518         genlmsg_cancel(msg, hdr);
5519 put_failure:
5520         nlmsg_free(msg);
5521         return -EMSGSIZE;
5522 }
5523
5524 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
5525                                u32 seq, int flags, struct wiphy *wiphy,
5526                                const struct ieee80211_regdomain *regdom)
5527 {
5528         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
5529                                    NL80211_CMD_GET_REG);
5530
5531         if (!hdr)
5532                 return -1;
5533
5534         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
5535
5536         if (nl80211_put_regdom(regdom, msg))
5537                 goto nla_put_failure;
5538
5539         if (!wiphy && reg_last_request_cell_base() &&
5540             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
5541                         NL80211_USER_REG_HINT_CELL_BASE))
5542                 goto nla_put_failure;
5543
5544         if (wiphy &&
5545             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
5546                 goto nla_put_failure;
5547
5548         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
5549             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
5550                 goto nla_put_failure;
5551
5552         genlmsg_end(msg, hdr);
5553         return 0;
5554
5555 nla_put_failure:
5556         genlmsg_cancel(msg, hdr);
5557         return -EMSGSIZE;
5558 }
5559
5560 static int nl80211_get_reg_dump(struct sk_buff *skb,
5561                                 struct netlink_callback *cb)
5562 {
5563         const struct ieee80211_regdomain *regdom = NULL;
5564         struct cfg80211_registered_device *rdev;
5565         int err, reg_idx, start = cb->args[2];
5566
5567         rtnl_lock();
5568
5569         if (cfg80211_regdomain && start == 0) {
5570                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
5571                                           NLM_F_MULTI, NULL,
5572                                           rtnl_dereference(cfg80211_regdomain));
5573                 if (err < 0)
5574                         goto out_err;
5575         }
5576
5577         /* the global regdom is idx 0 */
5578         reg_idx = 1;
5579         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
5580                 regdom = get_wiphy_regdom(&rdev->wiphy);
5581                 if (!regdom)
5582                         continue;
5583
5584                 if (++reg_idx <= start)
5585                         continue;
5586
5587                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
5588                                           NLM_F_MULTI, &rdev->wiphy, regdom);
5589                 if (err < 0) {
5590                         reg_idx--;
5591                         break;
5592                 }
5593         }
5594
5595         cb->args[2] = reg_idx;
5596         err = skb->len;
5597 out_err:
5598         rtnl_unlock();
5599         return err;
5600 }
5601
5602 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
5603 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
5604         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
5605         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
5606         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
5607         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
5608         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
5609         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
5610         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
5611 };
5612
5613 static int parse_reg_rule(struct nlattr *tb[],
5614         struct ieee80211_reg_rule *reg_rule)
5615 {
5616         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
5617         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
5618
5619         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
5620                 return -EINVAL;
5621         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
5622                 return -EINVAL;
5623         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
5624                 return -EINVAL;
5625         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
5626                 return -EINVAL;
5627         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
5628                 return -EINVAL;
5629
5630         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
5631
5632         freq_range->start_freq_khz =
5633                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
5634         freq_range->end_freq_khz =
5635                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
5636         freq_range->max_bandwidth_khz =
5637                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
5638
5639         power_rule->max_eirp =
5640                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
5641
5642         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
5643                 power_rule->max_antenna_gain =
5644                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
5645
5646         if (tb[NL80211_ATTR_DFS_CAC_TIME])
5647                 reg_rule->dfs_cac_ms =
5648                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
5649
5650         return 0;
5651 }
5652
5653 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
5654 {
5655         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
5656         struct nlattr *nl_reg_rule;
5657         char *alpha2;
5658         int rem_reg_rules, r;
5659         u32 num_rules = 0, rule_idx = 0, size_of_regd;
5660         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
5661         struct ieee80211_regdomain *rd;
5662
5663         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5664                 return -EINVAL;
5665
5666         if (!info->attrs[NL80211_ATTR_REG_RULES])
5667                 return -EINVAL;
5668
5669         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5670
5671         if (info->attrs[NL80211_ATTR_DFS_REGION])
5672                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
5673
5674         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5675                             rem_reg_rules) {
5676                 num_rules++;
5677                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
5678                         return -EINVAL;
5679         }
5680
5681         if (!reg_is_valid_request(alpha2))
5682                 return -EINVAL;
5683
5684         size_of_regd = sizeof(struct ieee80211_regdomain) +
5685                        num_rules * sizeof(struct ieee80211_reg_rule);
5686
5687         rd = kzalloc(size_of_regd, GFP_KERNEL);
5688         if (!rd)
5689                 return -ENOMEM;
5690
5691         rd->n_reg_rules = num_rules;
5692         rd->alpha2[0] = alpha2[0];
5693         rd->alpha2[1] = alpha2[1];
5694
5695         /*
5696          * Disable DFS master mode if the DFS region was
5697          * not supported or known on this kernel.
5698          */
5699         if (reg_supported_dfs_region(dfs_region))
5700                 rd->dfs_region = dfs_region;
5701
5702         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5703                             rem_reg_rules) {
5704                 r = nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
5705                               nla_data(nl_reg_rule), nla_len(nl_reg_rule),
5706                               reg_rule_policy);
5707                 if (r)
5708                         goto bad_reg;
5709                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
5710                 if (r)
5711                         goto bad_reg;
5712
5713                 rule_idx++;
5714
5715                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
5716                         r = -EINVAL;
5717                         goto bad_reg;
5718                 }
5719         }
5720
5721         r = set_regdom(rd, REGD_SOURCE_CRDA);
5722         /* set_regdom took ownership */
5723         rd = NULL;
5724
5725  bad_reg:
5726         kfree(rd);
5727         return r;
5728 }
5729 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
5730
5731 static int validate_scan_freqs(struct nlattr *freqs)
5732 {
5733         struct nlattr *attr1, *attr2;
5734         int n_channels = 0, tmp1, tmp2;
5735
5736         nla_for_each_nested(attr1, freqs, tmp1) {
5737                 n_channels++;
5738                 /*
5739                  * Some hardware has a limited channel list for
5740                  * scanning, and it is pretty much nonsensical
5741                  * to scan for a channel twice, so disallow that
5742                  * and don't require drivers to check that the
5743                  * channel list they get isn't longer than what
5744                  * they can scan, as long as they can scan all
5745                  * the channels they registered at once.
5746                  */
5747                 nla_for_each_nested(attr2, freqs, tmp2)
5748                         if (attr1 != attr2 &&
5749                             nla_get_u32(attr1) == nla_get_u32(attr2))
5750                                 return 0;
5751         }
5752
5753         return n_channels;
5754 }
5755
5756 static int nl80211_parse_random_mac(struct nlattr **attrs,
5757                                     u8 *mac_addr, u8 *mac_addr_mask)
5758 {
5759         int i;
5760
5761         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
5762                 eth_zero_addr(mac_addr);
5763                 eth_zero_addr(mac_addr_mask);
5764                 mac_addr[0] = 0x2;
5765                 mac_addr_mask[0] = 0x3;
5766
5767                 return 0;
5768         }
5769
5770         /* need both or none */
5771         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
5772                 return -EINVAL;
5773
5774         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
5775         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
5776
5777         /* don't allow or configure an mcast address */
5778         if (!is_multicast_ether_addr(mac_addr_mask) ||
5779             is_multicast_ether_addr(mac_addr))
5780                 return -EINVAL;
5781
5782         /*
5783          * allow users to pass a MAC address that has bits set outside
5784          * of the mask, but don't bother drivers with having to deal
5785          * with such bits
5786          */
5787         for (i = 0; i < ETH_ALEN; i++)
5788                 mac_addr[i] &= mac_addr_mask[i];
5789
5790         return 0;
5791 }
5792
5793 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
5794 {
5795         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5796         struct wireless_dev *wdev = info->user_ptr[1];
5797         struct cfg80211_scan_request *request;
5798         struct nlattr *attr;
5799         struct wiphy *wiphy;
5800         int err, tmp, n_ssids = 0, n_channels, i;
5801         size_t ie_len;
5802
5803         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5804                 return -EINVAL;
5805
5806         wiphy = &rdev->wiphy;
5807
5808         if (!rdev->ops->scan)
5809                 return -EOPNOTSUPP;
5810
5811         if (rdev->scan_req || rdev->scan_msg) {
5812                 err = -EBUSY;
5813                 goto unlock;
5814         }
5815
5816         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5817                 n_channels = validate_scan_freqs(
5818                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5819                 if (!n_channels) {
5820                         err = -EINVAL;
5821                         goto unlock;
5822                 }
5823         } else {
5824                 n_channels = ieee80211_get_num_supported_channels(wiphy);
5825         }
5826
5827         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5828                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
5829                         n_ssids++;
5830
5831         if (n_ssids > wiphy->max_scan_ssids) {
5832                 err = -EINVAL;
5833                 goto unlock;
5834         }
5835
5836         if (info->attrs[NL80211_ATTR_IE])
5837                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5838         else
5839                 ie_len = 0;
5840
5841         if (ie_len > wiphy->max_scan_ie_len) {
5842                 err = -EINVAL;
5843                 goto unlock;
5844         }
5845
5846         request = kzalloc(sizeof(*request)
5847                         + sizeof(*request->ssids) * n_ssids
5848                         + sizeof(*request->channels) * n_channels
5849                         + ie_len, GFP_KERNEL);
5850         if (!request) {
5851                 err = -ENOMEM;
5852                 goto unlock;
5853         }
5854
5855         if (n_ssids)
5856                 request->ssids = (void *)&request->channels[n_channels];
5857         request->n_ssids = n_ssids;
5858         if (ie_len) {
5859                 if (n_ssids)
5860                         request->ie = (void *)(request->ssids + n_ssids);
5861                 else
5862                         request->ie = (void *)(request->channels + n_channels);
5863         }
5864
5865         i = 0;
5866         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5867                 /* user specified, bail out if channel not found */
5868                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
5869                         struct ieee80211_channel *chan;
5870
5871                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5872
5873                         if (!chan) {
5874                                 err = -EINVAL;
5875                                 goto out_free;
5876                         }
5877
5878                         /* ignore disabled channels */
5879                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5880                                 continue;
5881
5882                         request->channels[i] = chan;
5883                         i++;
5884                 }
5885         } else {
5886                 enum ieee80211_band band;
5887
5888                 /* all channels */
5889                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5890                         int j;
5891                         if (!wiphy->bands[band])
5892                                 continue;
5893                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5894                                 struct ieee80211_channel *chan;
5895
5896                                 chan = &wiphy->bands[band]->channels[j];
5897
5898                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5899                                         continue;
5900
5901                                 request->channels[i] = chan;
5902                                 i++;
5903                         }
5904                 }
5905         }
5906
5907         if (!i) {
5908                 err = -EINVAL;
5909                 goto out_free;
5910         }
5911
5912         request->n_channels = i;
5913
5914         i = 0;
5915         if (n_ssids) {
5916                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
5917                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5918                                 err = -EINVAL;
5919                                 goto out_free;
5920                         }
5921                         request->ssids[i].ssid_len = nla_len(attr);
5922                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
5923                         i++;
5924                 }
5925         }
5926
5927         if (info->attrs[NL80211_ATTR_IE]) {
5928                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5929                 memcpy((void *)request->ie,
5930                        nla_data(info->attrs[NL80211_ATTR_IE]),
5931                        request->ie_len);
5932         }
5933
5934         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
5935                 if (wiphy->bands[i])
5936                         request->rates[i] =
5937                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
5938
5939         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
5940                 nla_for_each_nested(attr,
5941                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
5942                                     tmp) {
5943                         enum ieee80211_band band = nla_type(attr);
5944
5945                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
5946                                 err = -EINVAL;
5947                                 goto out_free;
5948                         }
5949
5950                         if (!wiphy->bands[band])
5951                                 continue;
5952
5953                         err = ieee80211_get_ratemask(wiphy->bands[band],
5954                                                      nla_data(attr),
5955                                                      nla_len(attr),
5956                                                      &request->rates[band]);
5957                         if (err)
5958                                 goto out_free;
5959                 }
5960         }
5961
5962         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5963                 request->flags = nla_get_u32(
5964                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5965                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5966                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
5967                         err = -EOPNOTSUPP;
5968                         goto out_free;
5969                 }
5970
5971                 if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
5972                         if (!(wiphy->features &
5973                                         NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR)) {
5974                                 err = -EOPNOTSUPP;
5975                                 goto out_free;
5976                         }
5977
5978                         if (wdev->current_bss) {
5979                                 err = -EOPNOTSUPP;
5980                                 goto out_free;
5981                         }
5982
5983                         err = nl80211_parse_random_mac(info->attrs,
5984                                                        request->mac_addr,
5985                                                        request->mac_addr_mask);
5986                         if (err)
5987                                 goto out_free;
5988                 }
5989         }
5990
5991         request->no_cck =
5992                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
5993
5994         request->wdev = wdev;
5995         request->wiphy = &rdev->wiphy;
5996         request->scan_start = jiffies;
5997
5998         rdev->scan_req = request;
5999         err = rdev_scan(rdev, request);
6000
6001         if (!err) {
6002                 nl80211_send_scan_start(rdev, wdev);
6003                 if (wdev->netdev)
6004                         dev_hold(wdev->netdev);
6005         } else {
6006  out_free:
6007                 rdev->scan_req = NULL;
6008                 kfree(request);
6009         }
6010
6011  unlock:
6012         return err;
6013 }
6014
6015 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
6016 {
6017         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6018         struct wireless_dev *wdev = info->user_ptr[1];
6019
6020         if (!rdev->ops->abort_scan)
6021                 return -EOPNOTSUPP;
6022
6023         if (rdev->scan_msg)
6024                 return 0;
6025
6026         if (!rdev->scan_req)
6027                 return -ENOENT;
6028
6029         rdev_abort_scan(rdev, wdev);
6030         return 0;
6031 }
6032
6033 static int
6034 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
6035                                struct cfg80211_sched_scan_request *request,
6036                                struct nlattr **attrs)
6037 {
6038         int tmp, err, i = 0;
6039         struct nlattr *attr;
6040
6041         if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
6042                 u32 interval;
6043
6044                 /*
6045                  * If scan plans are not specified,
6046                  * %NL80211_ATTR_SCHED_SCAN_INTERVAL must be specified. In this
6047                  * case one scan plan will be set with the specified scan
6048                  * interval and infinite number of iterations.
6049                  */
6050                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
6051                         return -EINVAL;
6052
6053                 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
6054                 if (!interval)
6055                         return -EINVAL;
6056
6057                 request->scan_plans[0].interval =
6058                         DIV_ROUND_UP(interval, MSEC_PER_SEC);
6059                 if (!request->scan_plans[0].interval)
6060                         return -EINVAL;
6061
6062                 if (request->scan_plans[0].interval >
6063                     wiphy->max_sched_scan_plan_interval)
6064                         request->scan_plans[0].interval =
6065                                 wiphy->max_sched_scan_plan_interval;
6066
6067                 return 0;
6068         }
6069
6070         nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
6071                 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
6072
6073                 if (WARN_ON(i >= n_plans))
6074                         return -EINVAL;
6075
6076                 err = nla_parse(plan, NL80211_SCHED_SCAN_PLAN_MAX,
6077                                 nla_data(attr), nla_len(attr),
6078                                 nl80211_plan_policy);
6079                 if (err)
6080                         return err;
6081
6082                 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
6083                         return -EINVAL;
6084
6085                 request->scan_plans[i].interval =
6086                         nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
6087                 if (!request->scan_plans[i].interval ||
6088                     request->scan_plans[i].interval >
6089                     wiphy->max_sched_scan_plan_interval)
6090                         return -EINVAL;
6091
6092                 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
6093                         request->scan_plans[i].iterations =
6094                                 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
6095                         if (!request->scan_plans[i].iterations ||
6096                             (request->scan_plans[i].iterations >
6097                              wiphy->max_sched_scan_plan_iterations))
6098                                 return -EINVAL;
6099                 } else if (i < n_plans - 1) {
6100                         /*
6101                          * All scan plans but the last one must specify
6102                          * a finite number of iterations
6103                          */
6104                         return -EINVAL;
6105                 }
6106
6107                 i++;
6108         }
6109
6110         /*
6111          * The last scan plan must not specify the number of
6112          * iterations, it is supposed to run infinitely
6113          */
6114         if (request->scan_plans[n_plans - 1].iterations)
6115                 return  -EINVAL;
6116
6117         return 0;
6118 }
6119
6120 static struct cfg80211_sched_scan_request *
6121 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
6122                          struct nlattr **attrs)
6123 {
6124         struct cfg80211_sched_scan_request *request;
6125         struct nlattr *attr;
6126         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
6127         enum ieee80211_band band;
6128         size_t ie_len;
6129         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
6130         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
6131
6132         if (!is_valid_ie_attr(attrs[NL80211_ATTR_IE]))
6133                 return ERR_PTR(-EINVAL);
6134
6135         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6136                 n_channels = validate_scan_freqs(
6137                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
6138                 if (!n_channels)
6139                         return ERR_PTR(-EINVAL);
6140         } else {
6141                 n_channels = ieee80211_get_num_supported_channels(wiphy);
6142         }
6143
6144         if (attrs[NL80211_ATTR_SCAN_SSIDS])
6145                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
6146                                     tmp)
6147                         n_ssids++;
6148
6149         if (n_ssids > wiphy->max_sched_scan_ssids)
6150                 return ERR_PTR(-EINVAL);
6151
6152         /*
6153          * First, count the number of 'real' matchsets. Due to an issue with
6154          * the old implementation, matchsets containing only the RSSI attribute
6155          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
6156          * RSSI for all matchsets, rather than their own matchset for reporting
6157          * all APs with a strong RSSI. This is needed to be compatible with
6158          * older userspace that treated a matchset with only the RSSI as the
6159          * global RSSI for all other matchsets - if there are other matchsets.
6160          */
6161         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
6162                 nla_for_each_nested(attr,
6163                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
6164                                     tmp) {
6165                         struct nlattr *rssi;
6166
6167                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
6168                                         nla_data(attr), nla_len(attr),
6169                                         nl80211_match_policy);
6170                         if (err)
6171                                 return ERR_PTR(err);
6172                         /* add other standalone attributes here */
6173                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]) {
6174                                 n_match_sets++;
6175                                 continue;
6176                         }
6177                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
6178                         if (rssi)
6179                                 default_match_rssi = nla_get_s32(rssi);
6180                 }
6181         }
6182
6183         /* However, if there's no other matchset, add the RSSI one */
6184         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
6185                 n_match_sets = 1;
6186
6187         if (n_match_sets > wiphy->max_match_sets)
6188                 return ERR_PTR(-EINVAL);
6189
6190         if (attrs[NL80211_ATTR_IE])
6191                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
6192         else
6193                 ie_len = 0;
6194
6195         if (ie_len > wiphy->max_sched_scan_ie_len)
6196                 return ERR_PTR(-EINVAL);
6197
6198         if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
6199                 /*
6200                  * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
6201                  * each scan plan already specifies its own interval
6202                  */
6203                 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
6204                         return ERR_PTR(-EINVAL);
6205
6206                 nla_for_each_nested(attr,
6207                                     attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
6208                         n_plans++;
6209         } else {
6210                 /*
6211                  * The scan interval attribute is kept for backward
6212                  * compatibility. If no scan plans are specified and sched scan
6213                  * interval is specified, one scan plan will be set with this
6214                  * scan interval and infinite number of iterations.
6215                  */
6216                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
6217                         return ERR_PTR(-EINVAL);
6218
6219                 n_plans = 1;
6220         }
6221
6222         if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
6223                 return ERR_PTR(-EINVAL);
6224
6225         request = kzalloc(sizeof(*request)
6226                         + sizeof(*request->ssids) * n_ssids
6227                         + sizeof(*request->match_sets) * n_match_sets
6228                         + sizeof(*request->scan_plans) * n_plans
6229                         + sizeof(*request->channels) * n_channels
6230                         + ie_len, GFP_KERNEL);
6231         if (!request)
6232                 return ERR_PTR(-ENOMEM);
6233
6234         if (n_ssids)
6235                 request->ssids = (void *)&request->channels[n_channels];
6236         request->n_ssids = n_ssids;
6237         if (ie_len) {
6238                 if (n_ssids)
6239                         request->ie = (void *)(request->ssids + n_ssids);
6240                 else
6241                         request->ie = (void *)(request->channels + n_channels);
6242         }
6243
6244         if (n_match_sets) {
6245                 if (request->ie)
6246                         request->match_sets = (void *)(request->ie + ie_len);
6247                 else if (n_ssids)
6248                         request->match_sets =
6249                                 (void *)(request->ssids + n_ssids);
6250                 else
6251                         request->match_sets =
6252                                 (void *)(request->channels + n_channels);
6253         }
6254         request->n_match_sets = n_match_sets;
6255
6256         if (n_match_sets)
6257                 request->scan_plans = (void *)(request->match_sets +
6258                                                n_match_sets);
6259         else if (request->ie)
6260                 request->scan_plans = (void *)(request->ie + ie_len);
6261         else if (n_ssids)
6262                 request->scan_plans = (void *)(request->ssids + n_ssids);
6263         else
6264                 request->scan_plans = (void *)(request->channels + n_channels);
6265
6266         request->n_scan_plans = n_plans;
6267
6268         i = 0;
6269         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6270                 /* user specified, bail out if channel not found */
6271                 nla_for_each_nested(attr,
6272                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
6273                                     tmp) {
6274                         struct ieee80211_channel *chan;
6275
6276                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
6277
6278                         if (!chan) {
6279                                 err = -EINVAL;
6280                                 goto out_free;
6281                         }
6282
6283                         /* ignore disabled channels */
6284                         if (chan->flags & IEEE80211_CHAN_DISABLED)
6285                                 continue;
6286
6287                         request->channels[i] = chan;
6288                         i++;
6289                 }
6290         } else {
6291                 /* all channels */
6292                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
6293                         int j;
6294                         if (!wiphy->bands[band])
6295                                 continue;
6296                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
6297                                 struct ieee80211_channel *chan;
6298
6299                                 chan = &wiphy->bands[band]->channels[j];
6300
6301                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
6302                                         continue;
6303
6304                                 request->channels[i] = chan;
6305                                 i++;
6306                         }
6307                 }
6308         }
6309
6310         if (!i) {
6311                 err = -EINVAL;
6312                 goto out_free;
6313         }
6314
6315         request->n_channels = i;
6316
6317         i = 0;
6318         if (n_ssids) {
6319                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
6320                                     tmp) {
6321                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
6322                                 err = -EINVAL;
6323                                 goto out_free;
6324                         }
6325                         request->ssids[i].ssid_len = nla_len(attr);
6326                         memcpy(request->ssids[i].ssid, nla_data(attr),
6327                                nla_len(attr));
6328                         i++;
6329                 }
6330         }
6331
6332         i = 0;
6333         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
6334                 nla_for_each_nested(attr,
6335                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
6336                                     tmp) {
6337                         struct nlattr *ssid, *rssi;
6338
6339                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
6340                                         nla_data(attr), nla_len(attr),
6341                                         nl80211_match_policy);
6342                         if (err)
6343                                 goto out_free;
6344                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
6345                         if (ssid) {
6346                                 if (WARN_ON(i >= n_match_sets)) {
6347                                         /* this indicates a programming error,
6348                                          * the loop above should have verified
6349                                          * things properly
6350                                          */
6351                                         err = -EINVAL;
6352                                         goto out_free;
6353                                 }
6354
6355                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
6356                                         err = -EINVAL;
6357                                         goto out_free;
6358                                 }
6359                                 memcpy(request->match_sets[i].ssid.ssid,
6360                                        nla_data(ssid), nla_len(ssid));
6361                                 request->match_sets[i].ssid.ssid_len =
6362                                         nla_len(ssid);
6363                                 /* special attribute - old implemenation w/a */
6364                                 request->match_sets[i].rssi_thold =
6365                                         default_match_rssi;
6366                                 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
6367                                 if (rssi)
6368                                         request->match_sets[i].rssi_thold =
6369                                                 nla_get_s32(rssi);
6370                         }
6371                         i++;
6372                 }
6373
6374                 /* there was no other matchset, so the RSSI one is alone */
6375                 if (i == 0 && n_match_sets)
6376                         request->match_sets[0].rssi_thold = default_match_rssi;
6377
6378                 request->min_rssi_thold = INT_MAX;
6379                 for (i = 0; i < n_match_sets; i++)
6380                         request->min_rssi_thold =
6381                                 min(request->match_sets[i].rssi_thold,
6382                                     request->min_rssi_thold);
6383         } else {
6384                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
6385         }
6386
6387         if (ie_len) {
6388                 request->ie_len = ie_len;
6389                 memcpy((void *)request->ie,
6390                        nla_data(attrs[NL80211_ATTR_IE]),
6391                        request->ie_len);
6392         }
6393
6394         if (attrs[NL80211_ATTR_SCAN_FLAGS]) {
6395                 request->flags = nla_get_u32(
6396                         attrs[NL80211_ATTR_SCAN_FLAGS]);
6397                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
6398                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
6399                         err = -EOPNOTSUPP;
6400                         goto out_free;
6401                 }
6402
6403                 if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
6404                         u32 flg = NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
6405
6406                         if (!wdev) /* must be net-detect */
6407                                 flg = NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
6408
6409                         if (!(wiphy->features & flg)) {
6410                                 err = -EOPNOTSUPP;
6411                                 goto out_free;
6412                         }
6413
6414                         if (wdev && wdev->current_bss) {
6415                                 err = -EOPNOTSUPP;
6416                                 goto out_free;
6417                         }
6418
6419                         err = nl80211_parse_random_mac(attrs, request->mac_addr,
6420                                                        request->mac_addr_mask);
6421                         if (err)
6422                                 goto out_free;
6423                 }
6424         }
6425
6426         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
6427                 request->delay =
6428                         nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
6429
6430         err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
6431         if (err)
6432                 goto out_free;
6433
6434         request->scan_start = jiffies;
6435
6436         return request;
6437
6438 out_free:
6439         kfree(request);
6440         return ERR_PTR(err);
6441 }
6442
6443 static int nl80211_start_sched_scan(struct sk_buff *skb,
6444                                     struct genl_info *info)
6445 {
6446         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6447         struct net_device *dev = info->user_ptr[1];
6448         struct wireless_dev *wdev = dev->ieee80211_ptr;
6449         struct cfg80211_sched_scan_request *sched_scan_req;
6450         int err;
6451
6452         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
6453             !rdev->ops->sched_scan_start)
6454                 return -EOPNOTSUPP;
6455
6456         if (rdev->sched_scan_req)
6457                 return -EINPROGRESS;
6458
6459         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
6460                                                   info->attrs);
6461
6462         err = PTR_ERR_OR_ZERO(sched_scan_req);
6463         if (err)
6464                 goto out_err;
6465
6466         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
6467         if (err)
6468                 goto out_free;
6469
6470         sched_scan_req->dev = dev;
6471         sched_scan_req->wiphy = &rdev->wiphy;
6472
6473         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
6474                 sched_scan_req->owner_nlportid = info->snd_portid;
6475
6476         rcu_assign_pointer(rdev->sched_scan_req, sched_scan_req);
6477
6478         nl80211_send_sched_scan(rdev, dev,
6479                                 NL80211_CMD_START_SCHED_SCAN);
6480         return 0;
6481
6482 out_free:
6483         kfree(sched_scan_req);
6484 out_err:
6485         return err;
6486 }
6487
6488 static int nl80211_stop_sched_scan(struct sk_buff *skb,
6489                                    struct genl_info *info)
6490 {
6491         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6492
6493         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
6494             !rdev->ops->sched_scan_stop)
6495                 return -EOPNOTSUPP;
6496
6497         return __cfg80211_stop_sched_scan(rdev, false);
6498 }
6499
6500 static int nl80211_start_radar_detection(struct sk_buff *skb,
6501                                          struct genl_info *info)
6502 {
6503         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6504         struct net_device *dev = info->user_ptr[1];
6505         struct wireless_dev *wdev = dev->ieee80211_ptr;
6506         struct cfg80211_chan_def chandef;
6507         enum nl80211_dfs_regions dfs_region;
6508         unsigned int cac_time_ms;
6509         int err;
6510
6511         dfs_region = reg_get_dfs_region(wdev->wiphy);
6512         if (dfs_region == NL80211_DFS_UNSET)
6513                 return -EINVAL;
6514
6515         err = nl80211_parse_chandef(rdev, info, &chandef);
6516         if (err)
6517                 return err;
6518
6519         if (netif_carrier_ok(dev))
6520                 return -EBUSY;
6521
6522         if (wdev->cac_started)
6523                 return -EBUSY;
6524
6525         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef,
6526                                             wdev->iftype);
6527         if (err < 0)
6528                 return err;
6529
6530         if (err == 0)
6531                 return -EINVAL;
6532
6533         if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef))
6534                 return -EINVAL;
6535
6536         if (!rdev->ops->start_radar_detection)
6537                 return -EOPNOTSUPP;
6538
6539         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
6540         if (WARN_ON(!cac_time_ms))
6541                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
6542
6543         err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
6544         if (!err) {
6545                 wdev->chandef = chandef;
6546                 wdev->cac_started = true;
6547                 wdev->cac_start_time = jiffies;
6548                 wdev->cac_time_ms = cac_time_ms;
6549         }
6550         return err;
6551 }
6552
6553 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
6554 {
6555         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6556         struct net_device *dev = info->user_ptr[1];
6557         struct wireless_dev *wdev = dev->ieee80211_ptr;
6558         struct cfg80211_csa_settings params;
6559         /* csa_attrs is defined static to avoid waste of stack size - this
6560          * function is called under RTNL lock, so this should not be a problem.
6561          */
6562         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
6563         int err;
6564         bool need_new_beacon = false;
6565         int len, i;
6566         u32 cs_count;
6567
6568         if (!rdev->ops->channel_switch ||
6569             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
6570                 return -EOPNOTSUPP;
6571
6572         switch (dev->ieee80211_ptr->iftype) {
6573         case NL80211_IFTYPE_AP:
6574         case NL80211_IFTYPE_P2P_GO:
6575                 need_new_beacon = true;
6576
6577                 /* useless if AP is not running */
6578                 if (!wdev->beacon_interval)
6579                         return -ENOTCONN;
6580                 break;
6581         case NL80211_IFTYPE_ADHOC:
6582                 if (!wdev->ssid_len)
6583                         return -ENOTCONN;
6584                 break;
6585         case NL80211_IFTYPE_MESH_POINT:
6586                 if (!wdev->mesh_id_len)
6587                         return -ENOTCONN;
6588                 break;
6589         default:
6590                 return -EOPNOTSUPP;
6591         }
6592
6593         memset(&params, 0, sizeof(params));
6594
6595         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
6596             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
6597                 return -EINVAL;
6598
6599         /* only important for AP, IBSS and mesh create IEs internally */
6600         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
6601                 return -EINVAL;
6602
6603         /* Even though the attribute is u32, the specification says
6604          * u8, so let's make sure we don't overflow.
6605          */
6606         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
6607         if (cs_count > 255)
6608                 return -EINVAL;
6609
6610         params.count = cs_count;
6611
6612         if (!need_new_beacon)
6613                 goto skip_beacons;
6614
6615         err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
6616         if (err)
6617                 return err;
6618
6619         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
6620                                info->attrs[NL80211_ATTR_CSA_IES],
6621                                nl80211_policy);
6622         if (err)
6623                 return err;
6624
6625         err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
6626         if (err)
6627                 return err;
6628
6629         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
6630                 return -EINVAL;
6631
6632         len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
6633         if (!len || (len % sizeof(u16)))
6634                 return -EINVAL;
6635
6636         params.n_counter_offsets_beacon = len / sizeof(u16);
6637         if (rdev->wiphy.max_num_csa_counters &&
6638             (params.n_counter_offsets_beacon >
6639              rdev->wiphy.max_num_csa_counters))
6640                 return -EINVAL;
6641
6642         params.counter_offsets_beacon =
6643                 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
6644
6645         /* sanity checks - counters should fit and be the same */
6646         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
6647                 u16 offset = params.counter_offsets_beacon[i];
6648
6649                 if (offset >= params.beacon_csa.tail_len)
6650                         return -EINVAL;
6651
6652                 if (params.beacon_csa.tail[offset] != params.count)
6653                         return -EINVAL;
6654         }
6655
6656         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
6657                 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
6658                 if (!len || (len % sizeof(u16)))
6659                         return -EINVAL;
6660
6661                 params.n_counter_offsets_presp = len / sizeof(u16);
6662                 if (rdev->wiphy.max_num_csa_counters &&
6663                     (params.n_counter_offsets_beacon >
6664                      rdev->wiphy.max_num_csa_counters))
6665                         return -EINVAL;
6666
6667                 params.counter_offsets_presp =
6668                         nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
6669
6670                 /* sanity checks - counters should fit and be the same */
6671                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
6672                         u16 offset = params.counter_offsets_presp[i];
6673
6674                         if (offset >= params.beacon_csa.probe_resp_len)
6675                                 return -EINVAL;
6676
6677                         if (params.beacon_csa.probe_resp[offset] !=
6678                             params.count)
6679                                 return -EINVAL;
6680                 }
6681         }
6682
6683 skip_beacons:
6684         err = nl80211_parse_chandef(rdev, info, &params.chandef);
6685         if (err)
6686                 return err;
6687
6688         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
6689                                            wdev->iftype))
6690                 return -EINVAL;
6691
6692         err = cfg80211_chandef_dfs_required(wdev->wiphy,
6693                                             &params.chandef,
6694                                             wdev->iftype);
6695         if (err < 0)
6696                 return err;
6697
6698         if (err > 0)
6699                 params.radar_required = true;
6700
6701         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
6702                 params.block_tx = true;
6703
6704         wdev_lock(wdev);
6705         err = rdev_channel_switch(rdev, dev, &params);
6706         wdev_unlock(wdev);
6707
6708         return err;
6709 }
6710
6711 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
6712                             u32 seq, int flags,
6713                             struct cfg80211_registered_device *rdev,
6714                             struct wireless_dev *wdev,
6715                             struct cfg80211_internal_bss *intbss)
6716 {
6717         struct cfg80211_bss *res = &intbss->pub;
6718         const struct cfg80211_bss_ies *ies;
6719         void *hdr;
6720         struct nlattr *bss;
6721
6722         ASSERT_WDEV_LOCK(wdev);
6723
6724         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6725                              NL80211_CMD_NEW_SCAN_RESULTS);
6726         if (!hdr)
6727                 return -1;
6728
6729         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
6730
6731         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
6732                 goto nla_put_failure;
6733         if (wdev->netdev &&
6734             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
6735                 goto nla_put_failure;
6736         if (nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
6737                 goto nla_put_failure;
6738
6739         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
6740         if (!bss)
6741                 goto nla_put_failure;
6742         if ((!is_zero_ether_addr(res->bssid) &&
6743              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
6744                 goto nla_put_failure;
6745
6746         rcu_read_lock();
6747         /* indicate whether we have probe response data or not */
6748         if (rcu_access_pointer(res->proberesp_ies) &&
6749             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
6750                 goto fail_unlock_rcu;
6751
6752         /* this pointer prefers to be pointed to probe response data
6753          * but is always valid
6754          */
6755         ies = rcu_dereference(res->ies);
6756         if (ies) {
6757                 if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
6758                         goto fail_unlock_rcu;
6759                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
6760                                         ies->len, ies->data))
6761                         goto fail_unlock_rcu;
6762         }
6763
6764         /* and this pointer is always (unless driver didn't know) beacon data */
6765         ies = rcu_dereference(res->beacon_ies);
6766         if (ies && ies->from_beacon) {
6767                 if (nla_put_u64(msg, NL80211_BSS_BEACON_TSF, ies->tsf))
6768                         goto fail_unlock_rcu;
6769                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
6770                                         ies->len, ies->data))
6771                         goto fail_unlock_rcu;
6772         }
6773         rcu_read_unlock();
6774
6775         if (res->beacon_interval &&
6776             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
6777                 goto nla_put_failure;
6778         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
6779             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
6780             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
6781             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
6782                         jiffies_to_msecs(jiffies - intbss->ts)))
6783                 goto nla_put_failure;
6784
6785         if (intbss->ts_boottime &&
6786             nla_put_u64(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
6787                         intbss->ts_boottime))
6788                 goto nla_put_failure;
6789
6790         switch (rdev->wiphy.signal_type) {
6791         case CFG80211_SIGNAL_TYPE_MBM:
6792                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
6793                         goto nla_put_failure;
6794                 break;
6795         case CFG80211_SIGNAL_TYPE_UNSPEC:
6796                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
6797                         goto nla_put_failure;
6798                 break;
6799         default:
6800                 break;
6801         }
6802
6803         switch (wdev->iftype) {
6804         case NL80211_IFTYPE_P2P_CLIENT:
6805         case NL80211_IFTYPE_STATION:
6806                 if (intbss == wdev->current_bss &&
6807                     nla_put_u32(msg, NL80211_BSS_STATUS,
6808                                 NL80211_BSS_STATUS_ASSOCIATED))
6809                         goto nla_put_failure;
6810                 break;
6811         case NL80211_IFTYPE_ADHOC:
6812                 if (intbss == wdev->current_bss &&
6813                     nla_put_u32(msg, NL80211_BSS_STATUS,
6814                                 NL80211_BSS_STATUS_IBSS_JOINED))
6815                         goto nla_put_failure;
6816                 break;
6817         default:
6818                 break;
6819         }
6820
6821         nla_nest_end(msg, bss);
6822
6823         genlmsg_end(msg, hdr);
6824         return 0;
6825
6826  fail_unlock_rcu:
6827         rcu_read_unlock();
6828  nla_put_failure:
6829         genlmsg_cancel(msg, hdr);
6830         return -EMSGSIZE;
6831 }
6832
6833 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
6834 {
6835         struct cfg80211_registered_device *rdev;
6836         struct cfg80211_internal_bss *scan;
6837         struct wireless_dev *wdev;
6838         int start = cb->args[2], idx = 0;
6839         int err;
6840
6841         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
6842         if (err)
6843                 return err;
6844
6845         wdev_lock(wdev);
6846         spin_lock_bh(&rdev->bss_lock);
6847         cfg80211_bss_expire(rdev);
6848
6849         cb->seq = rdev->bss_generation;
6850
6851         list_for_each_entry(scan, &rdev->bss_list, list) {
6852                 if (++idx <= start)
6853                         continue;
6854                 if (nl80211_send_bss(skb, cb,
6855                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6856                                 rdev, wdev, scan) < 0) {
6857                         idx--;
6858                         break;
6859                 }
6860         }
6861
6862         spin_unlock_bh(&rdev->bss_lock);
6863         wdev_unlock(wdev);
6864
6865         cb->args[2] = idx;
6866         nl80211_finish_wdev_dump(rdev);
6867
6868         return skb->len;
6869 }
6870
6871 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
6872                                int flags, struct net_device *dev,
6873                                bool allow_radio_stats,
6874                                struct survey_info *survey)
6875 {
6876         void *hdr;
6877         struct nlattr *infoattr;
6878
6879         /* skip radio stats if userspace didn't request them */
6880         if (!survey->channel && !allow_radio_stats)
6881                 return 0;
6882
6883         hdr = nl80211hdr_put(msg, portid, seq, flags,
6884                              NL80211_CMD_NEW_SURVEY_RESULTS);
6885         if (!hdr)
6886                 return -ENOMEM;
6887
6888         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
6889                 goto nla_put_failure;
6890
6891         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
6892         if (!infoattr)
6893                 goto nla_put_failure;
6894
6895         if (survey->channel &&
6896             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
6897                         survey->channel->center_freq))
6898                 goto nla_put_failure;
6899
6900         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
6901             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
6902                 goto nla_put_failure;
6903         if ((survey->filled & SURVEY_INFO_IN_USE) &&
6904             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
6905                 goto nla_put_failure;
6906         if ((survey->filled & SURVEY_INFO_TIME) &&
6907             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME,
6908                         survey->time))
6909                 goto nla_put_failure;
6910         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
6911             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_BUSY,
6912                         survey->time_busy))
6913                 goto nla_put_failure;
6914         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
6915             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
6916                         survey->time_ext_busy))
6917                 goto nla_put_failure;
6918         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
6919             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_RX,
6920                         survey->time_rx))
6921                 goto nla_put_failure;
6922         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
6923             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_TX,
6924                         survey->time_tx))
6925                 goto nla_put_failure;
6926         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
6927             nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_SCAN,
6928                         survey->time_scan))
6929                 goto nla_put_failure;
6930
6931         nla_nest_end(msg, infoattr);
6932
6933         genlmsg_end(msg, hdr);
6934         return 0;
6935
6936  nla_put_failure:
6937         genlmsg_cancel(msg, hdr);
6938         return -EMSGSIZE;
6939 }
6940
6941 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
6942 {
6943         struct survey_info survey;
6944         struct cfg80211_registered_device *rdev;
6945         struct wireless_dev *wdev;
6946         int survey_idx = cb->args[2];
6947         int res;
6948         bool radio_stats;
6949
6950         res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
6951         if (res)
6952                 return res;
6953
6954         /* prepare_wdev_dump parsed the attributes */
6955         radio_stats = nl80211_fam.attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
6956
6957         if (!wdev->netdev) {
6958                 res = -EINVAL;
6959                 goto out_err;
6960         }
6961
6962         if (!rdev->ops->dump_survey) {
6963                 res = -EOPNOTSUPP;
6964                 goto out_err;
6965         }
6966
6967         while (1) {
6968                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
6969                 if (res == -ENOENT)
6970                         break;
6971                 if (res)
6972                         goto out_err;
6973
6974                 /* don't send disabled channels, but do send non-channel data */
6975                 if (survey.channel &&
6976                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
6977                         survey_idx++;
6978                         continue;
6979                 }
6980
6981                 if (nl80211_send_survey(skb,
6982                                 NETLINK_CB(cb->skb).portid,
6983                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6984                                 wdev->netdev, radio_stats, &survey) < 0)
6985                         goto out;
6986                 survey_idx++;
6987         }
6988
6989  out:
6990         cb->args[2] = survey_idx;
6991         res = skb->len;
6992  out_err:
6993         nl80211_finish_wdev_dump(rdev);
6994         return res;
6995 }
6996
6997 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
6998 {
6999         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
7000                                   NL80211_WPA_VERSION_2));
7001 }
7002
7003 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
7004 {
7005         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7006         struct net_device *dev = info->user_ptr[1];
7007         struct ieee80211_channel *chan;
7008         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
7009         int err, ssid_len, ie_len = 0, sae_data_len = 0;
7010         enum nl80211_auth_type auth_type;
7011         struct key_parse key;
7012         bool local_state_change;
7013
7014         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7015                 return -EINVAL;
7016
7017         if (!info->attrs[NL80211_ATTR_MAC])
7018                 return -EINVAL;
7019
7020         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
7021                 return -EINVAL;
7022
7023         if (!info->attrs[NL80211_ATTR_SSID])
7024                 return -EINVAL;
7025
7026         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
7027                 return -EINVAL;
7028
7029         err = nl80211_parse_key(info, &key);
7030         if (err)
7031                 return err;
7032
7033         if (key.idx >= 0) {
7034                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
7035                         return -EINVAL;
7036                 if (!key.p.key || !key.p.key_len)
7037                         return -EINVAL;
7038                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
7039                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
7040                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
7041                      key.p.key_len != WLAN_KEY_LEN_WEP104))
7042                         return -EINVAL;
7043                 if (key.idx > 4)
7044                         return -EINVAL;
7045         } else {
7046                 key.p.key_len = 0;
7047                 key.p.key = NULL;
7048         }
7049
7050         if (key.idx >= 0) {
7051                 int i;
7052                 bool ok = false;
7053                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
7054                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
7055                                 ok = true;
7056                                 break;
7057                         }
7058                 }
7059                 if (!ok)
7060                         return -EINVAL;
7061         }
7062
7063         if (!rdev->ops->auth)
7064                 return -EOPNOTSUPP;
7065
7066         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7067             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7068                 return -EOPNOTSUPP;
7069
7070         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7071         chan = nl80211_get_valid_chan(&rdev->wiphy,
7072                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7073         if (!chan)
7074                 return -EINVAL;
7075
7076         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7077         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7078
7079         if (info->attrs[NL80211_ATTR_IE]) {
7080                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7081                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7082         }
7083
7084         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
7085         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
7086                 return -EINVAL;
7087
7088         if (auth_type == NL80211_AUTHTYPE_SAE &&
7089             !info->attrs[NL80211_ATTR_SAE_DATA])
7090                 return -EINVAL;
7091
7092         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
7093                 if (auth_type != NL80211_AUTHTYPE_SAE)
7094                         return -EINVAL;
7095                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
7096                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
7097                 /* need to include at least Auth Transaction and Status Code */
7098                 if (sae_data_len < 4)
7099                         return -EINVAL;
7100         }
7101
7102         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
7103
7104         /*
7105          * Since we no longer track auth state, ignore
7106          * requests to only change local state.
7107          */
7108         if (local_state_change)
7109                 return 0;
7110
7111         wdev_lock(dev->ieee80211_ptr);
7112         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
7113                                  ssid, ssid_len, ie, ie_len,
7114                                  key.p.key, key.p.key_len, key.idx,
7115                                  sae_data, sae_data_len);
7116         wdev_unlock(dev->ieee80211_ptr);
7117         return err;
7118 }
7119
7120 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
7121                                    struct genl_info *info,
7122                                    struct cfg80211_crypto_settings *settings,
7123                                    int cipher_limit)
7124 {
7125         memset(settings, 0, sizeof(*settings));
7126
7127         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
7128
7129         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
7130                 u16 proto;
7131                 proto = nla_get_u16(
7132                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
7133                 settings->control_port_ethertype = cpu_to_be16(proto);
7134                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
7135                     proto != ETH_P_PAE)
7136                         return -EINVAL;
7137                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
7138                         settings->control_port_no_encrypt = true;
7139         } else
7140                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
7141
7142         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
7143                 void *data;
7144                 int len, i;
7145
7146                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
7147                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
7148                 settings->n_ciphers_pairwise = len / sizeof(u32);
7149
7150                 if (len % sizeof(u32))
7151                         return -EINVAL;
7152
7153                 if (settings->n_ciphers_pairwise > cipher_limit)
7154                         return -EINVAL;
7155
7156                 memcpy(settings->ciphers_pairwise, data, len);
7157
7158                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
7159                         if (!cfg80211_supported_cipher_suite(
7160                                         &rdev->wiphy,
7161                                         settings->ciphers_pairwise[i]))
7162                                 return -EINVAL;
7163         }
7164
7165         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
7166                 settings->cipher_group =
7167                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
7168                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
7169                                                      settings->cipher_group))
7170                         return -EINVAL;
7171         }
7172
7173         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
7174                 settings->wpa_versions =
7175                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
7176                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
7177                         return -EINVAL;
7178         }
7179
7180         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
7181                 void *data;
7182                 int len;
7183
7184                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
7185                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
7186                 settings->n_akm_suites = len / sizeof(u32);
7187
7188                 if (len % sizeof(u32))
7189                         return -EINVAL;
7190
7191                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
7192                         return -EINVAL;
7193
7194                 memcpy(settings->akm_suites, data, len);
7195         }
7196
7197         return 0;
7198 }
7199
7200 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
7201 {
7202         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7203         struct net_device *dev = info->user_ptr[1];
7204         struct ieee80211_channel *chan;
7205         struct cfg80211_assoc_request req = {};
7206         const u8 *bssid, *ssid;
7207         int err, ssid_len = 0;
7208
7209         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7210                 return -EINVAL;
7211
7212         if (!info->attrs[NL80211_ATTR_MAC] ||
7213             !info->attrs[NL80211_ATTR_SSID] ||
7214             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
7215                 return -EINVAL;
7216
7217         if (!rdev->ops->assoc)
7218                 return -EOPNOTSUPP;
7219
7220         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7221             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7222                 return -EOPNOTSUPP;
7223
7224         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7225
7226         chan = nl80211_get_valid_chan(&rdev->wiphy,
7227                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7228         if (!chan)
7229                 return -EINVAL;
7230
7231         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7232         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7233
7234         if (info->attrs[NL80211_ATTR_IE]) {
7235                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7236                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7237         }
7238
7239         if (info->attrs[NL80211_ATTR_USE_MFP]) {
7240                 enum nl80211_mfp mfp =
7241                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
7242                 if (mfp == NL80211_MFP_REQUIRED)
7243                         req.use_mfp = true;
7244                 else if (mfp != NL80211_MFP_NO)
7245                         return -EINVAL;
7246         }
7247
7248         if (info->attrs[NL80211_ATTR_PREV_BSSID])
7249                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
7250
7251         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
7252                 req.flags |= ASSOC_REQ_DISABLE_HT;
7253
7254         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7255                 memcpy(&req.ht_capa_mask,
7256                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7257                        sizeof(req.ht_capa_mask));
7258
7259         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7260                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7261                         return -EINVAL;
7262                 memcpy(&req.ht_capa,
7263                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7264                        sizeof(req.ht_capa));
7265         }
7266
7267         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
7268                 req.flags |= ASSOC_REQ_DISABLE_VHT;
7269
7270         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7271                 memcpy(&req.vht_capa_mask,
7272                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
7273                        sizeof(req.vht_capa_mask));
7274
7275         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
7276                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7277                         return -EINVAL;
7278                 memcpy(&req.vht_capa,
7279                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
7280                        sizeof(req.vht_capa));
7281         }
7282
7283         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
7284                 if (!(rdev->wiphy.features &
7285                       NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) ||
7286                     !(rdev->wiphy.features & NL80211_FEATURE_QUIET))
7287                         return -EINVAL;
7288                 req.flags |= ASSOC_REQ_USE_RRM;
7289         }
7290
7291         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
7292         if (!err) {
7293                 wdev_lock(dev->ieee80211_ptr);
7294                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
7295                                           ssid, ssid_len, &req);
7296                 wdev_unlock(dev->ieee80211_ptr);
7297         }
7298
7299         return err;
7300 }
7301
7302 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
7303 {
7304         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7305         struct net_device *dev = info->user_ptr[1];
7306         const u8 *ie = NULL, *bssid;
7307         int ie_len = 0, err;
7308         u16 reason_code;
7309         bool local_state_change;
7310
7311         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7312                 return -EINVAL;
7313
7314         if (!info->attrs[NL80211_ATTR_MAC])
7315                 return -EINVAL;
7316
7317         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7318                 return -EINVAL;
7319
7320         if (!rdev->ops->deauth)
7321                 return -EOPNOTSUPP;
7322
7323         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7324             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7325                 return -EOPNOTSUPP;
7326
7327         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7328
7329         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7330         if (reason_code == 0) {
7331                 /* Reason Code 0 is reserved */
7332                 return -EINVAL;
7333         }
7334
7335         if (info->attrs[NL80211_ATTR_IE]) {
7336                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7337                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7338         }
7339
7340         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
7341
7342         wdev_lock(dev->ieee80211_ptr);
7343         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
7344                                    local_state_change);
7345         wdev_unlock(dev->ieee80211_ptr);
7346         return err;
7347 }
7348
7349 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
7350 {
7351         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7352         struct net_device *dev = info->user_ptr[1];
7353         const u8 *ie = NULL, *bssid;
7354         int ie_len = 0, err;
7355         u16 reason_code;
7356         bool local_state_change;
7357
7358         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7359                 return -EINVAL;
7360
7361         if (!info->attrs[NL80211_ATTR_MAC])
7362                 return -EINVAL;
7363
7364         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7365                 return -EINVAL;
7366
7367         if (!rdev->ops->disassoc)
7368                 return -EOPNOTSUPP;
7369
7370         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7371             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7372                 return -EOPNOTSUPP;
7373
7374         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7375
7376         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7377         if (reason_code == 0) {
7378                 /* Reason Code 0 is reserved */
7379                 return -EINVAL;
7380         }
7381
7382         if (info->attrs[NL80211_ATTR_IE]) {
7383                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7384                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7385         }
7386
7387         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
7388
7389         wdev_lock(dev->ieee80211_ptr);
7390         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
7391                                      local_state_change);
7392         wdev_unlock(dev->ieee80211_ptr);
7393         return err;
7394 }
7395
7396 static bool
7397 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
7398                          int mcast_rate[IEEE80211_NUM_BANDS],
7399                          int rateval)
7400 {
7401         struct wiphy *wiphy = &rdev->wiphy;
7402         bool found = false;
7403         int band, i;
7404
7405         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
7406                 struct ieee80211_supported_band *sband;
7407
7408                 sband = wiphy->bands[band];
7409                 if (!sband)
7410                         continue;
7411
7412                 for (i = 0; i < sband->n_bitrates; i++) {
7413                         if (sband->bitrates[i].bitrate == rateval) {
7414                                 mcast_rate[band] = i + 1;
7415                                 found = true;
7416                                 break;
7417                         }
7418                 }
7419         }
7420
7421         return found;
7422 }
7423
7424 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
7425 {
7426         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7427         struct net_device *dev = info->user_ptr[1];
7428         struct cfg80211_ibss_params ibss;
7429         struct wiphy *wiphy;
7430         struct cfg80211_cached_keys *connkeys = NULL;
7431         int err;
7432
7433         memset(&ibss, 0, sizeof(ibss));
7434
7435         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7436                 return -EINVAL;
7437
7438         if (!info->attrs[NL80211_ATTR_SSID] ||
7439             !nla_len(info->attrs[NL80211_ATTR_SSID]))
7440                 return -EINVAL;
7441
7442         ibss.beacon_interval = 100;
7443
7444         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
7445                 ibss.beacon_interval =
7446                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
7447                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
7448                         return -EINVAL;
7449         }
7450
7451         if (!rdev->ops->join_ibss)
7452                 return -EOPNOTSUPP;
7453
7454         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
7455                 return -EOPNOTSUPP;
7456
7457         wiphy = &rdev->wiphy;
7458
7459         if (info->attrs[NL80211_ATTR_MAC]) {
7460                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7461
7462                 if (!is_valid_ether_addr(ibss.bssid))
7463                         return -EINVAL;
7464         }
7465         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7466         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7467
7468         if (info->attrs[NL80211_ATTR_IE]) {
7469                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7470                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7471         }
7472
7473         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
7474         if (err)
7475                 return err;
7476
7477         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
7478                                      NL80211_IFTYPE_ADHOC))
7479                 return -EINVAL;
7480
7481         switch (ibss.chandef.width) {
7482         case NL80211_CHAN_WIDTH_5:
7483         case NL80211_CHAN_WIDTH_10:
7484         case NL80211_CHAN_WIDTH_20_NOHT:
7485                 break;
7486         case NL80211_CHAN_WIDTH_20:
7487         case NL80211_CHAN_WIDTH_40:
7488                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
7489                         return -EINVAL;
7490                 break;
7491         case NL80211_CHAN_WIDTH_80:
7492         case NL80211_CHAN_WIDTH_80P80:
7493         case NL80211_CHAN_WIDTH_160:
7494                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
7495                         return -EINVAL;
7496                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
7497                                              NL80211_EXT_FEATURE_VHT_IBSS))
7498                         return -EINVAL;
7499                 break;
7500         default:
7501                 return -EINVAL;
7502         }
7503
7504         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
7505         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
7506
7507         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
7508                 u8 *rates =
7509                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7510                 int n_rates =
7511                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7512                 struct ieee80211_supported_band *sband =
7513                         wiphy->bands[ibss.chandef.chan->band];
7514
7515                 err = ieee80211_get_ratemask(sband, rates, n_rates,
7516                                              &ibss.basic_rates);
7517                 if (err)
7518                         return err;
7519         }
7520
7521         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7522                 memcpy(&ibss.ht_capa_mask,
7523                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7524                        sizeof(ibss.ht_capa_mask));
7525
7526         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7527                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7528                         return -EINVAL;
7529                 memcpy(&ibss.ht_capa,
7530                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7531                        sizeof(ibss.ht_capa));
7532         }
7533
7534         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
7535             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
7536                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
7537                 return -EINVAL;
7538
7539         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
7540                 bool no_ht = false;
7541
7542                 connkeys = nl80211_parse_connkeys(rdev,
7543                                           info->attrs[NL80211_ATTR_KEYS],
7544                                           &no_ht);
7545                 if (IS_ERR(connkeys))
7546                         return PTR_ERR(connkeys);
7547
7548                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
7549                     no_ht) {
7550                         kfree(connkeys);
7551                         return -EINVAL;
7552                 }
7553         }
7554
7555         ibss.control_port =
7556                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
7557
7558         ibss.userspace_handles_dfs =
7559                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
7560
7561         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
7562         if (err)
7563                 kzfree(connkeys);
7564         return err;
7565 }
7566
7567 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
7568 {
7569         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7570         struct net_device *dev = info->user_ptr[1];
7571
7572         if (!rdev->ops->leave_ibss)
7573                 return -EOPNOTSUPP;
7574
7575         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
7576                 return -EOPNOTSUPP;
7577
7578         return cfg80211_leave_ibss(rdev, dev, false);
7579 }
7580
7581 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
7582 {
7583         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7584         struct net_device *dev = info->user_ptr[1];
7585         int mcast_rate[IEEE80211_NUM_BANDS];
7586         u32 nla_rate;
7587         int err;
7588
7589         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
7590             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
7591             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
7592                 return -EOPNOTSUPP;
7593
7594         if (!rdev->ops->set_mcast_rate)
7595                 return -EOPNOTSUPP;
7596
7597         memset(mcast_rate, 0, sizeof(mcast_rate));
7598
7599         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
7600                 return -EINVAL;
7601
7602         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
7603         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
7604                 return -EINVAL;
7605
7606         err = rdev_set_mcast_rate(rdev, dev, mcast_rate);
7607
7608         return err;
7609 }
7610
7611 static struct sk_buff *
7612 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
7613                             struct wireless_dev *wdev, int approxlen,
7614                             u32 portid, u32 seq, enum nl80211_commands cmd,
7615                             enum nl80211_attrs attr,
7616                             const struct nl80211_vendor_cmd_info *info,
7617                             gfp_t gfp)
7618 {
7619         struct sk_buff *skb;
7620         void *hdr;
7621         struct nlattr *data;
7622
7623         skb = nlmsg_new(approxlen + 100, gfp);
7624         if (!skb)
7625                 return NULL;
7626
7627         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
7628         if (!hdr) {
7629                 kfree_skb(skb);
7630                 return NULL;
7631         }
7632
7633         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
7634                 goto nla_put_failure;
7635
7636         if (info) {
7637                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
7638                                 info->vendor_id))
7639                         goto nla_put_failure;
7640                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
7641                                 info->subcmd))
7642                         goto nla_put_failure;
7643         }
7644
7645         if (wdev) {
7646                 if (nla_put_u64(skb, NL80211_ATTR_WDEV,
7647                                 wdev_id(wdev)))
7648                         goto nla_put_failure;
7649                 if (wdev->netdev &&
7650                     nla_put_u32(skb, NL80211_ATTR_IFINDEX,
7651                                 wdev->netdev->ifindex))
7652                         goto nla_put_failure;
7653         }
7654
7655         data = nla_nest_start(skb, attr);
7656
7657         ((void **)skb->cb)[0] = rdev;
7658         ((void **)skb->cb)[1] = hdr;
7659         ((void **)skb->cb)[2] = data;
7660
7661         return skb;
7662
7663  nla_put_failure:
7664         kfree_skb(skb);
7665         return NULL;
7666 }
7667
7668 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
7669                                            struct wireless_dev *wdev,
7670                                            enum nl80211_commands cmd,
7671                                            enum nl80211_attrs attr,
7672                                            int vendor_event_idx,
7673                                            int approxlen, gfp_t gfp)
7674 {
7675         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
7676         const struct nl80211_vendor_cmd_info *info;
7677
7678         switch (cmd) {
7679         case NL80211_CMD_TESTMODE:
7680                 if (WARN_ON(vendor_event_idx != -1))
7681                         return NULL;
7682                 info = NULL;
7683                 break;
7684         case NL80211_CMD_VENDOR:
7685                 if (WARN_ON(vendor_event_idx < 0 ||
7686                             vendor_event_idx >= wiphy->n_vendor_events))
7687                         return NULL;
7688                 info = &wiphy->vendor_events[vendor_event_idx];
7689                 break;
7690         default:
7691                 WARN_ON(1);
7692                 return NULL;
7693         }
7694
7695         return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, 0, 0,
7696                                            cmd, attr, info, gfp);
7697 }
7698 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
7699
7700 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
7701 {
7702         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
7703         void *hdr = ((void **)skb->cb)[1];
7704         struct nlattr *data = ((void **)skb->cb)[2];
7705         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
7706
7707         /* clear CB data for netlink core to own from now on */
7708         memset(skb->cb, 0, sizeof(skb->cb));
7709
7710         nla_nest_end(skb, data);
7711         genlmsg_end(skb, hdr);
7712
7713         if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
7714                 mcgrp = NL80211_MCGRP_VENDOR;
7715
7716         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
7717                                 mcgrp, gfp);
7718 }
7719 EXPORT_SYMBOL(__cfg80211_send_event_skb);
7720
7721 #ifdef CONFIG_NL80211_TESTMODE
7722 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
7723 {
7724         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7725         struct wireless_dev *wdev =
7726                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
7727         int err;
7728
7729         if (!rdev->ops->testmode_cmd)
7730                 return -EOPNOTSUPP;
7731
7732         if (IS_ERR(wdev)) {
7733                 err = PTR_ERR(wdev);
7734                 if (err != -EINVAL)
7735                         return err;
7736                 wdev = NULL;
7737         } else if (wdev->wiphy != &rdev->wiphy) {
7738                 return -EINVAL;
7739         }
7740
7741         if (!info->attrs[NL80211_ATTR_TESTDATA])
7742                 return -EINVAL;
7743
7744         rdev->cur_cmd_info = info;
7745         err = rdev_testmode_cmd(rdev, wdev,
7746                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
7747                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
7748         rdev->cur_cmd_info = NULL;
7749
7750         return err;
7751 }
7752
7753 static int nl80211_testmode_dump(struct sk_buff *skb,
7754                                  struct netlink_callback *cb)
7755 {
7756         struct cfg80211_registered_device *rdev;
7757         int err;
7758         long phy_idx;
7759         void *data = NULL;
7760         int data_len = 0;
7761
7762         rtnl_lock();
7763
7764         if (cb->args[0]) {
7765                 /*
7766                  * 0 is a valid index, but not valid for args[0],
7767                  * so we need to offset by 1.
7768                  */
7769                 phy_idx = cb->args[0] - 1;
7770         } else {
7771                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
7772                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
7773                                   nl80211_policy);
7774                 if (err)
7775                         goto out_err;
7776
7777                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
7778                                                   nl80211_fam.attrbuf);
7779                 if (IS_ERR(rdev)) {
7780                         err = PTR_ERR(rdev);
7781                         goto out_err;
7782                 }
7783                 phy_idx = rdev->wiphy_idx;
7784                 rdev = NULL;
7785
7786                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
7787                         cb->args[1] =
7788                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
7789         }
7790
7791         if (cb->args[1]) {
7792                 data = nla_data((void *)cb->args[1]);
7793                 data_len = nla_len((void *)cb->args[1]);
7794         }
7795
7796         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
7797         if (!rdev) {
7798                 err = -ENOENT;
7799                 goto out_err;
7800         }
7801
7802         if (!rdev->ops->testmode_dump) {
7803                 err = -EOPNOTSUPP;
7804                 goto out_err;
7805         }
7806
7807         while (1) {
7808                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
7809                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
7810                                            NL80211_CMD_TESTMODE);
7811                 struct nlattr *tmdata;
7812
7813                 if (!hdr)
7814                         break;
7815
7816                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
7817                         genlmsg_cancel(skb, hdr);
7818                         break;
7819                 }
7820
7821                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
7822                 if (!tmdata) {
7823                         genlmsg_cancel(skb, hdr);
7824                         break;
7825                 }
7826                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
7827                 nla_nest_end(skb, tmdata);
7828
7829                 if (err == -ENOBUFS || err == -ENOENT) {
7830                         genlmsg_cancel(skb, hdr);
7831                         break;
7832                 } else if (err) {
7833                         genlmsg_cancel(skb, hdr);
7834                         goto out_err;
7835                 }
7836
7837                 genlmsg_end(skb, hdr);
7838         }
7839
7840         err = skb->len;
7841         /* see above */
7842         cb->args[0] = phy_idx + 1;
7843  out_err:
7844         rtnl_unlock();
7845         return err;
7846 }
7847 #endif
7848
7849 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
7850 {
7851         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7852         struct net_device *dev = info->user_ptr[1];
7853         struct cfg80211_connect_params connect;
7854         struct wiphy *wiphy;
7855         struct cfg80211_cached_keys *connkeys = NULL;
7856         int err;
7857
7858         memset(&connect, 0, sizeof(connect));
7859
7860         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7861                 return -EINVAL;
7862
7863         if (!info->attrs[NL80211_ATTR_SSID] ||
7864             !nla_len(info->attrs[NL80211_ATTR_SSID]))
7865                 return -EINVAL;
7866
7867         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
7868                 connect.auth_type =
7869                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
7870                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
7871                                              NL80211_CMD_CONNECT))
7872                         return -EINVAL;
7873         } else
7874                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
7875
7876         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
7877
7878         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
7879                                       NL80211_MAX_NR_CIPHER_SUITES);
7880         if (err)
7881                 return err;
7882
7883         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7884             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7885                 return -EOPNOTSUPP;
7886
7887         wiphy = &rdev->wiphy;
7888
7889         connect.bg_scan_period = -1;
7890         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
7891                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
7892                 connect.bg_scan_period =
7893                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
7894         }
7895
7896         if (info->attrs[NL80211_ATTR_MAC])
7897                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7898         else if (info->attrs[NL80211_ATTR_MAC_HINT])
7899                 connect.bssid_hint =
7900                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
7901         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7902         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7903
7904         if (info->attrs[NL80211_ATTR_IE]) {
7905                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7906                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7907         }
7908
7909         if (info->attrs[NL80211_ATTR_USE_MFP]) {
7910                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
7911                 if (connect.mfp != NL80211_MFP_REQUIRED &&
7912                     connect.mfp != NL80211_MFP_NO)
7913                         return -EINVAL;
7914         } else {
7915                 connect.mfp = NL80211_MFP_NO;
7916         }
7917
7918         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7919                 connect.channel = nl80211_get_valid_chan(
7920                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7921                 if (!connect.channel)
7922                         return -EINVAL;
7923         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
7924                 connect.channel_hint = nl80211_get_valid_chan(
7925                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
7926                 if (!connect.channel_hint)
7927                         return -EINVAL;
7928         }
7929
7930         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
7931                 connkeys = nl80211_parse_connkeys(rdev,
7932                                           info->attrs[NL80211_ATTR_KEYS], NULL);
7933                 if (IS_ERR(connkeys))
7934                         return PTR_ERR(connkeys);
7935         }
7936
7937         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
7938                 connect.flags |= ASSOC_REQ_DISABLE_HT;
7939
7940         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7941                 memcpy(&connect.ht_capa_mask,
7942                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7943                        sizeof(connect.ht_capa_mask));
7944
7945         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7946                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
7947                         kzfree(connkeys);
7948                         return -EINVAL;
7949                 }
7950                 memcpy(&connect.ht_capa,
7951                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7952                        sizeof(connect.ht_capa));
7953         }
7954
7955         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
7956                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
7957
7958         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7959                 memcpy(&connect.vht_capa_mask,
7960                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
7961                        sizeof(connect.vht_capa_mask));
7962
7963         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
7964                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
7965                         kzfree(connkeys);
7966                         return -EINVAL;
7967                 }
7968                 memcpy(&connect.vht_capa,
7969                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
7970                        sizeof(connect.vht_capa));
7971         }
7972
7973         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
7974                 if (!(rdev->wiphy.features &
7975                       NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) ||
7976                     !(rdev->wiphy.features & NL80211_FEATURE_QUIET))
7977                         return -EINVAL;
7978                 connect.flags |= ASSOC_REQ_USE_RRM;
7979         }
7980
7981         wdev_lock(dev->ieee80211_ptr);
7982         err = cfg80211_connect(rdev, dev, &connect, connkeys, NULL);
7983         wdev_unlock(dev->ieee80211_ptr);
7984         if (err)
7985                 kzfree(connkeys);
7986         return err;
7987 }
7988
7989 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
7990 {
7991         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7992         struct net_device *dev = info->user_ptr[1];
7993         u16 reason;
7994         int ret;
7995
7996         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7997                 reason = WLAN_REASON_DEAUTH_LEAVING;
7998         else
7999                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8000
8001         if (reason == 0)
8002                 return -EINVAL;
8003
8004         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8005             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8006                 return -EOPNOTSUPP;
8007
8008         wdev_lock(dev->ieee80211_ptr);
8009         ret = cfg80211_disconnect(rdev, dev, reason, true);
8010         wdev_unlock(dev->ieee80211_ptr);
8011         return ret;
8012 }
8013
8014 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
8015 {
8016         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8017         struct net *net;
8018         int err;
8019
8020         if (info->attrs[NL80211_ATTR_PID]) {
8021                 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
8022
8023                 net = get_net_ns_by_pid(pid);
8024         } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
8025                 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
8026
8027                 net = get_net_ns_by_fd(fd);
8028         } else {
8029                 return -EINVAL;
8030         }
8031
8032         if (IS_ERR(net))
8033                 return PTR_ERR(net);
8034
8035         err = 0;
8036
8037         /* check if anything to do */
8038         if (!net_eq(wiphy_net(&rdev->wiphy), net))
8039                 err = cfg80211_switch_netns(rdev, net);
8040
8041         put_net(net);
8042         return err;
8043 }
8044
8045 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
8046 {
8047         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8048         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
8049                         struct cfg80211_pmksa *pmksa) = NULL;
8050         struct net_device *dev = info->user_ptr[1];
8051         struct cfg80211_pmksa pmksa;
8052
8053         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
8054
8055         if (!info->attrs[NL80211_ATTR_MAC])
8056                 return -EINVAL;
8057
8058         if (!info->attrs[NL80211_ATTR_PMKID])
8059                 return -EINVAL;
8060
8061         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
8062         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8063
8064         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8065             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8066                 return -EOPNOTSUPP;
8067
8068         switch (info->genlhdr->cmd) {
8069         case NL80211_CMD_SET_PMKSA:
8070                 rdev_ops = rdev->ops->set_pmksa;
8071                 break;
8072         case NL80211_CMD_DEL_PMKSA:
8073                 rdev_ops = rdev->ops->del_pmksa;
8074                 break;
8075         default:
8076                 WARN_ON(1);
8077                 break;
8078         }
8079
8080         if (!rdev_ops)
8081                 return -EOPNOTSUPP;
8082
8083         return rdev_ops(&rdev->wiphy, dev, &pmksa);
8084 }
8085
8086 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
8087 {
8088         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8089         struct net_device *dev = info->user_ptr[1];
8090
8091         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8092             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8093                 return -EOPNOTSUPP;
8094
8095         if (!rdev->ops->flush_pmksa)
8096                 return -EOPNOTSUPP;
8097
8098         return rdev_flush_pmksa(rdev, dev);
8099 }
8100
8101 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
8102 {
8103         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8104         struct net_device *dev = info->user_ptr[1];
8105         u8 action_code, dialog_token;
8106         u32 peer_capability = 0;
8107         u16 status_code;
8108         u8 *peer;
8109         bool initiator;
8110
8111         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
8112             !rdev->ops->tdls_mgmt)
8113                 return -EOPNOTSUPP;
8114
8115         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
8116             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
8117             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
8118             !info->attrs[NL80211_ATTR_IE] ||
8119             !info->attrs[NL80211_ATTR_MAC])
8120                 return -EINVAL;
8121
8122         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
8123         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
8124         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
8125         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
8126         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
8127         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
8128                 peer_capability =
8129                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
8130
8131         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
8132                               dialog_token, status_code, peer_capability,
8133                               initiator,
8134                               nla_data(info->attrs[NL80211_ATTR_IE]),
8135                               nla_len(info->attrs[NL80211_ATTR_IE]));
8136 }
8137
8138 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
8139 {
8140         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8141         struct net_device *dev = info->user_ptr[1];
8142         enum nl80211_tdls_operation operation;
8143         u8 *peer;
8144
8145         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
8146             !rdev->ops->tdls_oper)
8147                 return -EOPNOTSUPP;
8148
8149         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
8150             !info->attrs[NL80211_ATTR_MAC])
8151                 return -EINVAL;
8152
8153         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
8154         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
8155
8156         return rdev_tdls_oper(rdev, dev, peer, operation);
8157 }
8158
8159 static int nl80211_remain_on_channel(struct sk_buff *skb,
8160                                      struct genl_info *info)
8161 {
8162         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8163         struct wireless_dev *wdev = info->user_ptr[1];
8164         struct cfg80211_chan_def chandef;
8165         struct sk_buff *msg;
8166         void *hdr;
8167         u64 cookie;
8168         u32 duration;
8169         int err;
8170
8171         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
8172             !info->attrs[NL80211_ATTR_DURATION])
8173                 return -EINVAL;
8174
8175         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
8176
8177         if (!rdev->ops->remain_on_channel ||
8178             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
8179                 return -EOPNOTSUPP;
8180
8181         /*
8182          * We should be on that channel for at least a minimum amount of
8183          * time (10ms) but no longer than the driver supports.
8184          */
8185         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
8186             duration > rdev->wiphy.max_remain_on_channel_duration)
8187                 return -EINVAL;
8188
8189         err = nl80211_parse_chandef(rdev, info, &chandef);
8190         if (err)
8191                 return err;
8192
8193         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8194         if (!msg)
8195                 return -ENOMEM;
8196
8197         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8198                              NL80211_CMD_REMAIN_ON_CHANNEL);
8199         if (!hdr) {
8200                 err = -ENOBUFS;
8201                 goto free_msg;
8202         }
8203
8204         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
8205                                      duration, &cookie);
8206
8207         if (err)
8208                 goto free_msg;
8209
8210         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8211                 goto nla_put_failure;
8212
8213         genlmsg_end(msg, hdr);
8214
8215         return genlmsg_reply(msg, info);
8216
8217  nla_put_failure:
8218         err = -ENOBUFS;
8219  free_msg:
8220         nlmsg_free(msg);
8221         return err;
8222 }
8223
8224 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
8225                                             struct genl_info *info)
8226 {
8227         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8228         struct wireless_dev *wdev = info->user_ptr[1];
8229         u64 cookie;
8230
8231         if (!info->attrs[NL80211_ATTR_COOKIE])
8232                 return -EINVAL;
8233
8234         if (!rdev->ops->cancel_remain_on_channel)
8235                 return -EOPNOTSUPP;
8236
8237         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
8238
8239         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
8240 }
8241
8242 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
8243                            u8 *rates, u8 rates_len)
8244 {
8245         u8 i;
8246         u32 mask = 0;
8247
8248         for (i = 0; i < rates_len; i++) {
8249                 int rate = (rates[i] & 0x7f) * 5;
8250                 int ridx;
8251                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
8252                         struct ieee80211_rate *srate =
8253                                 &sband->bitrates[ridx];
8254                         if (rate == srate->bitrate) {
8255                                 mask |= 1 << ridx;
8256                                 break;
8257                         }
8258                 }
8259                 if (ridx == sband->n_bitrates)
8260                         return 0; /* rate not found */
8261         }
8262
8263         return mask;
8264 }
8265
8266 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
8267                                u8 *rates, u8 rates_len,
8268                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
8269 {
8270         u8 i;
8271
8272         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
8273
8274         for (i = 0; i < rates_len; i++) {
8275                 int ridx, rbit;
8276
8277                 ridx = rates[i] / 8;
8278                 rbit = BIT(rates[i] % 8);
8279
8280                 /* check validity */
8281                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
8282                         return false;
8283
8284                 /* check availability */
8285                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
8286                         mcs[ridx] |= rbit;
8287                 else
8288                         return false;
8289         }
8290
8291         return true;
8292 }
8293
8294 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
8295 {
8296         u16 mcs_mask = 0;
8297
8298         switch (vht_mcs_map) {
8299         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
8300                 break;
8301         case IEEE80211_VHT_MCS_SUPPORT_0_7:
8302                 mcs_mask = 0x00FF;
8303                 break;
8304         case IEEE80211_VHT_MCS_SUPPORT_0_8:
8305                 mcs_mask = 0x01FF;
8306                 break;
8307         case IEEE80211_VHT_MCS_SUPPORT_0_9:
8308                 mcs_mask = 0x03FF;
8309                 break;
8310         default:
8311                 break;
8312         }
8313
8314         return mcs_mask;
8315 }
8316
8317 static void vht_build_mcs_mask(u16 vht_mcs_map,
8318                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
8319 {
8320         u8 nss;
8321
8322         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
8323                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
8324                 vht_mcs_map >>= 2;
8325         }
8326 }
8327
8328 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
8329                              struct nl80211_txrate_vht *txrate,
8330                              u16 mcs[NL80211_VHT_NSS_MAX])
8331 {
8332         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
8333         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
8334         u8 i;
8335
8336         if (!sband->vht_cap.vht_supported)
8337                 return false;
8338
8339         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
8340
8341         /* Build vht_mcs_mask from VHT capabilities */
8342         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
8343
8344         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
8345                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
8346                         mcs[i] = txrate->mcs[i];
8347                 else
8348                         return false;
8349         }
8350
8351         return true;
8352 }
8353
8354 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
8355         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
8356                                     .len = NL80211_MAX_SUPP_RATES },
8357         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
8358                                 .len = NL80211_MAX_SUPP_HT_RATES },
8359         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
8360         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
8361 };
8362
8363 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
8364                                        struct genl_info *info)
8365 {
8366         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
8367         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8368         struct cfg80211_bitrate_mask mask;
8369         int rem, i;
8370         struct net_device *dev = info->user_ptr[1];
8371         struct nlattr *tx_rates;
8372         struct ieee80211_supported_band *sband;
8373         u16 vht_tx_mcs_map;
8374
8375         if (!rdev->ops->set_bitrate_mask)
8376                 return -EOPNOTSUPP;
8377
8378         memset(&mask, 0, sizeof(mask));
8379         /* Default to all rates enabled */
8380         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
8381                 sband = rdev->wiphy.bands[i];
8382
8383                 if (!sband)
8384                         continue;
8385
8386                 mask.control[i].legacy = (1 << sband->n_bitrates) - 1;
8387                 memcpy(mask.control[i].ht_mcs,
8388                        sband->ht_cap.mcs.rx_mask,
8389                        sizeof(mask.control[i].ht_mcs));
8390
8391                 if (!sband->vht_cap.vht_supported)
8392                         continue;
8393
8394                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
8395                 vht_build_mcs_mask(vht_tx_mcs_map, mask.control[i].vht_mcs);
8396         }
8397
8398         /* if no rates are given set it back to the defaults */
8399         if (!info->attrs[NL80211_ATTR_TX_RATES])
8400                 goto out;
8401
8402         /*
8403          * The nested attribute uses enum nl80211_band as the index. This maps
8404          * directly to the enum ieee80211_band values used in cfg80211.
8405          */
8406         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
8407         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
8408                 enum ieee80211_band band = nla_type(tx_rates);
8409                 int err;
8410
8411                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
8412                         return -EINVAL;
8413                 sband = rdev->wiphy.bands[band];
8414                 if (sband == NULL)
8415                         return -EINVAL;
8416                 err = nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
8417                                 nla_len(tx_rates), nl80211_txattr_policy);
8418                 if (err)
8419                         return err;
8420                 if (tb[NL80211_TXRATE_LEGACY]) {
8421                         mask.control[band].legacy = rateset_to_mask(
8422                                 sband,
8423                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
8424                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
8425                         if ((mask.control[band].legacy == 0) &&
8426                             nla_len(tb[NL80211_TXRATE_LEGACY]))
8427                                 return -EINVAL;
8428                 }
8429                 if (tb[NL80211_TXRATE_HT]) {
8430                         if (!ht_rateset_to_mask(
8431                                         sband,
8432                                         nla_data(tb[NL80211_TXRATE_HT]),
8433                                         nla_len(tb[NL80211_TXRATE_HT]),
8434                                         mask.control[band].ht_mcs))
8435                                 return -EINVAL;
8436                 }
8437                 if (tb[NL80211_TXRATE_VHT]) {
8438                         if (!vht_set_mcs_mask(
8439                                         sband,
8440                                         nla_data(tb[NL80211_TXRATE_VHT]),
8441                                         mask.control[band].vht_mcs))
8442                                 return -EINVAL;
8443                 }
8444                 if (tb[NL80211_TXRATE_GI]) {
8445                         mask.control[band].gi =
8446                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
8447                         if (mask.control[band].gi > NL80211_TXRATE_FORCE_LGI)
8448                                 return -EINVAL;
8449                 }
8450
8451                 if (mask.control[band].legacy == 0) {
8452                         /* don't allow empty legacy rates if HT or VHT
8453                          * are not even supported.
8454                          */
8455                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
8456                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
8457                                 return -EINVAL;
8458
8459                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
8460                                 if (mask.control[band].ht_mcs[i])
8461                                         goto out;
8462
8463                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
8464                                 if (mask.control[band].vht_mcs[i])
8465                                         goto out;
8466
8467                         /* legacy and mcs rates may not be both empty */
8468                         return -EINVAL;
8469                 }
8470         }
8471
8472 out:
8473         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
8474 }
8475
8476 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
8477 {
8478         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8479         struct wireless_dev *wdev = info->user_ptr[1];
8480         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
8481
8482         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
8483                 return -EINVAL;
8484
8485         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
8486                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
8487
8488         switch (wdev->iftype) {
8489         case NL80211_IFTYPE_STATION:
8490         case NL80211_IFTYPE_ADHOC:
8491         case NL80211_IFTYPE_P2P_CLIENT:
8492         case NL80211_IFTYPE_AP:
8493         case NL80211_IFTYPE_AP_VLAN:
8494         case NL80211_IFTYPE_MESH_POINT:
8495         case NL80211_IFTYPE_P2P_GO:
8496         case NL80211_IFTYPE_P2P_DEVICE:
8497                 break;
8498         default:
8499                 return -EOPNOTSUPP;
8500         }
8501
8502         /* not much point in registering if we can't reply */
8503         if (!rdev->ops->mgmt_tx)
8504                 return -EOPNOTSUPP;
8505
8506         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
8507                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
8508                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
8509 }
8510
8511 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
8512 {
8513         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8514         struct wireless_dev *wdev = info->user_ptr[1];
8515         struct cfg80211_chan_def chandef;
8516         int err;
8517         void *hdr = NULL;
8518         u64 cookie;
8519         struct sk_buff *msg = NULL;
8520         struct cfg80211_mgmt_tx_params params = {
8521                 .dont_wait_for_ack =
8522                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
8523         };
8524
8525         if (!info->attrs[NL80211_ATTR_FRAME])
8526                 return -EINVAL;
8527
8528         if (!rdev->ops->mgmt_tx)
8529                 return -EOPNOTSUPP;
8530
8531         switch (wdev->iftype) {
8532         case NL80211_IFTYPE_P2P_DEVICE:
8533                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
8534                         return -EINVAL;
8535         case NL80211_IFTYPE_STATION:
8536         case NL80211_IFTYPE_ADHOC:
8537         case NL80211_IFTYPE_P2P_CLIENT:
8538         case NL80211_IFTYPE_AP:
8539         case NL80211_IFTYPE_AP_VLAN:
8540         case NL80211_IFTYPE_MESH_POINT:
8541         case NL80211_IFTYPE_P2P_GO:
8542                 break;
8543         default:
8544                 return -EOPNOTSUPP;
8545         }
8546
8547         if (info->attrs[NL80211_ATTR_DURATION]) {
8548                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
8549                         return -EINVAL;
8550                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
8551
8552                 /*
8553                  * We should wait on the channel for at least a minimum amount
8554                  * of time (10ms) but no longer than the driver supports.
8555                  */
8556                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
8557                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
8558                         return -EINVAL;
8559
8560         }
8561
8562         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
8563
8564         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
8565                 return -EINVAL;
8566
8567         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
8568
8569         /* get the channel if any has been specified, otherwise pass NULL to
8570          * the driver. The latter will use the current one
8571          */
8572         chandef.chan = NULL;
8573         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8574                 err = nl80211_parse_chandef(rdev, info, &chandef);
8575                 if (err)
8576                         return err;
8577         }
8578
8579         if (!chandef.chan && params.offchan)
8580                 return -EINVAL;
8581
8582         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
8583         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
8584
8585         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
8586                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
8587                 int i;
8588
8589                 if (len % sizeof(u16))
8590                         return -EINVAL;
8591
8592                 params.n_csa_offsets = len / sizeof(u16);
8593                 params.csa_offsets =
8594                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
8595
8596                 /* check that all the offsets fit the frame */
8597                 for (i = 0; i < params.n_csa_offsets; i++) {
8598                         if (params.csa_offsets[i] >= params.len)
8599                                 return -EINVAL;
8600                 }
8601         }
8602
8603         if (!params.dont_wait_for_ack) {
8604                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8605                 if (!msg)
8606                         return -ENOMEM;
8607
8608                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8609                                      NL80211_CMD_FRAME);
8610                 if (!hdr) {
8611                         err = -ENOBUFS;
8612                         goto free_msg;
8613                 }
8614         }
8615
8616         params.chan = chandef.chan;
8617         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
8618         if (err)
8619                 goto free_msg;
8620
8621         if (msg) {
8622                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8623                         goto nla_put_failure;
8624
8625                 genlmsg_end(msg, hdr);
8626                 return genlmsg_reply(msg, info);
8627         }
8628
8629         return 0;
8630
8631  nla_put_failure:
8632         err = -ENOBUFS;
8633  free_msg:
8634         nlmsg_free(msg);
8635         return err;
8636 }
8637
8638 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
8639 {
8640         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8641         struct wireless_dev *wdev = info->user_ptr[1];
8642         u64 cookie;
8643
8644         if (!info->attrs[NL80211_ATTR_COOKIE])
8645                 return -EINVAL;
8646
8647         if (!rdev->ops->mgmt_tx_cancel_wait)
8648                 return -EOPNOTSUPP;
8649
8650         switch (wdev->iftype) {
8651         case NL80211_IFTYPE_STATION:
8652         case NL80211_IFTYPE_ADHOC:
8653         case NL80211_IFTYPE_P2P_CLIENT:
8654         case NL80211_IFTYPE_AP:
8655         case NL80211_IFTYPE_AP_VLAN:
8656         case NL80211_IFTYPE_P2P_GO:
8657         case NL80211_IFTYPE_P2P_DEVICE:
8658                 break;
8659         default:
8660                 return -EOPNOTSUPP;
8661         }
8662
8663         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
8664
8665         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
8666 }
8667
8668 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
8669 {
8670         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8671         struct wireless_dev *wdev;
8672         struct net_device *dev = info->user_ptr[1];
8673         u8 ps_state;
8674         bool state;
8675         int err;
8676
8677         if (!info->attrs[NL80211_ATTR_PS_STATE])
8678                 return -EINVAL;
8679
8680         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
8681
8682         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
8683                 return -EINVAL;
8684
8685         wdev = dev->ieee80211_ptr;
8686
8687         if (!rdev->ops->set_power_mgmt)
8688                 return -EOPNOTSUPP;
8689
8690         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
8691
8692         if (state == wdev->ps)
8693                 return 0;
8694
8695         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
8696         if (!err)
8697                 wdev->ps = state;
8698         return err;
8699 }
8700
8701 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
8702 {
8703         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8704         enum nl80211_ps_state ps_state;
8705         struct wireless_dev *wdev;
8706         struct net_device *dev = info->user_ptr[1];
8707         struct sk_buff *msg;
8708         void *hdr;
8709         int err;
8710
8711         wdev = dev->ieee80211_ptr;
8712
8713         if (!rdev->ops->set_power_mgmt)
8714                 return -EOPNOTSUPP;
8715
8716         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8717         if (!msg)
8718                 return -ENOMEM;
8719
8720         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8721                              NL80211_CMD_GET_POWER_SAVE);
8722         if (!hdr) {
8723                 err = -ENOBUFS;
8724                 goto free_msg;
8725         }
8726
8727         if (wdev->ps)
8728                 ps_state = NL80211_PS_ENABLED;
8729         else
8730                 ps_state = NL80211_PS_DISABLED;
8731
8732         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
8733                 goto nla_put_failure;
8734
8735         genlmsg_end(msg, hdr);
8736         return genlmsg_reply(msg, info);
8737
8738  nla_put_failure:
8739         err = -ENOBUFS;
8740  free_msg:
8741         nlmsg_free(msg);
8742         return err;
8743 }
8744
8745 static const struct nla_policy
8746 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
8747         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
8748         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
8749         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
8750         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
8751         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
8752         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
8753 };
8754
8755 static int nl80211_set_cqm_txe(struct genl_info *info,
8756                                u32 rate, u32 pkts, u32 intvl)
8757 {
8758         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8759         struct net_device *dev = info->user_ptr[1];
8760         struct wireless_dev *wdev = dev->ieee80211_ptr;
8761
8762         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
8763                 return -EINVAL;
8764
8765         if (!rdev->ops->set_cqm_txe_config)
8766                 return -EOPNOTSUPP;
8767
8768         if (wdev->iftype != NL80211_IFTYPE_STATION &&
8769             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
8770                 return -EOPNOTSUPP;
8771
8772         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
8773 }
8774
8775 static int nl80211_set_cqm_rssi(struct genl_info *info,
8776                                 s32 threshold, u32 hysteresis)
8777 {
8778         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8779         struct net_device *dev = info->user_ptr[1];
8780         struct wireless_dev *wdev = dev->ieee80211_ptr;
8781
8782         if (threshold > 0)
8783                 return -EINVAL;
8784
8785         /* disabling - hysteresis should also be zero then */
8786         if (threshold == 0)
8787                 hysteresis = 0;
8788
8789         if (!rdev->ops->set_cqm_rssi_config)
8790                 return -EOPNOTSUPP;
8791
8792         if (wdev->iftype != NL80211_IFTYPE_STATION &&
8793             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
8794                 return -EOPNOTSUPP;
8795
8796         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
8797 }
8798
8799 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
8800 {
8801         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
8802         struct nlattr *cqm;
8803         int err;
8804
8805         cqm = info->attrs[NL80211_ATTR_CQM];
8806         if (!cqm)
8807                 return -EINVAL;
8808
8809         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
8810                                nl80211_attr_cqm_policy);
8811         if (err)
8812                 return err;
8813
8814         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
8815             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
8816                 s32 threshold = nla_get_s32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
8817                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
8818
8819                 return nl80211_set_cqm_rssi(info, threshold, hysteresis);
8820         }
8821
8822         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
8823             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
8824             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
8825                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
8826                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
8827                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
8828
8829                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
8830         }
8831
8832         return -EINVAL;
8833 }
8834
8835 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
8836 {
8837         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8838         struct net_device *dev = info->user_ptr[1];
8839         struct ocb_setup setup = {};
8840         int err;
8841
8842         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
8843         if (err)
8844                 return err;
8845
8846         return cfg80211_join_ocb(rdev, dev, &setup);
8847 }
8848
8849 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
8850 {
8851         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8852         struct net_device *dev = info->user_ptr[1];
8853
8854         return cfg80211_leave_ocb(rdev, dev);
8855 }
8856
8857 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
8858 {
8859         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8860         struct net_device *dev = info->user_ptr[1];
8861         struct mesh_config cfg;
8862         struct mesh_setup setup;
8863         int err;
8864
8865         /* start with default */
8866         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
8867         memcpy(&setup, &default_mesh_setup, sizeof(setup));
8868
8869         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
8870                 /* and parse parameters if given */
8871                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
8872                 if (err)
8873                         return err;
8874         }
8875
8876         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
8877             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
8878                 return -EINVAL;
8879
8880         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
8881         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
8882
8883         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
8884             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
8885                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
8886                         return -EINVAL;
8887
8888         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
8889                 setup.beacon_interval =
8890                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
8891                 if (setup.beacon_interval < 10 ||
8892                     setup.beacon_interval > 10000)
8893                         return -EINVAL;
8894         }
8895
8896         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
8897                 setup.dtim_period =
8898                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
8899                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
8900                         return -EINVAL;
8901         }
8902
8903         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
8904                 /* parse additional setup parameters if given */
8905                 err = nl80211_parse_mesh_setup(info, &setup);
8906                 if (err)
8907                         return err;
8908         }
8909
8910         if (setup.user_mpm)
8911                 cfg.auto_open_plinks = false;
8912
8913         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8914                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
8915                 if (err)
8916                         return err;
8917         } else {
8918                 /* cfg80211_join_mesh() will sort it out */
8919                 setup.chandef.chan = NULL;
8920         }
8921
8922         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8923                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8924                 int n_rates =
8925                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8926                 struct ieee80211_supported_band *sband;
8927
8928                 if (!setup.chandef.chan)
8929                         return -EINVAL;
8930
8931                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
8932
8933                 err = ieee80211_get_ratemask(sband, rates, n_rates,
8934                                              &setup.basic_rates);
8935                 if (err)
8936                         return err;
8937         }
8938
8939         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
8940 }
8941
8942 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
8943 {
8944         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8945         struct net_device *dev = info->user_ptr[1];
8946
8947         return cfg80211_leave_mesh(rdev, dev);
8948 }
8949
8950 #ifdef CONFIG_PM
8951 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
8952                                         struct cfg80211_registered_device *rdev)
8953 {
8954         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
8955         struct nlattr *nl_pats, *nl_pat;
8956         int i, pat_len;
8957
8958         if (!wowlan->n_patterns)
8959                 return 0;
8960
8961         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
8962         if (!nl_pats)
8963                 return -ENOBUFS;
8964
8965         for (i = 0; i < wowlan->n_patterns; i++) {
8966                 nl_pat = nla_nest_start(msg, i + 1);
8967                 if (!nl_pat)
8968                         return -ENOBUFS;
8969                 pat_len = wowlan->patterns[i].pattern_len;
8970                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
8971                             wowlan->patterns[i].mask) ||
8972                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
8973                             wowlan->patterns[i].pattern) ||
8974                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
8975                                 wowlan->patterns[i].pkt_offset))
8976                         return -ENOBUFS;
8977                 nla_nest_end(msg, nl_pat);
8978         }
8979         nla_nest_end(msg, nl_pats);
8980
8981         return 0;
8982 }
8983
8984 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
8985                                    struct cfg80211_wowlan_tcp *tcp)
8986 {
8987         struct nlattr *nl_tcp;
8988
8989         if (!tcp)
8990                 return 0;
8991
8992         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
8993         if (!nl_tcp)
8994                 return -ENOBUFS;
8995
8996         if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
8997             nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
8998             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
8999             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
9000             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
9001             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
9002                     tcp->payload_len, tcp->payload) ||
9003             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
9004                         tcp->data_interval) ||
9005             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
9006                     tcp->wake_len, tcp->wake_data) ||
9007             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
9008                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
9009                 return -ENOBUFS;
9010
9011         if (tcp->payload_seq.len &&
9012             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
9013                     sizeof(tcp->payload_seq), &tcp->payload_seq))
9014                 return -ENOBUFS;
9015
9016         if (tcp->payload_tok.len &&
9017             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
9018                     sizeof(tcp->payload_tok) + tcp->tokens_size,
9019                     &tcp->payload_tok))
9020                 return -ENOBUFS;
9021
9022         nla_nest_end(msg, nl_tcp);
9023
9024         return 0;
9025 }
9026
9027 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
9028                                   struct cfg80211_sched_scan_request *req)
9029 {
9030         struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
9031         int i;
9032
9033         if (!req)
9034                 return 0;
9035
9036         nd = nla_nest_start(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
9037         if (!nd)
9038                 return -ENOBUFS;
9039
9040         if (req->n_scan_plans == 1 &&
9041             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
9042                         req->scan_plans[0].interval * 1000))
9043                 return -ENOBUFS;
9044
9045         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
9046                 return -ENOBUFS;
9047
9048         freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
9049         if (!freqs)
9050                 return -ENOBUFS;
9051
9052         for (i = 0; i < req->n_channels; i++)
9053                 nla_put_u32(msg, i, req->channels[i]->center_freq);
9054
9055         nla_nest_end(msg, freqs);
9056
9057         if (req->n_match_sets) {
9058                 matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
9059                 for (i = 0; i < req->n_match_sets; i++) {
9060                         match = nla_nest_start(msg, i);
9061                         nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
9062                                 req->match_sets[i].ssid.ssid_len,
9063                                 req->match_sets[i].ssid.ssid);
9064                         nla_nest_end(msg, match);
9065                 }
9066                 nla_nest_end(msg, matches);
9067         }
9068
9069         scan_plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
9070         if (!scan_plans)
9071                 return -ENOBUFS;
9072
9073         for (i = 0; i < req->n_scan_plans; i++) {
9074                 scan_plan = nla_nest_start(msg, i + 1);
9075                 if (!scan_plan ||
9076                     nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
9077                                 req->scan_plans[i].interval) ||
9078                     (req->scan_plans[i].iterations &&
9079                      nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
9080                                  req->scan_plans[i].iterations)))
9081                         return -ENOBUFS;
9082                 nla_nest_end(msg, scan_plan);
9083         }
9084         nla_nest_end(msg, scan_plans);
9085
9086         nla_nest_end(msg, nd);
9087
9088         return 0;
9089 }
9090
9091 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
9092 {
9093         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9094         struct sk_buff *msg;
9095         void *hdr;
9096         u32 size = NLMSG_DEFAULT_SIZE;
9097
9098         if (!rdev->wiphy.wowlan)
9099                 return -EOPNOTSUPP;
9100
9101         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
9102                 /* adjust size to have room for all the data */
9103                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
9104                         rdev->wiphy.wowlan_config->tcp->payload_len +
9105                         rdev->wiphy.wowlan_config->tcp->wake_len +
9106                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
9107         }
9108
9109         msg = nlmsg_new(size, GFP_KERNEL);
9110         if (!msg)
9111                 return -ENOMEM;
9112
9113         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9114                              NL80211_CMD_GET_WOWLAN);
9115         if (!hdr)
9116                 goto nla_put_failure;
9117
9118         if (rdev->wiphy.wowlan_config) {
9119                 struct nlattr *nl_wowlan;
9120
9121                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
9122                 if (!nl_wowlan)
9123                         goto nla_put_failure;
9124
9125                 if ((rdev->wiphy.wowlan_config->any &&
9126                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
9127                     (rdev->wiphy.wowlan_config->disconnect &&
9128                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
9129                     (rdev->wiphy.wowlan_config->magic_pkt &&
9130                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
9131                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
9132                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
9133                     (rdev->wiphy.wowlan_config->eap_identity_req &&
9134                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
9135                     (rdev->wiphy.wowlan_config->four_way_handshake &&
9136                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
9137                     (rdev->wiphy.wowlan_config->rfkill_release &&
9138                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
9139                         goto nla_put_failure;
9140
9141                 if (nl80211_send_wowlan_patterns(msg, rdev))
9142                         goto nla_put_failure;
9143
9144                 if (nl80211_send_wowlan_tcp(msg,
9145                                             rdev->wiphy.wowlan_config->tcp))
9146                         goto nla_put_failure;
9147
9148                 if (nl80211_send_wowlan_nd(
9149                             msg,
9150                             rdev->wiphy.wowlan_config->nd_config))
9151                         goto nla_put_failure;
9152
9153                 nla_nest_end(msg, nl_wowlan);
9154         }
9155
9156         genlmsg_end(msg, hdr);
9157         return genlmsg_reply(msg, info);
9158
9159 nla_put_failure:
9160         nlmsg_free(msg);
9161         return -ENOBUFS;
9162 }
9163
9164 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
9165                                     struct nlattr *attr,
9166                                     struct cfg80211_wowlan *trig)
9167 {
9168         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
9169         struct cfg80211_wowlan_tcp *cfg;
9170         struct nl80211_wowlan_tcp_data_token *tok = NULL;
9171         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
9172         u32 size;
9173         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
9174         int err, port;
9175
9176         if (!rdev->wiphy.wowlan->tcp)
9177                 return -EINVAL;
9178
9179         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
9180                         nla_data(attr), nla_len(attr),
9181                         nl80211_wowlan_tcp_policy);
9182         if (err)
9183                 return err;
9184
9185         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
9186             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
9187             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
9188             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
9189             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
9190             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
9191             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
9192             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
9193                 return -EINVAL;
9194
9195         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
9196         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
9197                 return -EINVAL;
9198
9199         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
9200                         rdev->wiphy.wowlan->tcp->data_interval_max ||
9201             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
9202                 return -EINVAL;
9203
9204         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
9205         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
9206                 return -EINVAL;
9207
9208         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
9209         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
9210                 return -EINVAL;
9211
9212         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
9213                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
9214
9215                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
9216                 tokens_size = tokln - sizeof(*tok);
9217
9218                 if (!tok->len || tokens_size % tok->len)
9219                         return -EINVAL;
9220                 if (!rdev->wiphy.wowlan->tcp->tok)
9221                         return -EINVAL;
9222                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
9223                         return -EINVAL;
9224                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
9225                         return -EINVAL;
9226                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
9227                         return -EINVAL;
9228                 if (tok->offset + tok->len > data_size)
9229                         return -EINVAL;
9230         }
9231
9232         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
9233                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
9234                 if (!rdev->wiphy.wowlan->tcp->seq)
9235                         return -EINVAL;
9236                 if (seq->len == 0 || seq->len > 4)
9237                         return -EINVAL;
9238                 if (seq->len + seq->offset > data_size)
9239                         return -EINVAL;
9240         }
9241
9242         size = sizeof(*cfg);
9243         size += data_size;
9244         size += wake_size + wake_mask_size;
9245         size += tokens_size;
9246
9247         cfg = kzalloc(size, GFP_KERNEL);
9248         if (!cfg)
9249                 return -ENOMEM;
9250         cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
9251         cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
9252         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
9253                ETH_ALEN);
9254         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
9255                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
9256         else
9257                 port = 0;
9258 #ifdef CONFIG_INET
9259         /* allocate a socket and port for it and use it */
9260         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
9261                             IPPROTO_TCP, &cfg->sock, 1);
9262         if (err) {
9263                 kfree(cfg);
9264                 return err;
9265         }
9266         if (inet_csk_get_port(cfg->sock->sk, port)) {
9267                 sock_release(cfg->sock);
9268                 kfree(cfg);
9269                 return -EADDRINUSE;
9270         }
9271         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
9272 #else
9273         if (!port) {
9274                 kfree(cfg);
9275                 return -EINVAL;
9276         }
9277         cfg->src_port = port;
9278 #endif
9279
9280         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
9281         cfg->payload_len = data_size;
9282         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
9283         memcpy((void *)cfg->payload,
9284                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
9285                data_size);
9286         if (seq)
9287                 cfg->payload_seq = *seq;
9288         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
9289         cfg->wake_len = wake_size;
9290         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
9291         memcpy((void *)cfg->wake_data,
9292                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
9293                wake_size);
9294         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
9295                          data_size + wake_size;
9296         memcpy((void *)cfg->wake_mask,
9297                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
9298                wake_mask_size);
9299         if (tok) {
9300                 cfg->tokens_size = tokens_size;
9301                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
9302         }
9303
9304         trig->tcp = cfg;
9305
9306         return 0;
9307 }
9308
9309 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
9310                                    const struct wiphy_wowlan_support *wowlan,
9311                                    struct nlattr *attr,
9312                                    struct cfg80211_wowlan *trig)
9313 {
9314         struct nlattr **tb;
9315         int err;
9316
9317         tb = kzalloc(NUM_NL80211_ATTR * sizeof(*tb), GFP_KERNEL);
9318         if (!tb)
9319                 return -ENOMEM;
9320
9321         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
9322                 err = -EOPNOTSUPP;
9323                 goto out;
9324         }
9325
9326         err = nla_parse(tb, NL80211_ATTR_MAX,
9327                         nla_data(attr), nla_len(attr),
9328                         nl80211_policy);
9329         if (err)
9330                 goto out;
9331
9332         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb);
9333         err = PTR_ERR_OR_ZERO(trig->nd_config);
9334         if (err)
9335                 trig->nd_config = NULL;
9336
9337 out:
9338         kfree(tb);
9339         return err;
9340 }
9341
9342 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
9343 {
9344         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9345         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
9346         struct cfg80211_wowlan new_triggers = {};
9347         struct cfg80211_wowlan *ntrig;
9348         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
9349         int err, i;
9350         bool prev_enabled = rdev->wiphy.wowlan_config;
9351         bool regular = false;
9352
9353         if (!wowlan)
9354                 return -EOPNOTSUPP;
9355
9356         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
9357                 cfg80211_rdev_free_wowlan(rdev);
9358                 rdev->wiphy.wowlan_config = NULL;
9359                 goto set_wakeup;
9360         }
9361
9362         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
9363                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
9364                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
9365                         nl80211_wowlan_policy);
9366         if (err)
9367                 return err;
9368
9369         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
9370                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
9371                         return -EINVAL;
9372                 new_triggers.any = true;
9373         }
9374
9375         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
9376                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
9377                         return -EINVAL;
9378                 new_triggers.disconnect = true;
9379                 regular = true;
9380         }
9381
9382         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
9383                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
9384                         return -EINVAL;
9385                 new_triggers.magic_pkt = true;
9386                 regular = true;
9387         }
9388
9389         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
9390                 return -EINVAL;
9391
9392         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
9393                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
9394                         return -EINVAL;
9395                 new_triggers.gtk_rekey_failure = true;
9396                 regular = true;
9397         }
9398
9399         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
9400                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
9401                         return -EINVAL;
9402                 new_triggers.eap_identity_req = true;
9403                 regular = true;
9404         }
9405
9406         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
9407                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
9408                         return -EINVAL;
9409                 new_triggers.four_way_handshake = true;
9410                 regular = true;
9411         }
9412
9413         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
9414                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
9415                         return -EINVAL;
9416                 new_triggers.rfkill_release = true;
9417                 regular = true;
9418         }
9419
9420         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
9421                 struct nlattr *pat;
9422                 int n_patterns = 0;
9423                 int rem, pat_len, mask_len, pkt_offset;
9424                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
9425
9426                 regular = true;
9427
9428                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
9429                                     rem)
9430                         n_patterns++;
9431                 if (n_patterns > wowlan->n_patterns)
9432                         return -EINVAL;
9433
9434                 new_triggers.patterns = kcalloc(n_patterns,
9435                                                 sizeof(new_triggers.patterns[0]),
9436                                                 GFP_KERNEL);
9437                 if (!new_triggers.patterns)
9438                         return -ENOMEM;
9439
9440                 new_triggers.n_patterns = n_patterns;
9441                 i = 0;
9442
9443                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
9444                                     rem) {
9445                         u8 *mask_pat;
9446
9447                         nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
9448                                   nla_len(pat), NULL);
9449                         err = -EINVAL;
9450                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
9451                             !pat_tb[NL80211_PKTPAT_PATTERN])
9452                                 goto error;
9453                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
9454                         mask_len = DIV_ROUND_UP(pat_len, 8);
9455                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
9456                                 goto error;
9457                         if (pat_len > wowlan->pattern_max_len ||
9458                             pat_len < wowlan->pattern_min_len)
9459                                 goto error;
9460
9461                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
9462                                 pkt_offset = 0;
9463                         else
9464                                 pkt_offset = nla_get_u32(
9465                                         pat_tb[NL80211_PKTPAT_OFFSET]);
9466                         if (pkt_offset > wowlan->max_pkt_offset)
9467                                 goto error;
9468                         new_triggers.patterns[i].pkt_offset = pkt_offset;
9469
9470                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
9471                         if (!mask_pat) {
9472                                 err = -ENOMEM;
9473                                 goto error;
9474                         }
9475                         new_triggers.patterns[i].mask = mask_pat;
9476                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
9477                                mask_len);
9478                         mask_pat += mask_len;
9479                         new_triggers.patterns[i].pattern = mask_pat;
9480                         new_triggers.patterns[i].pattern_len = pat_len;
9481                         memcpy(mask_pat,
9482                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
9483                                pat_len);
9484                         i++;
9485                 }
9486         }
9487
9488         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
9489                 regular = true;
9490                 err = nl80211_parse_wowlan_tcp(
9491                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
9492                         &new_triggers);
9493                 if (err)
9494                         goto error;
9495         }
9496
9497         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
9498                 regular = true;
9499                 err = nl80211_parse_wowlan_nd(
9500                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
9501                         &new_triggers);
9502                 if (err)
9503                         goto error;
9504         }
9505
9506         /* The 'any' trigger means the device continues operating more or less
9507          * as in its normal operation mode and wakes up the host on most of the
9508          * normal interrupts (like packet RX, ...)
9509          * It therefore makes little sense to combine with the more constrained
9510          * wakeup trigger modes.
9511          */
9512         if (new_triggers.any && regular) {
9513                 err = -EINVAL;
9514                 goto error;
9515         }
9516
9517         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
9518         if (!ntrig) {
9519                 err = -ENOMEM;
9520                 goto error;
9521         }
9522         cfg80211_rdev_free_wowlan(rdev);
9523         rdev->wiphy.wowlan_config = ntrig;
9524
9525  set_wakeup:
9526         if (rdev->ops->set_wakeup &&
9527             prev_enabled != !!rdev->wiphy.wowlan_config)
9528                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
9529
9530         return 0;
9531  error:
9532         for (i = 0; i < new_triggers.n_patterns; i++)
9533                 kfree(new_triggers.patterns[i].mask);
9534         kfree(new_triggers.patterns);
9535         if (new_triggers.tcp && new_triggers.tcp->sock)
9536                 sock_release(new_triggers.tcp->sock);
9537         kfree(new_triggers.tcp);
9538         return err;
9539 }
9540 #endif
9541
9542 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
9543                                        struct cfg80211_registered_device *rdev)
9544 {
9545         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
9546         int i, j, pat_len;
9547         struct cfg80211_coalesce_rules *rule;
9548
9549         if (!rdev->coalesce->n_rules)
9550                 return 0;
9551
9552         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
9553         if (!nl_rules)
9554                 return -ENOBUFS;
9555
9556         for (i = 0; i < rdev->coalesce->n_rules; i++) {
9557                 nl_rule = nla_nest_start(msg, i + 1);
9558                 if (!nl_rule)
9559                         return -ENOBUFS;
9560
9561                 rule = &rdev->coalesce->rules[i];
9562                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
9563                                 rule->delay))
9564                         return -ENOBUFS;
9565
9566                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
9567                                 rule->condition))
9568                         return -ENOBUFS;
9569
9570                 nl_pats = nla_nest_start(msg,
9571                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
9572                 if (!nl_pats)
9573                         return -ENOBUFS;
9574
9575                 for (j = 0; j < rule->n_patterns; j++) {
9576                         nl_pat = nla_nest_start(msg, j + 1);
9577                         if (!nl_pat)
9578                                 return -ENOBUFS;
9579                         pat_len = rule->patterns[j].pattern_len;
9580                         if (nla_put(msg, NL80211_PKTPAT_MASK,
9581                                     DIV_ROUND_UP(pat_len, 8),
9582                                     rule->patterns[j].mask) ||
9583                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
9584                                     rule->patterns[j].pattern) ||
9585                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
9586                                         rule->patterns[j].pkt_offset))
9587                                 return -ENOBUFS;
9588                         nla_nest_end(msg, nl_pat);
9589                 }
9590                 nla_nest_end(msg, nl_pats);
9591                 nla_nest_end(msg, nl_rule);
9592         }
9593         nla_nest_end(msg, nl_rules);
9594
9595         return 0;
9596 }
9597
9598 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
9599 {
9600         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9601         struct sk_buff *msg;
9602         void *hdr;
9603
9604         if (!rdev->wiphy.coalesce)
9605                 return -EOPNOTSUPP;
9606
9607         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9608         if (!msg)
9609                 return -ENOMEM;
9610
9611         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9612                              NL80211_CMD_GET_COALESCE);
9613         if (!hdr)
9614                 goto nla_put_failure;
9615
9616         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
9617                 goto nla_put_failure;
9618
9619         genlmsg_end(msg, hdr);
9620         return genlmsg_reply(msg, info);
9621
9622 nla_put_failure:
9623         nlmsg_free(msg);
9624         return -ENOBUFS;
9625 }
9626
9627 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
9628 {
9629         struct cfg80211_coalesce *coalesce = rdev->coalesce;
9630         int i, j;
9631         struct cfg80211_coalesce_rules *rule;
9632
9633         if (!coalesce)
9634                 return;
9635
9636         for (i = 0; i < coalesce->n_rules; i++) {
9637                 rule = &coalesce->rules[i];
9638                 for (j = 0; j < rule->n_patterns; j++)
9639                         kfree(rule->patterns[j].mask);
9640                 kfree(rule->patterns);
9641         }
9642         kfree(coalesce->rules);
9643         kfree(coalesce);
9644         rdev->coalesce = NULL;
9645 }
9646
9647 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
9648                                        struct nlattr *rule,
9649                                        struct cfg80211_coalesce_rules *new_rule)
9650 {
9651         int err, i;
9652         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
9653         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
9654         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
9655         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
9656
9657         err = nla_parse(tb, NL80211_ATTR_COALESCE_RULE_MAX, nla_data(rule),
9658                         nla_len(rule), nl80211_coalesce_policy);
9659         if (err)
9660                 return err;
9661
9662         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
9663                 new_rule->delay =
9664                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
9665         if (new_rule->delay > coalesce->max_delay)
9666                 return -EINVAL;
9667
9668         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
9669                 new_rule->condition =
9670                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
9671         if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
9672             new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
9673                 return -EINVAL;
9674
9675         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
9676                 return -EINVAL;
9677
9678         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
9679                             rem)
9680                 n_patterns++;
9681         if (n_patterns > coalesce->n_patterns)
9682                 return -EINVAL;
9683
9684         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
9685                                      GFP_KERNEL);
9686         if (!new_rule->patterns)
9687                 return -ENOMEM;
9688
9689         new_rule->n_patterns = n_patterns;
9690         i = 0;
9691
9692         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
9693                             rem) {
9694                 u8 *mask_pat;
9695
9696                 nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
9697                           nla_len(pat), NULL);
9698                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
9699                     !pat_tb[NL80211_PKTPAT_PATTERN])
9700                         return -EINVAL;
9701                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
9702                 mask_len = DIV_ROUND_UP(pat_len, 8);
9703                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
9704                         return -EINVAL;
9705                 if (pat_len > coalesce->pattern_max_len ||
9706                     pat_len < coalesce->pattern_min_len)
9707                         return -EINVAL;
9708
9709                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
9710                         pkt_offset = 0;
9711                 else
9712                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
9713                 if (pkt_offset > coalesce->max_pkt_offset)
9714                         return -EINVAL;
9715                 new_rule->patterns[i].pkt_offset = pkt_offset;
9716
9717                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
9718                 if (!mask_pat)
9719                         return -ENOMEM;
9720
9721                 new_rule->patterns[i].mask = mask_pat;
9722                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
9723                        mask_len);
9724
9725                 mask_pat += mask_len;
9726                 new_rule->patterns[i].pattern = mask_pat;
9727                 new_rule->patterns[i].pattern_len = pat_len;
9728                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
9729                        pat_len);
9730                 i++;
9731         }
9732
9733         return 0;
9734 }
9735
9736 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
9737 {
9738         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9739         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
9740         struct cfg80211_coalesce new_coalesce = {};
9741         struct cfg80211_coalesce *n_coalesce;
9742         int err, rem_rule, n_rules = 0, i, j;
9743         struct nlattr *rule;
9744         struct cfg80211_coalesce_rules *tmp_rule;
9745
9746         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
9747                 return -EOPNOTSUPP;
9748
9749         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
9750                 cfg80211_rdev_free_coalesce(rdev);
9751                 rdev_set_coalesce(rdev, NULL);
9752                 return 0;
9753         }
9754
9755         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
9756                             rem_rule)
9757                 n_rules++;
9758         if (n_rules > coalesce->n_rules)
9759                 return -EINVAL;
9760
9761         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
9762                                      GFP_KERNEL);
9763         if (!new_coalesce.rules)
9764                 return -ENOMEM;
9765
9766         new_coalesce.n_rules = n_rules;
9767         i = 0;
9768
9769         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
9770                             rem_rule) {
9771                 err = nl80211_parse_coalesce_rule(rdev, rule,
9772                                                   &new_coalesce.rules[i]);
9773                 if (err)
9774                         goto error;
9775
9776                 i++;
9777         }
9778
9779         err = rdev_set_coalesce(rdev, &new_coalesce);
9780         if (err)
9781                 goto error;
9782
9783         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
9784         if (!n_coalesce) {
9785                 err = -ENOMEM;
9786                 goto error;
9787         }
9788         cfg80211_rdev_free_coalesce(rdev);
9789         rdev->coalesce = n_coalesce;
9790
9791         return 0;
9792 error:
9793         for (i = 0; i < new_coalesce.n_rules; i++) {
9794                 tmp_rule = &new_coalesce.rules[i];
9795                 for (j = 0; j < tmp_rule->n_patterns; j++)
9796                         kfree(tmp_rule->patterns[j].mask);
9797                 kfree(tmp_rule->patterns);
9798         }
9799         kfree(new_coalesce.rules);
9800
9801         return err;
9802 }
9803
9804 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
9805 {
9806         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9807         struct net_device *dev = info->user_ptr[1];
9808         struct wireless_dev *wdev = dev->ieee80211_ptr;
9809         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
9810         struct cfg80211_gtk_rekey_data rekey_data;
9811         int err;
9812
9813         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
9814                 return -EINVAL;
9815
9816         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
9817                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
9818                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
9819                         nl80211_rekey_policy);
9820         if (err)
9821                 return err;
9822
9823         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
9824                 return -ERANGE;
9825         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
9826                 return -ERANGE;
9827         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
9828                 return -ERANGE;
9829
9830         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
9831         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
9832         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
9833
9834         wdev_lock(wdev);
9835         if (!wdev->current_bss) {
9836                 err = -ENOTCONN;
9837                 goto out;
9838         }
9839
9840         if (!rdev->ops->set_rekey_data) {
9841                 err = -EOPNOTSUPP;
9842                 goto out;
9843         }
9844
9845         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
9846  out:
9847         wdev_unlock(wdev);
9848         return err;
9849 }
9850
9851 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
9852                                              struct genl_info *info)
9853 {
9854         struct net_device *dev = info->user_ptr[1];
9855         struct wireless_dev *wdev = dev->ieee80211_ptr;
9856
9857         if (wdev->iftype != NL80211_IFTYPE_AP &&
9858             wdev->iftype != NL80211_IFTYPE_P2P_GO)
9859                 return -EINVAL;
9860
9861         if (wdev->ap_unexpected_nlportid)
9862                 return -EBUSY;
9863
9864         wdev->ap_unexpected_nlportid = info->snd_portid;
9865         return 0;
9866 }
9867
9868 static int nl80211_probe_client(struct sk_buff *skb,
9869                                 struct genl_info *info)
9870 {
9871         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9872         struct net_device *dev = info->user_ptr[1];
9873         struct wireless_dev *wdev = dev->ieee80211_ptr;
9874         struct sk_buff *msg;
9875         void *hdr;
9876         const u8 *addr;
9877         u64 cookie;
9878         int err;
9879
9880         if (wdev->iftype != NL80211_IFTYPE_AP &&
9881             wdev->iftype != NL80211_IFTYPE_P2P_GO)
9882                 return -EOPNOTSUPP;
9883
9884         if (!info->attrs[NL80211_ATTR_MAC])
9885                 return -EINVAL;
9886
9887         if (!rdev->ops->probe_client)
9888                 return -EOPNOTSUPP;
9889
9890         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9891         if (!msg)
9892                 return -ENOMEM;
9893
9894         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9895                              NL80211_CMD_PROBE_CLIENT);
9896         if (!hdr) {
9897                 err = -ENOBUFS;
9898                 goto free_msg;
9899         }
9900
9901         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
9902
9903         err = rdev_probe_client(rdev, dev, addr, &cookie);
9904         if (err)
9905                 goto free_msg;
9906
9907         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
9908                 goto nla_put_failure;
9909
9910         genlmsg_end(msg, hdr);
9911
9912         return genlmsg_reply(msg, info);
9913
9914  nla_put_failure:
9915         err = -ENOBUFS;
9916  free_msg:
9917         nlmsg_free(msg);
9918         return err;
9919 }
9920
9921 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
9922 {
9923         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9924         struct cfg80211_beacon_registration *reg, *nreg;
9925         int rv;
9926
9927         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
9928                 return -EOPNOTSUPP;
9929
9930         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
9931         if (!nreg)
9932                 return -ENOMEM;
9933
9934         /* First, check if already registered. */
9935         spin_lock_bh(&rdev->beacon_registrations_lock);
9936         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
9937                 if (reg->nlportid == info->snd_portid) {
9938                         rv = -EALREADY;
9939                         goto out_err;
9940                 }
9941         }
9942         /* Add it to the list */
9943         nreg->nlportid = info->snd_portid;
9944         list_add(&nreg->list, &rdev->beacon_registrations);
9945
9946         spin_unlock_bh(&rdev->beacon_registrations_lock);
9947
9948         return 0;
9949 out_err:
9950         spin_unlock_bh(&rdev->beacon_registrations_lock);
9951         kfree(nreg);
9952         return rv;
9953 }
9954
9955 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
9956 {
9957         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9958         struct wireless_dev *wdev = info->user_ptr[1];
9959         int err;
9960
9961         if (!rdev->ops->start_p2p_device)
9962                 return -EOPNOTSUPP;
9963
9964         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
9965                 return -EOPNOTSUPP;
9966
9967         if (wdev->p2p_started)
9968                 return 0;
9969
9970         if (rfkill_blocked(rdev->rfkill))
9971                 return -ERFKILL;
9972
9973         err = rdev_start_p2p_device(rdev, wdev);
9974         if (err)
9975                 return err;
9976
9977         wdev->p2p_started = true;
9978         rdev->opencount++;
9979
9980         return 0;
9981 }
9982
9983 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
9984 {
9985         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9986         struct wireless_dev *wdev = info->user_ptr[1];
9987
9988         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
9989                 return -EOPNOTSUPP;
9990
9991         if (!rdev->ops->stop_p2p_device)
9992                 return -EOPNOTSUPP;
9993
9994         cfg80211_stop_p2p_device(rdev, wdev);
9995
9996         return 0;
9997 }
9998
9999 static int nl80211_get_protocol_features(struct sk_buff *skb,
10000                                          struct genl_info *info)
10001 {
10002         void *hdr;
10003         struct sk_buff *msg;
10004
10005         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10006         if (!msg)
10007                 return -ENOMEM;
10008
10009         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10010                              NL80211_CMD_GET_PROTOCOL_FEATURES);
10011         if (!hdr)
10012                 goto nla_put_failure;
10013
10014         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
10015                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
10016                 goto nla_put_failure;
10017
10018         genlmsg_end(msg, hdr);
10019         return genlmsg_reply(msg, info);
10020
10021  nla_put_failure:
10022         kfree_skb(msg);
10023         return -ENOBUFS;
10024 }
10025
10026 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
10027 {
10028         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10029         struct cfg80211_update_ft_ies_params ft_params;
10030         struct net_device *dev = info->user_ptr[1];
10031
10032         if (!rdev->ops->update_ft_ies)
10033                 return -EOPNOTSUPP;
10034
10035         if (!info->attrs[NL80211_ATTR_MDID] ||
10036             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
10037                 return -EINVAL;
10038
10039         memset(&ft_params, 0, sizeof(ft_params));
10040         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
10041         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10042         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10043
10044         return rdev_update_ft_ies(rdev, dev, &ft_params);
10045 }
10046
10047 static int nl80211_crit_protocol_start(struct sk_buff *skb,
10048                                        struct genl_info *info)
10049 {
10050         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10051         struct wireless_dev *wdev = info->user_ptr[1];
10052         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
10053         u16 duration;
10054         int ret;
10055
10056         if (!rdev->ops->crit_proto_start)
10057                 return -EOPNOTSUPP;
10058
10059         if (WARN_ON(!rdev->ops->crit_proto_stop))
10060                 return -EINVAL;
10061
10062         if (rdev->crit_proto_nlportid)
10063                 return -EBUSY;
10064
10065         /* determine protocol if provided */
10066         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
10067                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
10068
10069         if (proto >= NUM_NL80211_CRIT_PROTO)
10070                 return -EINVAL;
10071
10072         /* timeout must be provided */
10073         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
10074                 return -EINVAL;
10075
10076         duration =
10077                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
10078
10079         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
10080                 return -ERANGE;
10081
10082         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
10083         if (!ret)
10084                 rdev->crit_proto_nlportid = info->snd_portid;
10085
10086         return ret;
10087 }
10088
10089 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
10090                                       struct genl_info *info)
10091 {
10092         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10093         struct wireless_dev *wdev = info->user_ptr[1];
10094
10095         if (!rdev->ops->crit_proto_stop)
10096                 return -EOPNOTSUPP;
10097
10098         if (rdev->crit_proto_nlportid) {
10099                 rdev->crit_proto_nlportid = 0;
10100                 rdev_crit_proto_stop(rdev, wdev);
10101         }
10102         return 0;
10103 }
10104
10105 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
10106 {
10107         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10108         struct wireless_dev *wdev =
10109                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
10110         int i, err;
10111         u32 vid, subcmd;
10112
10113         if (!rdev->wiphy.vendor_commands)
10114                 return -EOPNOTSUPP;
10115
10116         if (IS_ERR(wdev)) {
10117                 err = PTR_ERR(wdev);
10118                 if (err != -EINVAL)
10119                         return err;
10120                 wdev = NULL;
10121         } else if (wdev->wiphy != &rdev->wiphy) {
10122                 return -EINVAL;
10123         }
10124
10125         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
10126             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
10127                 return -EINVAL;
10128
10129         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
10130         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
10131         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
10132                 const struct wiphy_vendor_command *vcmd;
10133                 void *data = NULL;
10134                 int len = 0;
10135
10136                 vcmd = &rdev->wiphy.vendor_commands[i];
10137
10138                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
10139                         continue;
10140
10141                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
10142                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
10143                         if (!wdev)
10144                                 return -EINVAL;
10145                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
10146                             !wdev->netdev)
10147                                 return -EINVAL;
10148
10149                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
10150                                 if (wdev->netdev &&
10151                                     !netif_running(wdev->netdev))
10152                                         return -ENETDOWN;
10153                                 if (!wdev->netdev && !wdev->p2p_started)
10154                                         return -ENETDOWN;
10155                         }
10156
10157                         if (!vcmd->doit)
10158                                 return -EOPNOTSUPP;
10159                 } else {
10160                         wdev = NULL;
10161                 }
10162
10163                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
10164                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
10165                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
10166                 }
10167
10168                 rdev->cur_cmd_info = info;
10169                 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
10170                                                           data, len);
10171                 rdev->cur_cmd_info = NULL;
10172                 return err;
10173         }
10174
10175         return -EOPNOTSUPP;
10176 }
10177
10178 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
10179                                        struct netlink_callback *cb,
10180                                        struct cfg80211_registered_device **rdev,
10181                                        struct wireless_dev **wdev)
10182 {
10183         u32 vid, subcmd;
10184         unsigned int i;
10185         int vcmd_idx = -1;
10186         int err;
10187         void *data = NULL;
10188         unsigned int data_len = 0;
10189
10190         rtnl_lock();
10191
10192         if (cb->args[0]) {
10193                 /* subtract the 1 again here */
10194                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
10195                 struct wireless_dev *tmp;
10196
10197                 if (!wiphy) {
10198                         err = -ENODEV;
10199                         goto out_unlock;
10200                 }
10201                 *rdev = wiphy_to_rdev(wiphy);
10202                 *wdev = NULL;
10203
10204                 if (cb->args[1]) {
10205                         list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
10206                                 if (tmp->identifier == cb->args[1] - 1) {
10207                                         *wdev = tmp;
10208                                         break;
10209                                 }
10210                         }
10211                 }
10212
10213                 /* keep rtnl locked in successful case */
10214                 return 0;
10215         }
10216
10217         err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
10218                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
10219                           nl80211_policy);
10220         if (err)
10221                 goto out_unlock;
10222
10223         if (!nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_ID] ||
10224             !nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
10225                 err = -EINVAL;
10226                 goto out_unlock;
10227         }
10228
10229         *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
10230                                            nl80211_fam.attrbuf);
10231         if (IS_ERR(*wdev))
10232                 *wdev = NULL;
10233
10234         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
10235                                            nl80211_fam.attrbuf);
10236         if (IS_ERR(*rdev)) {
10237                 err = PTR_ERR(*rdev);
10238                 goto out_unlock;
10239         }
10240
10241         vid = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_ID]);
10242         subcmd = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
10243
10244         for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
10245                 const struct wiphy_vendor_command *vcmd;
10246
10247                 vcmd = &(*rdev)->wiphy.vendor_commands[i];
10248
10249                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
10250                         continue;
10251
10252                 if (!vcmd->dumpit) {
10253                         err = -EOPNOTSUPP;
10254                         goto out_unlock;
10255                 }
10256
10257                 vcmd_idx = i;
10258                 break;
10259         }
10260
10261         if (vcmd_idx < 0) {
10262                 err = -EOPNOTSUPP;
10263                 goto out_unlock;
10264         }
10265
10266         if (nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_DATA]) {
10267                 data = nla_data(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_DATA]);
10268                 data_len = nla_len(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_DATA]);
10269         }
10270
10271         /* 0 is the first index - add 1 to parse only once */
10272         cb->args[0] = (*rdev)->wiphy_idx + 1;
10273         /* add 1 to know if it was NULL */
10274         cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
10275         cb->args[2] = vcmd_idx;
10276         cb->args[3] = (unsigned long)data;
10277         cb->args[4] = data_len;
10278
10279         /* keep rtnl locked in successful case */
10280         return 0;
10281  out_unlock:
10282         rtnl_unlock();
10283         return err;
10284 }
10285
10286 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
10287                                    struct netlink_callback *cb)
10288 {
10289         struct cfg80211_registered_device *rdev;
10290         struct wireless_dev *wdev;
10291         unsigned int vcmd_idx;
10292         const struct wiphy_vendor_command *vcmd;
10293         void *data;
10294         int data_len;
10295         int err;
10296         struct nlattr *vendor_data;
10297
10298         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
10299         if (err)
10300                 return err;
10301
10302         vcmd_idx = cb->args[2];
10303         data = (void *)cb->args[3];
10304         data_len = cb->args[4];
10305         vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
10306
10307         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
10308                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
10309                 if (!wdev)
10310                         return -EINVAL;
10311                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
10312                     !wdev->netdev)
10313                         return -EINVAL;
10314
10315                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
10316                         if (wdev->netdev &&
10317                             !netif_running(wdev->netdev))
10318                                 return -ENETDOWN;
10319                         if (!wdev->netdev && !wdev->p2p_started)
10320                                 return -ENETDOWN;
10321                 }
10322         }
10323
10324         while (1) {
10325                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
10326                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
10327                                            NL80211_CMD_VENDOR);
10328                 if (!hdr)
10329                         break;
10330
10331                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10332                     (wdev && nla_put_u64(skb, NL80211_ATTR_WDEV,
10333                                          wdev_id(wdev)))) {
10334                         genlmsg_cancel(skb, hdr);
10335                         break;
10336                 }
10337
10338                 vendor_data = nla_nest_start(skb, NL80211_ATTR_VENDOR_DATA);
10339                 if (!vendor_data) {
10340                         genlmsg_cancel(skb, hdr);
10341                         break;
10342                 }
10343
10344                 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
10345                                    (unsigned long *)&cb->args[5]);
10346                 nla_nest_end(skb, vendor_data);
10347
10348                 if (err == -ENOBUFS || err == -ENOENT) {
10349                         genlmsg_cancel(skb, hdr);
10350                         break;
10351                 } else if (err) {
10352                         genlmsg_cancel(skb, hdr);
10353                         goto out;
10354                 }
10355
10356                 genlmsg_end(skb, hdr);
10357         }
10358
10359         err = skb->len;
10360  out:
10361         rtnl_unlock();
10362         return err;
10363 }
10364
10365 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
10366                                            enum nl80211_commands cmd,
10367                                            enum nl80211_attrs attr,
10368                                            int approxlen)
10369 {
10370         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10371
10372         if (WARN_ON(!rdev->cur_cmd_info))
10373                 return NULL;
10374
10375         return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
10376                                            rdev->cur_cmd_info->snd_portid,
10377                                            rdev->cur_cmd_info->snd_seq,
10378                                            cmd, attr, NULL, GFP_KERNEL);
10379 }
10380 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
10381
10382 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
10383 {
10384         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
10385         void *hdr = ((void **)skb->cb)[1];
10386         struct nlattr *data = ((void **)skb->cb)[2];
10387
10388         /* clear CB data for netlink core to own from now on */
10389         memset(skb->cb, 0, sizeof(skb->cb));
10390
10391         if (WARN_ON(!rdev->cur_cmd_info)) {
10392                 kfree_skb(skb);
10393                 return -EINVAL;
10394         }
10395
10396         nla_nest_end(skb, data);
10397         genlmsg_end(skb, hdr);
10398         return genlmsg_reply(skb, rdev->cur_cmd_info);
10399 }
10400 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
10401
10402
10403 static int nl80211_set_qos_map(struct sk_buff *skb,
10404                                struct genl_info *info)
10405 {
10406         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10407         struct cfg80211_qos_map *qos_map = NULL;
10408         struct net_device *dev = info->user_ptr[1];
10409         u8 *pos, len, num_des, des_len, des;
10410         int ret;
10411
10412         if (!rdev->ops->set_qos_map)
10413                 return -EOPNOTSUPP;
10414
10415         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
10416                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
10417                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
10418
10419                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
10420                     len > IEEE80211_QOS_MAP_LEN_MAX)
10421                         return -EINVAL;
10422
10423                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
10424                 if (!qos_map)
10425                         return -ENOMEM;
10426
10427                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
10428                 if (num_des) {
10429                         des_len = num_des *
10430                                 sizeof(struct cfg80211_dscp_exception);
10431                         memcpy(qos_map->dscp_exception, pos, des_len);
10432                         qos_map->num_des = num_des;
10433                         for (des = 0; des < num_des; des++) {
10434                                 if (qos_map->dscp_exception[des].up > 7) {
10435                                         kfree(qos_map);
10436                                         return -EINVAL;
10437                                 }
10438                         }
10439                         pos += des_len;
10440                 }
10441                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
10442         }
10443
10444         wdev_lock(dev->ieee80211_ptr);
10445         ret = nl80211_key_allowed(dev->ieee80211_ptr);
10446         if (!ret)
10447                 ret = rdev_set_qos_map(rdev, dev, qos_map);
10448         wdev_unlock(dev->ieee80211_ptr);
10449
10450         kfree(qos_map);
10451         return ret;
10452 }
10453
10454 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
10455 {
10456         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10457         struct net_device *dev = info->user_ptr[1];
10458         struct wireless_dev *wdev = dev->ieee80211_ptr;
10459         const u8 *peer;
10460         u8 tsid, up;
10461         u16 admitted_time = 0;
10462         int err;
10463
10464         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
10465                 return -EOPNOTSUPP;
10466
10467         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
10468             !info->attrs[NL80211_ATTR_USER_PRIO])
10469                 return -EINVAL;
10470
10471         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
10472         if (tsid >= IEEE80211_NUM_TIDS)
10473                 return -EINVAL;
10474
10475         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
10476         if (up >= IEEE80211_NUM_UPS)
10477                 return -EINVAL;
10478
10479         /* WMM uses TIDs 0-7 even for TSPEC */
10480         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
10481                 /* TODO: handle 802.11 TSPEC/admission control
10482                  * need more attributes for that (e.g. BA session requirement);
10483                  * change the WMM adminssion test above to allow both then
10484                  */
10485                 return -EINVAL;
10486         }
10487
10488         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
10489
10490         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
10491                 admitted_time =
10492                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
10493                 if (!admitted_time)
10494                         return -EINVAL;
10495         }
10496
10497         wdev_lock(wdev);
10498         switch (wdev->iftype) {
10499         case NL80211_IFTYPE_STATION:
10500         case NL80211_IFTYPE_P2P_CLIENT:
10501                 if (wdev->current_bss)
10502                         break;
10503                 err = -ENOTCONN;
10504                 goto out;
10505         default:
10506                 err = -EOPNOTSUPP;
10507                 goto out;
10508         }
10509
10510         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
10511
10512  out:
10513         wdev_unlock(wdev);
10514         return err;
10515 }
10516
10517 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
10518 {
10519         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10520         struct net_device *dev = info->user_ptr[1];
10521         struct wireless_dev *wdev = dev->ieee80211_ptr;
10522         const u8 *peer;
10523         u8 tsid;
10524         int err;
10525
10526         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
10527                 return -EINVAL;
10528
10529         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
10530         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
10531
10532         wdev_lock(wdev);
10533         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
10534         wdev_unlock(wdev);
10535
10536         return err;
10537 }
10538
10539 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
10540                                        struct genl_info *info)
10541 {
10542         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10543         struct net_device *dev = info->user_ptr[1];
10544         struct wireless_dev *wdev = dev->ieee80211_ptr;
10545         struct cfg80211_chan_def chandef = {};
10546         const u8 *addr;
10547         u8 oper_class;
10548         int err;
10549
10550         if (!rdev->ops->tdls_channel_switch ||
10551             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
10552                 return -EOPNOTSUPP;
10553
10554         switch (dev->ieee80211_ptr->iftype) {
10555         case NL80211_IFTYPE_STATION:
10556         case NL80211_IFTYPE_P2P_CLIENT:
10557                 break;
10558         default:
10559                 return -EOPNOTSUPP;
10560         }
10561
10562         if (!info->attrs[NL80211_ATTR_MAC] ||
10563             !info->attrs[NL80211_ATTR_OPER_CLASS])
10564                 return -EINVAL;
10565
10566         err = nl80211_parse_chandef(rdev, info, &chandef);
10567         if (err)
10568                 return err;
10569
10570         /*
10571          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
10572          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
10573          * specification is not defined for them.
10574          */
10575         if (chandef.chan->band == IEEE80211_BAND_2GHZ &&
10576             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
10577             chandef.width != NL80211_CHAN_WIDTH_20)
10578                 return -EINVAL;
10579
10580         /* we will be active on the TDLS link */
10581         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
10582                                            wdev->iftype))
10583                 return -EINVAL;
10584
10585         /* don't allow switching to DFS channels */
10586         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
10587                 return -EINVAL;
10588
10589         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
10590         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
10591
10592         wdev_lock(wdev);
10593         err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
10594         wdev_unlock(wdev);
10595
10596         return err;
10597 }
10598
10599 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
10600                                               struct genl_info *info)
10601 {
10602         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10603         struct net_device *dev = info->user_ptr[1];
10604         struct wireless_dev *wdev = dev->ieee80211_ptr;
10605         const u8 *addr;
10606
10607         if (!rdev->ops->tdls_channel_switch ||
10608             !rdev->ops->tdls_cancel_channel_switch ||
10609             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
10610                 return -EOPNOTSUPP;
10611
10612         switch (dev->ieee80211_ptr->iftype) {
10613         case NL80211_IFTYPE_STATION:
10614         case NL80211_IFTYPE_P2P_CLIENT:
10615                 break;
10616         default:
10617                 return -EOPNOTSUPP;
10618         }
10619
10620         if (!info->attrs[NL80211_ATTR_MAC])
10621                 return -EINVAL;
10622
10623         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
10624
10625         wdev_lock(wdev);
10626         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
10627         wdev_unlock(wdev);
10628
10629         return 0;
10630 }
10631
10632 #define NL80211_FLAG_NEED_WIPHY         0x01
10633 #define NL80211_FLAG_NEED_NETDEV        0x02
10634 #define NL80211_FLAG_NEED_RTNL          0x04
10635 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
10636 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
10637                                          NL80211_FLAG_CHECK_NETDEV_UP)
10638 #define NL80211_FLAG_NEED_WDEV          0x10
10639 /* If a netdev is associated, it must be UP, P2P must be started */
10640 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
10641                                          NL80211_FLAG_CHECK_NETDEV_UP)
10642 #define NL80211_FLAG_CLEAR_SKB          0x20
10643
10644 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
10645                             struct genl_info *info)
10646 {
10647         struct cfg80211_registered_device *rdev;
10648         struct wireless_dev *wdev;
10649         struct net_device *dev;
10650         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
10651
10652         if (rtnl)
10653                 rtnl_lock();
10654
10655         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
10656                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
10657                 if (IS_ERR(rdev)) {
10658                         if (rtnl)
10659                                 rtnl_unlock();
10660                         return PTR_ERR(rdev);
10661                 }
10662                 info->user_ptr[0] = rdev;
10663         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
10664                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
10665                 ASSERT_RTNL();
10666
10667                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
10668                                                   info->attrs);
10669                 if (IS_ERR(wdev)) {
10670                         if (rtnl)
10671                                 rtnl_unlock();
10672                         return PTR_ERR(wdev);
10673                 }
10674
10675                 dev = wdev->netdev;
10676                 rdev = wiphy_to_rdev(wdev->wiphy);
10677
10678                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
10679                         if (!dev) {
10680                                 if (rtnl)
10681                                         rtnl_unlock();
10682                                 return -EINVAL;
10683                         }
10684
10685                         info->user_ptr[1] = dev;
10686                 } else {
10687                         info->user_ptr[1] = wdev;
10688                 }
10689
10690                 if (dev) {
10691                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
10692                             !netif_running(dev)) {
10693                                 if (rtnl)
10694                                         rtnl_unlock();
10695                                 return -ENETDOWN;
10696                         }
10697
10698                         dev_hold(dev);
10699                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
10700                         if (!wdev->p2p_started) {
10701                                 if (rtnl)
10702                                         rtnl_unlock();
10703                                 return -ENETDOWN;
10704                         }
10705                 }
10706
10707                 info->user_ptr[0] = rdev;
10708         }
10709
10710         return 0;
10711 }
10712
10713 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
10714                               struct genl_info *info)
10715 {
10716         if (info->user_ptr[1]) {
10717                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
10718                         struct wireless_dev *wdev = info->user_ptr[1];
10719
10720                         if (wdev->netdev)
10721                                 dev_put(wdev->netdev);
10722                 } else {
10723                         dev_put(info->user_ptr[1]);
10724                 }
10725         }
10726
10727         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
10728                 rtnl_unlock();
10729
10730         /* If needed, clear the netlink message payload from the SKB
10731          * as it might contain key data that shouldn't stick around on
10732          * the heap after the SKB is freed. The netlink message header
10733          * is still needed for further processing, so leave it intact.
10734          */
10735         if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
10736                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
10737
10738                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
10739         }
10740 }
10741
10742 static const struct genl_ops nl80211_ops[] = {
10743         {
10744                 .cmd = NL80211_CMD_GET_WIPHY,
10745                 .doit = nl80211_get_wiphy,
10746                 .dumpit = nl80211_dump_wiphy,
10747                 .done = nl80211_dump_wiphy_done,
10748                 .policy = nl80211_policy,
10749                 /* can be retrieved by unprivileged users */
10750                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10751                                   NL80211_FLAG_NEED_RTNL,
10752         },
10753         {
10754                 .cmd = NL80211_CMD_SET_WIPHY,
10755                 .doit = nl80211_set_wiphy,
10756                 .policy = nl80211_policy,
10757                 .flags = GENL_ADMIN_PERM,
10758                 .internal_flags = NL80211_FLAG_NEED_RTNL,
10759         },
10760         {
10761                 .cmd = NL80211_CMD_GET_INTERFACE,
10762                 .doit = nl80211_get_interface,
10763                 .dumpit = nl80211_dump_interface,
10764                 .policy = nl80211_policy,
10765                 /* can be retrieved by unprivileged users */
10766                 .internal_flags = NL80211_FLAG_NEED_WDEV |
10767                                   NL80211_FLAG_NEED_RTNL,
10768         },
10769         {
10770                 .cmd = NL80211_CMD_SET_INTERFACE,
10771                 .doit = nl80211_set_interface,
10772                 .policy = nl80211_policy,
10773                 .flags = GENL_ADMIN_PERM,
10774                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10775                                   NL80211_FLAG_NEED_RTNL,
10776         },
10777         {
10778                 .cmd = NL80211_CMD_NEW_INTERFACE,
10779                 .doit = nl80211_new_interface,
10780                 .policy = nl80211_policy,
10781                 .flags = GENL_ADMIN_PERM,
10782                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10783                                   NL80211_FLAG_NEED_RTNL,
10784         },
10785         {
10786                 .cmd = NL80211_CMD_DEL_INTERFACE,
10787                 .doit = nl80211_del_interface,
10788                 .policy = nl80211_policy,
10789                 .flags = GENL_ADMIN_PERM,
10790                 .internal_flags = NL80211_FLAG_NEED_WDEV |
10791                                   NL80211_FLAG_NEED_RTNL,
10792         },
10793         {
10794                 .cmd = NL80211_CMD_GET_KEY,
10795                 .doit = nl80211_get_key,
10796                 .policy = nl80211_policy,
10797                 .flags = GENL_ADMIN_PERM,
10798                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10799                                   NL80211_FLAG_NEED_RTNL,
10800         },
10801         {
10802                 .cmd = NL80211_CMD_SET_KEY,
10803                 .doit = nl80211_set_key,
10804                 .policy = nl80211_policy,
10805                 .flags = GENL_ADMIN_PERM,
10806                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10807                                   NL80211_FLAG_NEED_RTNL |
10808                                   NL80211_FLAG_CLEAR_SKB,
10809         },
10810         {
10811                 .cmd = NL80211_CMD_NEW_KEY,
10812                 .doit = nl80211_new_key,
10813                 .policy = nl80211_policy,
10814                 .flags = GENL_ADMIN_PERM,
10815                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10816                                   NL80211_FLAG_NEED_RTNL |
10817                                   NL80211_FLAG_CLEAR_SKB,
10818         },
10819         {
10820                 .cmd = NL80211_CMD_DEL_KEY,
10821                 .doit = nl80211_del_key,
10822                 .policy = nl80211_policy,
10823                 .flags = GENL_ADMIN_PERM,
10824                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10825                                   NL80211_FLAG_NEED_RTNL,
10826         },
10827         {
10828                 .cmd = NL80211_CMD_SET_BEACON,
10829                 .policy = nl80211_policy,
10830                 .flags = GENL_ADMIN_PERM,
10831                 .doit = nl80211_set_beacon,
10832                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10833                                   NL80211_FLAG_NEED_RTNL,
10834         },
10835         {
10836                 .cmd = NL80211_CMD_START_AP,
10837                 .policy = nl80211_policy,
10838                 .flags = GENL_ADMIN_PERM,
10839                 .doit = nl80211_start_ap,
10840                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10841                                   NL80211_FLAG_NEED_RTNL,
10842         },
10843         {
10844                 .cmd = NL80211_CMD_STOP_AP,
10845                 .policy = nl80211_policy,
10846                 .flags = GENL_ADMIN_PERM,
10847                 .doit = nl80211_stop_ap,
10848                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10849                                   NL80211_FLAG_NEED_RTNL,
10850         },
10851         {
10852                 .cmd = NL80211_CMD_GET_STATION,
10853                 .doit = nl80211_get_station,
10854                 .dumpit = nl80211_dump_station,
10855                 .policy = nl80211_policy,
10856                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10857                                   NL80211_FLAG_NEED_RTNL,
10858         },
10859         {
10860                 .cmd = NL80211_CMD_SET_STATION,
10861                 .doit = nl80211_set_station,
10862                 .policy = nl80211_policy,
10863                 .flags = GENL_ADMIN_PERM,
10864                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10865                                   NL80211_FLAG_NEED_RTNL,
10866         },
10867         {
10868                 .cmd = NL80211_CMD_NEW_STATION,
10869                 .doit = nl80211_new_station,
10870                 .policy = nl80211_policy,
10871                 .flags = GENL_ADMIN_PERM,
10872                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10873                                   NL80211_FLAG_NEED_RTNL,
10874         },
10875         {
10876                 .cmd = NL80211_CMD_DEL_STATION,
10877                 .doit = nl80211_del_station,
10878                 .policy = nl80211_policy,
10879                 .flags = GENL_ADMIN_PERM,
10880                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10881                                   NL80211_FLAG_NEED_RTNL,
10882         },
10883         {
10884                 .cmd = NL80211_CMD_GET_MPATH,
10885                 .doit = nl80211_get_mpath,
10886                 .dumpit = nl80211_dump_mpath,
10887                 .policy = nl80211_policy,
10888                 .flags = GENL_ADMIN_PERM,
10889                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10890                                   NL80211_FLAG_NEED_RTNL,
10891         },
10892         {
10893                 .cmd = NL80211_CMD_GET_MPP,
10894                 .doit = nl80211_get_mpp,
10895                 .dumpit = nl80211_dump_mpp,
10896                 .policy = nl80211_policy,
10897                 .flags = GENL_ADMIN_PERM,
10898                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10899                                   NL80211_FLAG_NEED_RTNL,
10900         },
10901         {
10902                 .cmd = NL80211_CMD_SET_MPATH,
10903                 .doit = nl80211_set_mpath,
10904                 .policy = nl80211_policy,
10905                 .flags = GENL_ADMIN_PERM,
10906                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10907                                   NL80211_FLAG_NEED_RTNL,
10908         },
10909         {
10910                 .cmd = NL80211_CMD_NEW_MPATH,
10911                 .doit = nl80211_new_mpath,
10912                 .policy = nl80211_policy,
10913                 .flags = GENL_ADMIN_PERM,
10914                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10915                                   NL80211_FLAG_NEED_RTNL,
10916         },
10917         {
10918                 .cmd = NL80211_CMD_DEL_MPATH,
10919                 .doit = nl80211_del_mpath,
10920                 .policy = nl80211_policy,
10921                 .flags = GENL_ADMIN_PERM,
10922                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10923                                   NL80211_FLAG_NEED_RTNL,
10924         },
10925         {
10926                 .cmd = NL80211_CMD_SET_BSS,
10927                 .doit = nl80211_set_bss,
10928                 .policy = nl80211_policy,
10929                 .flags = GENL_ADMIN_PERM,
10930                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10931                                   NL80211_FLAG_NEED_RTNL,
10932         },
10933         {
10934                 .cmd = NL80211_CMD_GET_REG,
10935                 .doit = nl80211_get_reg_do,
10936                 .dumpit = nl80211_get_reg_dump,
10937                 .policy = nl80211_policy,
10938                 .internal_flags = NL80211_FLAG_NEED_RTNL,
10939                 /* can be retrieved by unprivileged users */
10940         },
10941 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
10942         {
10943                 .cmd = NL80211_CMD_SET_REG,
10944                 .doit = nl80211_set_reg,
10945                 .policy = nl80211_policy,
10946                 .flags = GENL_ADMIN_PERM,
10947                 .internal_flags = NL80211_FLAG_NEED_RTNL,
10948         },
10949 #endif
10950         {
10951                 .cmd = NL80211_CMD_REQ_SET_REG,
10952                 .doit = nl80211_req_set_reg,
10953                 .policy = nl80211_policy,
10954                 .flags = GENL_ADMIN_PERM,
10955         },
10956         {
10957                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
10958                 .doit = nl80211_get_mesh_config,
10959                 .policy = nl80211_policy,
10960                 /* can be retrieved by unprivileged users */
10961                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10962                                   NL80211_FLAG_NEED_RTNL,
10963         },
10964         {
10965                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
10966                 .doit = nl80211_update_mesh_config,
10967                 .policy = nl80211_policy,
10968                 .flags = GENL_ADMIN_PERM,
10969                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10970                                   NL80211_FLAG_NEED_RTNL,
10971         },
10972         {
10973                 .cmd = NL80211_CMD_TRIGGER_SCAN,
10974                 .doit = nl80211_trigger_scan,
10975                 .policy = nl80211_policy,
10976                 .flags = GENL_ADMIN_PERM,
10977                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10978                                   NL80211_FLAG_NEED_RTNL,
10979         },
10980         {
10981                 .cmd = NL80211_CMD_ABORT_SCAN,
10982                 .doit = nl80211_abort_scan,
10983                 .policy = nl80211_policy,
10984                 .flags = GENL_ADMIN_PERM,
10985                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10986                                   NL80211_FLAG_NEED_RTNL,
10987         },
10988         {
10989                 .cmd = NL80211_CMD_GET_SCAN,
10990                 .policy = nl80211_policy,
10991                 .dumpit = nl80211_dump_scan,
10992         },
10993         {
10994                 .cmd = NL80211_CMD_START_SCHED_SCAN,
10995                 .doit = nl80211_start_sched_scan,
10996                 .policy = nl80211_policy,
10997                 .flags = GENL_ADMIN_PERM,
10998                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10999                                   NL80211_FLAG_NEED_RTNL,
11000         },
11001         {
11002                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
11003                 .doit = nl80211_stop_sched_scan,
11004                 .policy = nl80211_policy,
11005                 .flags = GENL_ADMIN_PERM,
11006                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11007                                   NL80211_FLAG_NEED_RTNL,
11008         },
11009         {
11010                 .cmd = NL80211_CMD_AUTHENTICATE,
11011                 .doit = nl80211_authenticate,
11012                 .policy = nl80211_policy,
11013                 .flags = GENL_ADMIN_PERM,
11014                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11015                                   NL80211_FLAG_NEED_RTNL |
11016                                   NL80211_FLAG_CLEAR_SKB,
11017         },
11018         {
11019                 .cmd = NL80211_CMD_ASSOCIATE,
11020                 .doit = nl80211_associate,
11021                 .policy = nl80211_policy,
11022                 .flags = GENL_ADMIN_PERM,
11023                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11024                                   NL80211_FLAG_NEED_RTNL,
11025         },
11026         {
11027                 .cmd = NL80211_CMD_DEAUTHENTICATE,
11028                 .doit = nl80211_deauthenticate,
11029                 .policy = nl80211_policy,
11030                 .flags = GENL_ADMIN_PERM,
11031                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11032                                   NL80211_FLAG_NEED_RTNL,
11033         },
11034         {
11035                 .cmd = NL80211_CMD_DISASSOCIATE,
11036                 .doit = nl80211_disassociate,
11037                 .policy = nl80211_policy,
11038                 .flags = GENL_ADMIN_PERM,
11039                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11040                                   NL80211_FLAG_NEED_RTNL,
11041         },
11042         {
11043                 .cmd = NL80211_CMD_JOIN_IBSS,
11044                 .doit = nl80211_join_ibss,
11045                 .policy = nl80211_policy,
11046                 .flags = GENL_ADMIN_PERM,
11047                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11048                                   NL80211_FLAG_NEED_RTNL,
11049         },
11050         {
11051                 .cmd = NL80211_CMD_LEAVE_IBSS,
11052                 .doit = nl80211_leave_ibss,
11053                 .policy = nl80211_policy,
11054                 .flags = GENL_ADMIN_PERM,
11055                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11056                                   NL80211_FLAG_NEED_RTNL,
11057         },
11058 #ifdef CONFIG_NL80211_TESTMODE
11059         {
11060                 .cmd = NL80211_CMD_TESTMODE,
11061                 .doit = nl80211_testmode_do,
11062                 .dumpit = nl80211_testmode_dump,
11063                 .policy = nl80211_policy,
11064                 .flags = GENL_ADMIN_PERM,
11065                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11066                                   NL80211_FLAG_NEED_RTNL,
11067         },
11068 #endif
11069         {
11070                 .cmd = NL80211_CMD_CONNECT,
11071                 .doit = nl80211_connect,
11072                 .policy = nl80211_policy,
11073                 .flags = GENL_ADMIN_PERM,
11074                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11075                                   NL80211_FLAG_NEED_RTNL,
11076         },
11077         {
11078                 .cmd = NL80211_CMD_DISCONNECT,
11079                 .doit = nl80211_disconnect,
11080                 .policy = nl80211_policy,
11081                 .flags = GENL_ADMIN_PERM,
11082                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11083                                   NL80211_FLAG_NEED_RTNL,
11084         },
11085         {
11086                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
11087                 .doit = nl80211_wiphy_netns,
11088                 .policy = nl80211_policy,
11089                 .flags = GENL_ADMIN_PERM,
11090                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11091                                   NL80211_FLAG_NEED_RTNL,
11092         },
11093         {
11094                 .cmd = NL80211_CMD_GET_SURVEY,
11095                 .policy = nl80211_policy,
11096                 .dumpit = nl80211_dump_survey,
11097         },
11098         {
11099                 .cmd = NL80211_CMD_SET_PMKSA,
11100                 .doit = nl80211_setdel_pmksa,
11101                 .policy = nl80211_policy,
11102                 .flags = GENL_ADMIN_PERM,
11103                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11104                                   NL80211_FLAG_NEED_RTNL,
11105         },
11106         {
11107                 .cmd = NL80211_CMD_DEL_PMKSA,
11108                 .doit = nl80211_setdel_pmksa,
11109                 .policy = nl80211_policy,
11110                 .flags = GENL_ADMIN_PERM,
11111                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11112                                   NL80211_FLAG_NEED_RTNL,
11113         },
11114         {
11115                 .cmd = NL80211_CMD_FLUSH_PMKSA,
11116                 .doit = nl80211_flush_pmksa,
11117                 .policy = nl80211_policy,
11118                 .flags = GENL_ADMIN_PERM,
11119                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11120                                   NL80211_FLAG_NEED_RTNL,
11121         },
11122         {
11123                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
11124                 .doit = nl80211_remain_on_channel,
11125                 .policy = nl80211_policy,
11126                 .flags = GENL_ADMIN_PERM,
11127                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11128                                   NL80211_FLAG_NEED_RTNL,
11129         },
11130         {
11131                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
11132                 .doit = nl80211_cancel_remain_on_channel,
11133                 .policy = nl80211_policy,
11134                 .flags = GENL_ADMIN_PERM,
11135                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11136                                   NL80211_FLAG_NEED_RTNL,
11137         },
11138         {
11139                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
11140                 .doit = nl80211_set_tx_bitrate_mask,
11141                 .policy = nl80211_policy,
11142                 .flags = GENL_ADMIN_PERM,
11143                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11144                                   NL80211_FLAG_NEED_RTNL,
11145         },
11146         {
11147                 .cmd = NL80211_CMD_REGISTER_FRAME,
11148                 .doit = nl80211_register_mgmt,
11149                 .policy = nl80211_policy,
11150                 .flags = GENL_ADMIN_PERM,
11151                 .internal_flags = NL80211_FLAG_NEED_WDEV |
11152                                   NL80211_FLAG_NEED_RTNL,
11153         },
11154         {
11155                 .cmd = NL80211_CMD_FRAME,
11156                 .doit = nl80211_tx_mgmt,
11157                 .policy = nl80211_policy,
11158                 .flags = GENL_ADMIN_PERM,
11159                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11160                                   NL80211_FLAG_NEED_RTNL,
11161         },
11162         {
11163                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
11164                 .doit = nl80211_tx_mgmt_cancel_wait,
11165                 .policy = nl80211_policy,
11166                 .flags = GENL_ADMIN_PERM,
11167                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11168                                   NL80211_FLAG_NEED_RTNL,
11169         },
11170         {
11171                 .cmd = NL80211_CMD_SET_POWER_SAVE,
11172                 .doit = nl80211_set_power_save,
11173                 .policy = nl80211_policy,
11174                 .flags = GENL_ADMIN_PERM,
11175                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11176                                   NL80211_FLAG_NEED_RTNL,
11177         },
11178         {
11179                 .cmd = NL80211_CMD_GET_POWER_SAVE,
11180                 .doit = nl80211_get_power_save,
11181                 .policy = nl80211_policy,
11182                 /* can be retrieved by unprivileged users */
11183                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11184                                   NL80211_FLAG_NEED_RTNL,
11185         },
11186         {
11187                 .cmd = NL80211_CMD_SET_CQM,
11188                 .doit = nl80211_set_cqm,
11189                 .policy = nl80211_policy,
11190                 .flags = GENL_ADMIN_PERM,
11191                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11192                                   NL80211_FLAG_NEED_RTNL,
11193         },
11194         {
11195                 .cmd = NL80211_CMD_SET_CHANNEL,
11196                 .doit = nl80211_set_channel,
11197                 .policy = nl80211_policy,
11198                 .flags = GENL_ADMIN_PERM,
11199                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11200                                   NL80211_FLAG_NEED_RTNL,
11201         },
11202         {
11203                 .cmd = NL80211_CMD_SET_WDS_PEER,
11204                 .doit = nl80211_set_wds_peer,
11205                 .policy = nl80211_policy,
11206                 .flags = GENL_ADMIN_PERM,
11207                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11208                                   NL80211_FLAG_NEED_RTNL,
11209         },
11210         {
11211                 .cmd = NL80211_CMD_JOIN_MESH,
11212                 .doit = nl80211_join_mesh,
11213                 .policy = nl80211_policy,
11214                 .flags = GENL_ADMIN_PERM,
11215                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11216                                   NL80211_FLAG_NEED_RTNL,
11217         },
11218         {
11219                 .cmd = NL80211_CMD_LEAVE_MESH,
11220                 .doit = nl80211_leave_mesh,
11221                 .policy = nl80211_policy,
11222                 .flags = GENL_ADMIN_PERM,
11223                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11224                                   NL80211_FLAG_NEED_RTNL,
11225         },
11226         {
11227                 .cmd = NL80211_CMD_JOIN_OCB,
11228                 .doit = nl80211_join_ocb,
11229                 .policy = nl80211_policy,
11230                 .flags = GENL_ADMIN_PERM,
11231                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11232                                   NL80211_FLAG_NEED_RTNL,
11233         },
11234         {
11235                 .cmd = NL80211_CMD_LEAVE_OCB,
11236                 .doit = nl80211_leave_ocb,
11237                 .policy = nl80211_policy,
11238                 .flags = GENL_ADMIN_PERM,
11239                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11240                                   NL80211_FLAG_NEED_RTNL,
11241         },
11242 #ifdef CONFIG_PM
11243         {
11244                 .cmd = NL80211_CMD_GET_WOWLAN,
11245                 .doit = nl80211_get_wowlan,
11246                 .policy = nl80211_policy,
11247                 /* can be retrieved by unprivileged users */
11248                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11249                                   NL80211_FLAG_NEED_RTNL,
11250         },
11251         {
11252                 .cmd = NL80211_CMD_SET_WOWLAN,
11253                 .doit = nl80211_set_wowlan,
11254                 .policy = nl80211_policy,
11255                 .flags = GENL_ADMIN_PERM,
11256                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11257                                   NL80211_FLAG_NEED_RTNL,
11258         },
11259 #endif
11260         {
11261                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
11262                 .doit = nl80211_set_rekey_data,
11263                 .policy = nl80211_policy,
11264                 .flags = GENL_ADMIN_PERM,
11265                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11266                                   NL80211_FLAG_NEED_RTNL |
11267                                   NL80211_FLAG_CLEAR_SKB,
11268         },
11269         {
11270                 .cmd = NL80211_CMD_TDLS_MGMT,
11271                 .doit = nl80211_tdls_mgmt,
11272                 .policy = nl80211_policy,
11273                 .flags = GENL_ADMIN_PERM,
11274                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11275                                   NL80211_FLAG_NEED_RTNL,
11276         },
11277         {
11278                 .cmd = NL80211_CMD_TDLS_OPER,
11279                 .doit = nl80211_tdls_oper,
11280                 .policy = nl80211_policy,
11281                 .flags = GENL_ADMIN_PERM,
11282                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11283                                   NL80211_FLAG_NEED_RTNL,
11284         },
11285         {
11286                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
11287                 .doit = nl80211_register_unexpected_frame,
11288                 .policy = nl80211_policy,
11289                 .flags = GENL_ADMIN_PERM,
11290                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11291                                   NL80211_FLAG_NEED_RTNL,
11292         },
11293         {
11294                 .cmd = NL80211_CMD_PROBE_CLIENT,
11295                 .doit = nl80211_probe_client,
11296                 .policy = nl80211_policy,
11297                 .flags = GENL_ADMIN_PERM,
11298                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11299                                   NL80211_FLAG_NEED_RTNL,
11300         },
11301         {
11302                 .cmd = NL80211_CMD_REGISTER_BEACONS,
11303                 .doit = nl80211_register_beacons,
11304                 .policy = nl80211_policy,
11305                 .flags = GENL_ADMIN_PERM,
11306                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11307                                   NL80211_FLAG_NEED_RTNL,
11308         },
11309         {
11310                 .cmd = NL80211_CMD_SET_NOACK_MAP,
11311                 .doit = nl80211_set_noack_map,
11312                 .policy = nl80211_policy,
11313                 .flags = GENL_ADMIN_PERM,
11314                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11315                                   NL80211_FLAG_NEED_RTNL,
11316         },
11317         {
11318                 .cmd = NL80211_CMD_START_P2P_DEVICE,
11319                 .doit = nl80211_start_p2p_device,
11320                 .policy = nl80211_policy,
11321                 .flags = GENL_ADMIN_PERM,
11322                 .internal_flags = NL80211_FLAG_NEED_WDEV |
11323                                   NL80211_FLAG_NEED_RTNL,
11324         },
11325         {
11326                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
11327                 .doit = nl80211_stop_p2p_device,
11328                 .policy = nl80211_policy,
11329                 .flags = GENL_ADMIN_PERM,
11330                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11331                                   NL80211_FLAG_NEED_RTNL,
11332         },
11333         {
11334                 .cmd = NL80211_CMD_SET_MCAST_RATE,
11335                 .doit = nl80211_set_mcast_rate,
11336                 .policy = nl80211_policy,
11337                 .flags = GENL_ADMIN_PERM,
11338                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11339                                   NL80211_FLAG_NEED_RTNL,
11340         },
11341         {
11342                 .cmd = NL80211_CMD_SET_MAC_ACL,
11343                 .doit = nl80211_set_mac_acl,
11344                 .policy = nl80211_policy,
11345                 .flags = GENL_ADMIN_PERM,
11346                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11347                                   NL80211_FLAG_NEED_RTNL,
11348         },
11349         {
11350                 .cmd = NL80211_CMD_RADAR_DETECT,
11351                 .doit = nl80211_start_radar_detection,
11352                 .policy = nl80211_policy,
11353                 .flags = GENL_ADMIN_PERM,
11354                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11355                                   NL80211_FLAG_NEED_RTNL,
11356         },
11357         {
11358                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
11359                 .doit = nl80211_get_protocol_features,
11360                 .policy = nl80211_policy,
11361         },
11362         {
11363                 .cmd = NL80211_CMD_UPDATE_FT_IES,
11364                 .doit = nl80211_update_ft_ies,
11365                 .policy = nl80211_policy,
11366                 .flags = GENL_ADMIN_PERM,
11367                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11368                                   NL80211_FLAG_NEED_RTNL,
11369         },
11370         {
11371                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
11372                 .doit = nl80211_crit_protocol_start,
11373                 .policy = nl80211_policy,
11374                 .flags = GENL_ADMIN_PERM,
11375                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11376                                   NL80211_FLAG_NEED_RTNL,
11377         },
11378         {
11379                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
11380                 .doit = nl80211_crit_protocol_stop,
11381                 .policy = nl80211_policy,
11382                 .flags = GENL_ADMIN_PERM,
11383                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11384                                   NL80211_FLAG_NEED_RTNL,
11385         },
11386         {
11387                 .cmd = NL80211_CMD_GET_COALESCE,
11388                 .doit = nl80211_get_coalesce,
11389                 .policy = nl80211_policy,
11390                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11391                                   NL80211_FLAG_NEED_RTNL,
11392         },
11393         {
11394                 .cmd = NL80211_CMD_SET_COALESCE,
11395                 .doit = nl80211_set_coalesce,
11396                 .policy = nl80211_policy,
11397                 .flags = GENL_ADMIN_PERM,
11398                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11399                                   NL80211_FLAG_NEED_RTNL,
11400         },
11401         {
11402                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
11403                 .doit = nl80211_channel_switch,
11404                 .policy = nl80211_policy,
11405                 .flags = GENL_ADMIN_PERM,
11406                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11407                                   NL80211_FLAG_NEED_RTNL,
11408         },
11409         {
11410                 .cmd = NL80211_CMD_VENDOR,
11411                 .doit = nl80211_vendor_cmd,
11412                 .dumpit = nl80211_vendor_cmd_dump,
11413                 .policy = nl80211_policy,
11414                 .flags = GENL_ADMIN_PERM,
11415                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11416                                   NL80211_FLAG_NEED_RTNL,
11417         },
11418         {
11419                 .cmd = NL80211_CMD_SET_QOS_MAP,
11420                 .doit = nl80211_set_qos_map,
11421                 .policy = nl80211_policy,
11422                 .flags = GENL_ADMIN_PERM,
11423                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11424                                   NL80211_FLAG_NEED_RTNL,
11425         },
11426         {
11427                 .cmd = NL80211_CMD_ADD_TX_TS,
11428                 .doit = nl80211_add_tx_ts,
11429                 .policy = nl80211_policy,
11430                 .flags = GENL_ADMIN_PERM,
11431                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11432                                   NL80211_FLAG_NEED_RTNL,
11433         },
11434         {
11435                 .cmd = NL80211_CMD_DEL_TX_TS,
11436                 .doit = nl80211_del_tx_ts,
11437                 .policy = nl80211_policy,
11438                 .flags = GENL_ADMIN_PERM,
11439                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11440                                   NL80211_FLAG_NEED_RTNL,
11441         },
11442         {
11443                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
11444                 .doit = nl80211_tdls_channel_switch,
11445                 .policy = nl80211_policy,
11446                 .flags = GENL_ADMIN_PERM,
11447                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11448                                   NL80211_FLAG_NEED_RTNL,
11449         },
11450         {
11451                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
11452                 .doit = nl80211_tdls_cancel_channel_switch,
11453                 .policy = nl80211_policy,
11454                 .flags = GENL_ADMIN_PERM,
11455                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11456                                   NL80211_FLAG_NEED_RTNL,
11457         },
11458 };
11459
11460 /* notification functions */
11461
11462 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
11463                           enum nl80211_commands cmd)
11464 {
11465         struct sk_buff *msg;
11466         struct nl80211_dump_wiphy_state state = {};
11467
11468         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
11469                 cmd != NL80211_CMD_DEL_WIPHY);
11470
11471         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11472         if (!msg)
11473                 return;
11474
11475         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
11476                 nlmsg_free(msg);
11477                 return;
11478         }
11479
11480         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11481                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
11482 }
11483
11484 static int nl80211_add_scan_req(struct sk_buff *msg,
11485                                 struct cfg80211_registered_device *rdev)
11486 {
11487         struct cfg80211_scan_request *req = rdev->scan_req;
11488         struct nlattr *nest;
11489         int i;
11490
11491         if (WARN_ON(!req))
11492                 return 0;
11493
11494         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
11495         if (!nest)
11496                 goto nla_put_failure;
11497         for (i = 0; i < req->n_ssids; i++) {
11498                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
11499                         goto nla_put_failure;
11500         }
11501         nla_nest_end(msg, nest);
11502
11503         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
11504         if (!nest)
11505                 goto nla_put_failure;
11506         for (i = 0; i < req->n_channels; i++) {
11507                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
11508                         goto nla_put_failure;
11509         }
11510         nla_nest_end(msg, nest);
11511
11512         if (req->ie &&
11513             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
11514                 goto nla_put_failure;
11515
11516         if (req->flags &&
11517             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
11518                 goto nla_put_failure;
11519
11520         return 0;
11521  nla_put_failure:
11522         return -ENOBUFS;
11523 }
11524
11525 static int nl80211_send_scan_msg(struct sk_buff *msg,
11526                                  struct cfg80211_registered_device *rdev,
11527                                  struct wireless_dev *wdev,
11528                                  u32 portid, u32 seq, int flags,
11529                                  u32 cmd)
11530 {
11531         void *hdr;
11532
11533         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
11534         if (!hdr)
11535                 return -1;
11536
11537         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11538             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11539                                          wdev->netdev->ifindex)) ||
11540             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11541                 goto nla_put_failure;
11542
11543         /* ignore errors and send incomplete event anyway */
11544         nl80211_add_scan_req(msg, rdev);
11545
11546         genlmsg_end(msg, hdr);
11547         return 0;
11548
11549  nla_put_failure:
11550         genlmsg_cancel(msg, hdr);
11551         return -EMSGSIZE;
11552 }
11553
11554 static int
11555 nl80211_send_sched_scan_msg(struct sk_buff *msg,
11556                             struct cfg80211_registered_device *rdev,
11557                             struct net_device *netdev,
11558                             u32 portid, u32 seq, int flags, u32 cmd)
11559 {
11560         void *hdr;
11561
11562         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
11563         if (!hdr)
11564                 return -1;
11565
11566         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11567             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
11568                 goto nla_put_failure;
11569
11570         genlmsg_end(msg, hdr);
11571         return 0;
11572
11573  nla_put_failure:
11574         genlmsg_cancel(msg, hdr);
11575         return -EMSGSIZE;
11576 }
11577
11578 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
11579                              struct wireless_dev *wdev)
11580 {
11581         struct sk_buff *msg;
11582
11583         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11584         if (!msg)
11585                 return;
11586
11587         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
11588                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
11589                 nlmsg_free(msg);
11590                 return;
11591         }
11592
11593         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11594                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
11595 }
11596
11597 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
11598                                        struct wireless_dev *wdev, bool aborted)
11599 {
11600         struct sk_buff *msg;
11601
11602         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11603         if (!msg)
11604                 return NULL;
11605
11606         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
11607                                   aborted ? NL80211_CMD_SCAN_ABORTED :
11608                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
11609                 nlmsg_free(msg);
11610                 return NULL;
11611         }
11612
11613         return msg;
11614 }
11615
11616 void nl80211_send_scan_result(struct cfg80211_registered_device *rdev,
11617                               struct sk_buff *msg)
11618 {
11619         if (!msg)
11620                 return;
11621
11622         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11623                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
11624 }
11625
11626 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
11627                                      struct net_device *netdev)
11628 {
11629         struct sk_buff *msg;
11630
11631         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11632         if (!msg)
11633                 return;
11634
11635         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
11636                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
11637                 nlmsg_free(msg);
11638                 return;
11639         }
11640
11641         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11642                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
11643 }
11644
11645 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
11646                              struct net_device *netdev, u32 cmd)
11647 {
11648         struct sk_buff *msg;
11649
11650         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11651         if (!msg)
11652                 return;
11653
11654         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
11655                 nlmsg_free(msg);
11656                 return;
11657         }
11658
11659         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11660                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
11661 }
11662
11663 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
11664                                           struct regulatory_request *request)
11665 {
11666         /* Userspace can always count this one always being set */
11667         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
11668                 goto nla_put_failure;
11669
11670         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
11671                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
11672                                NL80211_REGDOM_TYPE_WORLD))
11673                         goto nla_put_failure;
11674         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
11675                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
11676                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
11677                         goto nla_put_failure;
11678         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
11679                    request->intersect) {
11680                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
11681                                NL80211_REGDOM_TYPE_INTERSECTION))
11682                         goto nla_put_failure;
11683         } else {
11684                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
11685                                NL80211_REGDOM_TYPE_COUNTRY) ||
11686                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
11687                                    request->alpha2))
11688                         goto nla_put_failure;
11689         }
11690
11691         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
11692                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
11693
11694                 if (wiphy &&
11695                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
11696                         goto nla_put_failure;
11697
11698                 if (wiphy &&
11699                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
11700                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
11701                         goto nla_put_failure;
11702         }
11703
11704         return true;
11705
11706 nla_put_failure:
11707         return false;
11708 }
11709
11710 /*
11711  * This can happen on global regulatory changes or device specific settings
11712  * based on custom regulatory domains.
11713  */
11714 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
11715                                      struct regulatory_request *request)
11716 {
11717         struct sk_buff *msg;
11718         void *hdr;
11719
11720         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11721         if (!msg)
11722                 return;
11723
11724         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
11725         if (!hdr) {
11726                 nlmsg_free(msg);
11727                 return;
11728         }
11729
11730         if (nl80211_reg_change_event_fill(msg, request) == false)
11731                 goto nla_put_failure;
11732
11733         genlmsg_end(msg, hdr);
11734
11735         rcu_read_lock();
11736         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
11737                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
11738         rcu_read_unlock();
11739
11740         return;
11741
11742 nla_put_failure:
11743         genlmsg_cancel(msg, hdr);
11744         nlmsg_free(msg);
11745 }
11746
11747 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
11748                                     struct net_device *netdev,
11749                                     const u8 *buf, size_t len,
11750                                     enum nl80211_commands cmd, gfp_t gfp,
11751                                     int uapsd_queues)
11752 {
11753         struct sk_buff *msg;
11754         void *hdr;
11755
11756         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11757         if (!msg)
11758                 return;
11759
11760         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
11761         if (!hdr) {
11762                 nlmsg_free(msg);
11763                 return;
11764         }
11765
11766         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11767             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11768             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
11769                 goto nla_put_failure;
11770
11771         if (uapsd_queues >= 0) {
11772                 struct nlattr *nla_wmm =
11773                         nla_nest_start(msg, NL80211_ATTR_STA_WME);
11774                 if (!nla_wmm)
11775                         goto nla_put_failure;
11776
11777                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
11778                                uapsd_queues))
11779                         goto nla_put_failure;
11780
11781                 nla_nest_end(msg, nla_wmm);
11782         }
11783
11784         genlmsg_end(msg, hdr);
11785
11786         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11787                                 NL80211_MCGRP_MLME, gfp);
11788         return;
11789
11790  nla_put_failure:
11791         genlmsg_cancel(msg, hdr);
11792         nlmsg_free(msg);
11793 }
11794
11795 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
11796                           struct net_device *netdev, const u8 *buf,
11797                           size_t len, gfp_t gfp)
11798 {
11799         nl80211_send_mlme_event(rdev, netdev, buf, len,
11800                                 NL80211_CMD_AUTHENTICATE, gfp, -1);
11801 }
11802
11803 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
11804                            struct net_device *netdev, const u8 *buf,
11805                            size_t len, gfp_t gfp, int uapsd_queues)
11806 {
11807         nl80211_send_mlme_event(rdev, netdev, buf, len,
11808                                 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues);
11809 }
11810
11811 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
11812                          struct net_device *netdev, const u8 *buf,
11813                          size_t len, gfp_t gfp)
11814 {
11815         nl80211_send_mlme_event(rdev, netdev, buf, len,
11816                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1);
11817 }
11818
11819 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
11820                            struct net_device *netdev, const u8 *buf,
11821                            size_t len, gfp_t gfp)
11822 {
11823         nl80211_send_mlme_event(rdev, netdev, buf, len,
11824                                 NL80211_CMD_DISASSOCIATE, gfp, -1);
11825 }
11826
11827 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
11828                                   size_t len)
11829 {
11830         struct wireless_dev *wdev = dev->ieee80211_ptr;
11831         struct wiphy *wiphy = wdev->wiphy;
11832         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11833         const struct ieee80211_mgmt *mgmt = (void *)buf;
11834         u32 cmd;
11835
11836         if (WARN_ON(len < 2))
11837                 return;
11838
11839         if (ieee80211_is_deauth(mgmt->frame_control))
11840                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
11841         else
11842                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
11843
11844         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
11845         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1);
11846 }
11847 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
11848
11849 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
11850                                       struct net_device *netdev, int cmd,
11851                                       const u8 *addr, gfp_t gfp)
11852 {
11853         struct sk_buff *msg;
11854         void *hdr;
11855
11856         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11857         if (!msg)
11858                 return;
11859
11860         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
11861         if (!hdr) {
11862                 nlmsg_free(msg);
11863                 return;
11864         }
11865
11866         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11867             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11868             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
11869             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
11870                 goto nla_put_failure;
11871
11872         genlmsg_end(msg, hdr);
11873
11874         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11875                                 NL80211_MCGRP_MLME, gfp);
11876         return;
11877
11878  nla_put_failure:
11879         genlmsg_cancel(msg, hdr);
11880         nlmsg_free(msg);
11881 }
11882
11883 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
11884                                struct net_device *netdev, const u8 *addr,
11885                                gfp_t gfp)
11886 {
11887         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
11888                                   addr, gfp);
11889 }
11890
11891 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
11892                                 struct net_device *netdev, const u8 *addr,
11893                                 gfp_t gfp)
11894 {
11895         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
11896                                   addr, gfp);
11897 }
11898
11899 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
11900                                  struct net_device *netdev, const u8 *bssid,
11901                                  const u8 *req_ie, size_t req_ie_len,
11902                                  const u8 *resp_ie, size_t resp_ie_len,
11903                                  u16 status, gfp_t gfp)
11904 {
11905         struct sk_buff *msg;
11906         void *hdr;
11907
11908         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11909         if (!msg)
11910                 return;
11911
11912         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
11913         if (!hdr) {
11914                 nlmsg_free(msg);
11915                 return;
11916         }
11917
11918         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11919             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11920             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
11921             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
11922             (req_ie &&
11923              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
11924             (resp_ie &&
11925              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
11926                 goto nla_put_failure;
11927
11928         genlmsg_end(msg, hdr);
11929
11930         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11931                                 NL80211_MCGRP_MLME, gfp);
11932         return;
11933
11934  nla_put_failure:
11935         genlmsg_cancel(msg, hdr);
11936         nlmsg_free(msg);
11937
11938 }
11939
11940 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
11941                          struct net_device *netdev, const u8 *bssid,
11942                          const u8 *req_ie, size_t req_ie_len,
11943                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
11944 {
11945         struct sk_buff *msg;
11946         void *hdr;
11947
11948         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11949         if (!msg)
11950                 return;
11951
11952         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
11953         if (!hdr) {
11954                 nlmsg_free(msg);
11955                 return;
11956         }
11957
11958         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11959             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11960             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
11961             (req_ie &&
11962              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
11963             (resp_ie &&
11964              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
11965                 goto nla_put_failure;
11966
11967         genlmsg_end(msg, hdr);
11968
11969         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11970                                 NL80211_MCGRP_MLME, gfp);
11971         return;
11972
11973  nla_put_failure:
11974         genlmsg_cancel(msg, hdr);
11975         nlmsg_free(msg);
11976
11977 }
11978
11979 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
11980                                struct net_device *netdev, u16 reason,
11981                                const u8 *ie, size_t ie_len, bool from_ap)
11982 {
11983         struct sk_buff *msg;
11984         void *hdr;
11985
11986         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11987         if (!msg)
11988                 return;
11989
11990         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
11991         if (!hdr) {
11992                 nlmsg_free(msg);
11993                 return;
11994         }
11995
11996         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11997             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11998             (from_ap && reason &&
11999              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
12000             (from_ap &&
12001              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
12002             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
12003                 goto nla_put_failure;
12004
12005         genlmsg_end(msg, hdr);
12006
12007         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12008                                 NL80211_MCGRP_MLME, GFP_KERNEL);
12009         return;
12010
12011  nla_put_failure:
12012         genlmsg_cancel(msg, hdr);
12013         nlmsg_free(msg);
12014
12015 }
12016
12017 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
12018                              struct net_device *netdev, const u8 *bssid,
12019                              gfp_t gfp)
12020 {
12021         struct sk_buff *msg;
12022         void *hdr;
12023
12024         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12025         if (!msg)
12026                 return;
12027
12028         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
12029         if (!hdr) {
12030                 nlmsg_free(msg);
12031                 return;
12032         }
12033
12034         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12035             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12036             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
12037                 goto nla_put_failure;
12038
12039         genlmsg_end(msg, hdr);
12040
12041         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12042                                 NL80211_MCGRP_MLME, gfp);
12043         return;
12044
12045  nla_put_failure:
12046         genlmsg_cancel(msg, hdr);
12047         nlmsg_free(msg);
12048 }
12049
12050 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
12051                                         const u8* ie, u8 ie_len, gfp_t gfp)
12052 {
12053         struct wireless_dev *wdev = dev->ieee80211_ptr;
12054         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12055         struct sk_buff *msg;
12056         void *hdr;
12057
12058         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
12059                 return;
12060
12061         trace_cfg80211_notify_new_peer_candidate(dev, addr);
12062
12063         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12064         if (!msg)
12065                 return;
12066
12067         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
12068         if (!hdr) {
12069                 nlmsg_free(msg);
12070                 return;
12071         }
12072
12073         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12074             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
12075             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
12076             (ie_len && ie &&
12077              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
12078                 goto nla_put_failure;
12079
12080         genlmsg_end(msg, hdr);
12081
12082         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12083                                 NL80211_MCGRP_MLME, gfp);
12084         return;
12085
12086  nla_put_failure:
12087         genlmsg_cancel(msg, hdr);
12088         nlmsg_free(msg);
12089 }
12090 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
12091
12092 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
12093                                  struct net_device *netdev, const u8 *addr,
12094                                  enum nl80211_key_type key_type, int key_id,
12095                                  const u8 *tsc, gfp_t gfp)
12096 {
12097         struct sk_buff *msg;
12098         void *hdr;
12099
12100         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12101         if (!msg)
12102                 return;
12103
12104         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
12105         if (!hdr) {
12106                 nlmsg_free(msg);
12107                 return;
12108         }
12109
12110         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12111             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12112             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
12113             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
12114             (key_id != -1 &&
12115              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
12116             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
12117                 goto nla_put_failure;
12118
12119         genlmsg_end(msg, hdr);
12120
12121         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12122                                 NL80211_MCGRP_MLME, gfp);
12123         return;
12124
12125  nla_put_failure:
12126         genlmsg_cancel(msg, hdr);
12127         nlmsg_free(msg);
12128 }
12129
12130 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
12131                                     struct ieee80211_channel *channel_before,
12132                                     struct ieee80211_channel *channel_after)
12133 {
12134         struct sk_buff *msg;
12135         void *hdr;
12136         struct nlattr *nl_freq;
12137
12138         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
12139         if (!msg)
12140                 return;
12141
12142         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
12143         if (!hdr) {
12144                 nlmsg_free(msg);
12145                 return;
12146         }
12147
12148         /*
12149          * Since we are applying the beacon hint to a wiphy we know its
12150          * wiphy_idx is valid
12151          */
12152         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
12153                 goto nla_put_failure;
12154
12155         /* Before */
12156         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
12157         if (!nl_freq)
12158                 goto nla_put_failure;
12159         if (nl80211_msg_put_channel(msg, channel_before, false))
12160                 goto nla_put_failure;
12161         nla_nest_end(msg, nl_freq);
12162
12163         /* After */
12164         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
12165         if (!nl_freq)
12166                 goto nla_put_failure;
12167         if (nl80211_msg_put_channel(msg, channel_after, false))
12168                 goto nla_put_failure;
12169         nla_nest_end(msg, nl_freq);
12170
12171         genlmsg_end(msg, hdr);
12172
12173         rcu_read_lock();
12174         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
12175                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
12176         rcu_read_unlock();
12177
12178         return;
12179
12180 nla_put_failure:
12181         genlmsg_cancel(msg, hdr);
12182         nlmsg_free(msg);
12183 }
12184
12185 static void nl80211_send_remain_on_chan_event(
12186         int cmd, struct cfg80211_registered_device *rdev,
12187         struct wireless_dev *wdev, u64 cookie,
12188         struct ieee80211_channel *chan,
12189         unsigned int duration, gfp_t gfp)
12190 {
12191         struct sk_buff *msg;
12192         void *hdr;
12193
12194         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12195         if (!msg)
12196                 return;
12197
12198         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
12199         if (!hdr) {
12200                 nlmsg_free(msg);
12201                 return;
12202         }
12203
12204         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12205             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12206                                          wdev->netdev->ifindex)) ||
12207             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
12208             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
12209             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
12210                         NL80211_CHAN_NO_HT) ||
12211             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
12212                 goto nla_put_failure;
12213
12214         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
12215             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
12216                 goto nla_put_failure;
12217
12218         genlmsg_end(msg, hdr);
12219
12220         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12221                                 NL80211_MCGRP_MLME, gfp);
12222         return;
12223
12224  nla_put_failure:
12225         genlmsg_cancel(msg, hdr);
12226         nlmsg_free(msg);
12227 }
12228
12229 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
12230                                struct ieee80211_channel *chan,
12231                                unsigned int duration, gfp_t gfp)
12232 {
12233         struct wiphy *wiphy = wdev->wiphy;
12234         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12235
12236         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
12237         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
12238                                           rdev, wdev, cookie, chan,
12239                                           duration, gfp);
12240 }
12241 EXPORT_SYMBOL(cfg80211_ready_on_channel);
12242
12243 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
12244                                         struct ieee80211_channel *chan,
12245                                         gfp_t gfp)
12246 {
12247         struct wiphy *wiphy = wdev->wiphy;
12248         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12249
12250         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
12251         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
12252                                           rdev, wdev, cookie, chan, 0, gfp);
12253 }
12254 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
12255
12256 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
12257                       struct station_info *sinfo, gfp_t gfp)
12258 {
12259         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
12260         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12261         struct sk_buff *msg;
12262
12263         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
12264
12265         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12266         if (!msg)
12267                 return;
12268
12269         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
12270                                  rdev, dev, mac_addr, sinfo) < 0) {
12271                 nlmsg_free(msg);
12272                 return;
12273         }
12274
12275         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12276                                 NL80211_MCGRP_MLME, gfp);
12277 }
12278 EXPORT_SYMBOL(cfg80211_new_sta);
12279
12280 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
12281                             struct station_info *sinfo, gfp_t gfp)
12282 {
12283         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
12284         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12285         struct sk_buff *msg;
12286         struct station_info empty_sinfo = {};
12287
12288         if (!sinfo)
12289                 sinfo = &empty_sinfo;
12290
12291         trace_cfg80211_del_sta(dev, mac_addr);
12292
12293         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12294         if (!msg)
12295                 return;
12296
12297         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
12298                                  rdev, dev, mac_addr, sinfo) < 0) {
12299                 nlmsg_free(msg);
12300                 return;
12301         }
12302
12303         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12304                                 NL80211_MCGRP_MLME, gfp);
12305 }
12306 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
12307
12308 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
12309                           enum nl80211_connect_failed_reason reason,
12310                           gfp_t gfp)
12311 {
12312         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
12313         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12314         struct sk_buff *msg;
12315         void *hdr;
12316
12317         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
12318         if (!msg)
12319                 return;
12320
12321         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
12322         if (!hdr) {
12323                 nlmsg_free(msg);
12324                 return;
12325         }
12326
12327         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
12328             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
12329             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
12330                 goto nla_put_failure;
12331
12332         genlmsg_end(msg, hdr);
12333
12334         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12335                                 NL80211_MCGRP_MLME, gfp);
12336         return;
12337
12338  nla_put_failure:
12339         genlmsg_cancel(msg, hdr);
12340         nlmsg_free(msg);
12341 }
12342 EXPORT_SYMBOL(cfg80211_conn_failed);
12343
12344 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
12345                                        const u8 *addr, gfp_t gfp)
12346 {
12347         struct wireless_dev *wdev = dev->ieee80211_ptr;
12348         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12349         struct sk_buff *msg;
12350         void *hdr;
12351         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
12352
12353         if (!nlportid)
12354                 return false;
12355
12356         msg = nlmsg_new(100, gfp);
12357         if (!msg)
12358                 return true;
12359
12360         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
12361         if (!hdr) {
12362                 nlmsg_free(msg);
12363                 return true;
12364         }
12365
12366         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12367             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
12368             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
12369                 goto nla_put_failure;
12370
12371         genlmsg_end(msg, hdr);
12372         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
12373         return true;
12374
12375  nla_put_failure:
12376         genlmsg_cancel(msg, hdr);
12377         nlmsg_free(msg);
12378         return true;
12379 }
12380
12381 bool cfg80211_rx_spurious_frame(struct net_device *dev,
12382                                 const u8 *addr, gfp_t gfp)
12383 {
12384         struct wireless_dev *wdev = dev->ieee80211_ptr;
12385         bool ret;
12386
12387         trace_cfg80211_rx_spurious_frame(dev, addr);
12388
12389         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
12390                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
12391                 trace_cfg80211_return_bool(false);
12392                 return false;
12393         }
12394         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
12395                                          addr, gfp);
12396         trace_cfg80211_return_bool(ret);
12397         return ret;
12398 }
12399 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
12400
12401 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
12402                                         const u8 *addr, gfp_t gfp)
12403 {
12404         struct wireless_dev *wdev = dev->ieee80211_ptr;
12405         bool ret;
12406
12407         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
12408
12409         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
12410                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
12411                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
12412                 trace_cfg80211_return_bool(false);
12413                 return false;
12414         }
12415         ret = __nl80211_unexpected_frame(dev,
12416                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
12417                                          addr, gfp);
12418         trace_cfg80211_return_bool(ret);
12419         return ret;
12420 }
12421 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
12422
12423 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
12424                       struct wireless_dev *wdev, u32 nlportid,
12425                       int freq, int sig_dbm,
12426                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
12427 {
12428         struct net_device *netdev = wdev->netdev;
12429         struct sk_buff *msg;
12430         void *hdr;
12431
12432         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12433         if (!msg)
12434                 return -ENOMEM;
12435
12436         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
12437         if (!hdr) {
12438                 nlmsg_free(msg);
12439                 return -ENOMEM;
12440         }
12441
12442         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12443             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12444                                         netdev->ifindex)) ||
12445             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
12446             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
12447             (sig_dbm &&
12448              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
12449             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
12450             (flags &&
12451              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
12452                 goto nla_put_failure;
12453
12454         genlmsg_end(msg, hdr);
12455
12456         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
12457
12458  nla_put_failure:
12459         genlmsg_cancel(msg, hdr);
12460         nlmsg_free(msg);
12461         return -ENOBUFS;
12462 }
12463
12464 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
12465                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
12466 {
12467         struct wiphy *wiphy = wdev->wiphy;
12468         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12469         struct net_device *netdev = wdev->netdev;
12470         struct sk_buff *msg;
12471         void *hdr;
12472
12473         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
12474
12475         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12476         if (!msg)
12477                 return;
12478
12479         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
12480         if (!hdr) {
12481                 nlmsg_free(msg);
12482                 return;
12483         }
12484
12485         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12486             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12487                                    netdev->ifindex)) ||
12488             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
12489             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
12490             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
12491             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
12492                 goto nla_put_failure;
12493
12494         genlmsg_end(msg, hdr);
12495
12496         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12497                                 NL80211_MCGRP_MLME, gfp);
12498         return;
12499
12500  nla_put_failure:
12501         genlmsg_cancel(msg, hdr);
12502         nlmsg_free(msg);
12503 }
12504 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
12505
12506 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
12507                                             const char *mac, gfp_t gfp)
12508 {
12509         struct wireless_dev *wdev = dev->ieee80211_ptr;
12510         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12511         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12512         void **cb;
12513
12514         if (!msg)
12515                 return NULL;
12516
12517         cb = (void **)msg->cb;
12518
12519         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
12520         if (!cb[0]) {
12521                 nlmsg_free(msg);
12522                 return NULL;
12523         }
12524
12525         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12526             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
12527                 goto nla_put_failure;
12528
12529         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
12530                 goto nla_put_failure;
12531
12532         cb[1] = nla_nest_start(msg, NL80211_ATTR_CQM);
12533         if (!cb[1])
12534                 goto nla_put_failure;
12535
12536         cb[2] = rdev;
12537
12538         return msg;
12539  nla_put_failure:
12540         nlmsg_free(msg);
12541         return NULL;
12542 }
12543
12544 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
12545 {
12546         void **cb = (void **)msg->cb;
12547         struct cfg80211_registered_device *rdev = cb[2];
12548
12549         nla_nest_end(msg, cb[1]);
12550         genlmsg_end(msg, cb[0]);
12551
12552         memset(msg->cb, 0, sizeof(msg->cb));
12553
12554         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12555                                 NL80211_MCGRP_MLME, gfp);
12556 }
12557
12558 void cfg80211_cqm_rssi_notify(struct net_device *dev,
12559                               enum nl80211_cqm_rssi_threshold_event rssi_event,
12560                               gfp_t gfp)
12561 {
12562         struct sk_buff *msg;
12563
12564         trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
12565
12566         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
12567                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
12568                 return;
12569
12570         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
12571         if (!msg)
12572                 return;
12573
12574         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
12575                         rssi_event))
12576                 goto nla_put_failure;
12577
12578         cfg80211_send_cqm(msg, gfp);
12579
12580         return;
12581
12582  nla_put_failure:
12583         nlmsg_free(msg);
12584 }
12585 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
12586
12587 void cfg80211_cqm_txe_notify(struct net_device *dev,
12588                              const u8 *peer, u32 num_packets,
12589                              u32 rate, u32 intvl, gfp_t gfp)
12590 {
12591         struct sk_buff *msg;
12592
12593         msg = cfg80211_prepare_cqm(dev, peer, gfp);
12594         if (!msg)
12595                 return;
12596
12597         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
12598                 goto nla_put_failure;
12599
12600         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
12601                 goto nla_put_failure;
12602
12603         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
12604                 goto nla_put_failure;
12605
12606         cfg80211_send_cqm(msg, gfp);
12607         return;
12608
12609  nla_put_failure:
12610         nlmsg_free(msg);
12611 }
12612 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
12613
12614 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
12615                                  const u8 *peer, u32 num_packets, gfp_t gfp)
12616 {
12617         struct sk_buff *msg;
12618
12619         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
12620
12621         msg = cfg80211_prepare_cqm(dev, peer, gfp);
12622         if (!msg)
12623                 return;
12624
12625         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
12626                 goto nla_put_failure;
12627
12628         cfg80211_send_cqm(msg, gfp);
12629         return;
12630
12631  nla_put_failure:
12632         nlmsg_free(msg);
12633 }
12634 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
12635
12636 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
12637 {
12638         struct sk_buff *msg;
12639
12640         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
12641         if (!msg)
12642                 return;
12643
12644         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
12645                 goto nla_put_failure;
12646
12647         cfg80211_send_cqm(msg, gfp);
12648         return;
12649
12650  nla_put_failure:
12651         nlmsg_free(msg);
12652 }
12653 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
12654
12655 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
12656                                      struct net_device *netdev, const u8 *bssid,
12657                                      const u8 *replay_ctr, gfp_t gfp)
12658 {
12659         struct sk_buff *msg;
12660         struct nlattr *rekey_attr;
12661         void *hdr;
12662
12663         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12664         if (!msg)
12665                 return;
12666
12667         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
12668         if (!hdr) {
12669                 nlmsg_free(msg);
12670                 return;
12671         }
12672
12673         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12674             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12675             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
12676                 goto nla_put_failure;
12677
12678         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
12679         if (!rekey_attr)
12680                 goto nla_put_failure;
12681
12682         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
12683                     NL80211_REPLAY_CTR_LEN, replay_ctr))
12684                 goto nla_put_failure;
12685
12686         nla_nest_end(msg, rekey_attr);
12687
12688         genlmsg_end(msg, hdr);
12689
12690         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12691                                 NL80211_MCGRP_MLME, gfp);
12692         return;
12693
12694  nla_put_failure:
12695         genlmsg_cancel(msg, hdr);
12696         nlmsg_free(msg);
12697 }
12698
12699 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
12700                                const u8 *replay_ctr, gfp_t gfp)
12701 {
12702         struct wireless_dev *wdev = dev->ieee80211_ptr;
12703         struct wiphy *wiphy = wdev->wiphy;
12704         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12705
12706         trace_cfg80211_gtk_rekey_notify(dev, bssid);
12707         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
12708 }
12709 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
12710
12711 static void
12712 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
12713                                struct net_device *netdev, int index,
12714                                const u8 *bssid, bool preauth, gfp_t gfp)
12715 {
12716         struct sk_buff *msg;
12717         struct nlattr *attr;
12718         void *hdr;
12719
12720         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12721         if (!msg)
12722                 return;
12723
12724         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
12725         if (!hdr) {
12726                 nlmsg_free(msg);
12727                 return;
12728         }
12729
12730         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12731             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
12732                 goto nla_put_failure;
12733
12734         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
12735         if (!attr)
12736                 goto nla_put_failure;
12737
12738         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
12739             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
12740             (preauth &&
12741              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
12742                 goto nla_put_failure;
12743
12744         nla_nest_end(msg, attr);
12745
12746         genlmsg_end(msg, hdr);
12747
12748         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12749                                 NL80211_MCGRP_MLME, gfp);
12750         return;
12751
12752  nla_put_failure:
12753         genlmsg_cancel(msg, hdr);
12754         nlmsg_free(msg);
12755 }
12756
12757 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
12758                                      const u8 *bssid, bool preauth, gfp_t gfp)
12759 {
12760         struct wireless_dev *wdev = dev->ieee80211_ptr;
12761         struct wiphy *wiphy = wdev->wiphy;
12762         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12763
12764         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
12765         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
12766 }
12767 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
12768
12769 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
12770                                      struct net_device *netdev,
12771                                      struct cfg80211_chan_def *chandef,
12772                                      gfp_t gfp,
12773                                      enum nl80211_commands notif,
12774                                      u8 count)
12775 {
12776         struct sk_buff *msg;
12777         void *hdr;
12778
12779         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12780         if (!msg)
12781                 return;
12782
12783         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
12784         if (!hdr) {
12785                 nlmsg_free(msg);
12786                 return;
12787         }
12788
12789         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
12790                 goto nla_put_failure;
12791
12792         if (nl80211_send_chandef(msg, chandef))
12793                 goto nla_put_failure;
12794
12795         if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
12796             (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
12797                         goto nla_put_failure;
12798
12799         genlmsg_end(msg, hdr);
12800
12801         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12802                                 NL80211_MCGRP_MLME, gfp);
12803         return;
12804
12805  nla_put_failure:
12806         genlmsg_cancel(msg, hdr);
12807         nlmsg_free(msg);
12808 }
12809
12810 void cfg80211_ch_switch_notify(struct net_device *dev,
12811                                struct cfg80211_chan_def *chandef)
12812 {
12813         struct wireless_dev *wdev = dev->ieee80211_ptr;
12814         struct wiphy *wiphy = wdev->wiphy;
12815         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12816
12817         ASSERT_WDEV_LOCK(wdev);
12818
12819         trace_cfg80211_ch_switch_notify(dev, chandef);
12820
12821         wdev->chandef = *chandef;
12822         wdev->preset_chandef = *chandef;
12823         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
12824                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0);
12825 }
12826 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
12827
12828 void cfg80211_ch_switch_started_notify(struct net_device *dev,
12829                                        struct cfg80211_chan_def *chandef,
12830                                        u8 count)
12831 {
12832         struct wireless_dev *wdev = dev->ieee80211_ptr;
12833         struct wiphy *wiphy = wdev->wiphy;
12834         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12835
12836         trace_cfg80211_ch_switch_started_notify(dev, chandef);
12837
12838         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
12839                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
12840 }
12841 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
12842
12843 void
12844 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
12845                      const struct cfg80211_chan_def *chandef,
12846                      enum nl80211_radar_event event,
12847                      struct net_device *netdev, gfp_t gfp)
12848 {
12849         struct sk_buff *msg;
12850         void *hdr;
12851
12852         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12853         if (!msg)
12854                 return;
12855
12856         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
12857         if (!hdr) {
12858                 nlmsg_free(msg);
12859                 return;
12860         }
12861
12862         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
12863                 goto nla_put_failure;
12864
12865         /* NOP and radar events don't need a netdev parameter */
12866         if (netdev) {
12867                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
12868
12869                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12870                     nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
12871                         goto nla_put_failure;
12872         }
12873
12874         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
12875                 goto nla_put_failure;
12876
12877         if (nl80211_send_chandef(msg, chandef))
12878                 goto nla_put_failure;
12879
12880         genlmsg_end(msg, hdr);
12881
12882         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12883                                 NL80211_MCGRP_MLME, gfp);
12884         return;
12885
12886  nla_put_failure:
12887         genlmsg_cancel(msg, hdr);
12888         nlmsg_free(msg);
12889 }
12890
12891 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
12892                            u64 cookie, bool acked, gfp_t gfp)
12893 {
12894         struct wireless_dev *wdev = dev->ieee80211_ptr;
12895         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12896         struct sk_buff *msg;
12897         void *hdr;
12898
12899         trace_cfg80211_probe_status(dev, addr, cookie, acked);
12900
12901         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12902
12903         if (!msg)
12904                 return;
12905
12906         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
12907         if (!hdr) {
12908                 nlmsg_free(msg);
12909                 return;
12910         }
12911
12912         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12913             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
12914             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
12915             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
12916             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
12917                 goto nla_put_failure;
12918
12919         genlmsg_end(msg, hdr);
12920
12921         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12922                                 NL80211_MCGRP_MLME, gfp);
12923         return;
12924
12925  nla_put_failure:
12926         genlmsg_cancel(msg, hdr);
12927         nlmsg_free(msg);
12928 }
12929 EXPORT_SYMBOL(cfg80211_probe_status);
12930
12931 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
12932                                  const u8 *frame, size_t len,
12933                                  int freq, int sig_dbm)
12934 {
12935         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12936         struct sk_buff *msg;
12937         void *hdr;
12938         struct cfg80211_beacon_registration *reg;
12939
12940         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
12941
12942         spin_lock_bh(&rdev->beacon_registrations_lock);
12943         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
12944                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
12945                 if (!msg) {
12946                         spin_unlock_bh(&rdev->beacon_registrations_lock);
12947                         return;
12948                 }
12949
12950                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
12951                 if (!hdr)
12952                         goto nla_put_failure;
12953
12954                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12955                     (freq &&
12956                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
12957                     (sig_dbm &&
12958                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
12959                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
12960                         goto nla_put_failure;
12961
12962                 genlmsg_end(msg, hdr);
12963
12964                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
12965         }
12966         spin_unlock_bh(&rdev->beacon_registrations_lock);
12967         return;
12968
12969  nla_put_failure:
12970         spin_unlock_bh(&rdev->beacon_registrations_lock);
12971         if (hdr)
12972                 genlmsg_cancel(msg, hdr);
12973         nlmsg_free(msg);
12974 }
12975 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
12976
12977 #ifdef CONFIG_PM
12978 static int cfg80211_net_detect_results(struct sk_buff *msg,
12979                                        struct cfg80211_wowlan_wakeup *wakeup)
12980 {
12981         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
12982         struct nlattr *nl_results, *nl_match, *nl_freqs;
12983         int i, j;
12984
12985         nl_results = nla_nest_start(
12986                 msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
12987         if (!nl_results)
12988                 return -EMSGSIZE;
12989
12990         for (i = 0; i < nd->n_matches; i++) {
12991                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
12992
12993                 nl_match = nla_nest_start(msg, i);
12994                 if (!nl_match)
12995                         break;
12996
12997                 /* The SSID attribute is optional in nl80211, but for
12998                  * simplicity reasons it's always present in the
12999                  * cfg80211 structure.  If a driver can't pass the
13000                  * SSID, that needs to be changed.  A zero length SSID
13001                  * is still a valid SSID (wildcard), so it cannot be
13002                  * used for this purpose.
13003                  */
13004                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
13005                             match->ssid.ssid)) {
13006                         nla_nest_cancel(msg, nl_match);
13007                         goto out;
13008                 }
13009
13010                 if (match->n_channels) {
13011                         nl_freqs = nla_nest_start(
13012                                 msg, NL80211_ATTR_SCAN_FREQUENCIES);
13013                         if (!nl_freqs) {
13014                                 nla_nest_cancel(msg, nl_match);
13015                                 goto out;
13016                         }
13017
13018                         for (j = 0; j < match->n_channels; j++) {
13019                                 if (nla_put_u32(msg, j, match->channels[j])) {
13020                                         nla_nest_cancel(msg, nl_freqs);
13021                                         nla_nest_cancel(msg, nl_match);
13022                                         goto out;
13023                                 }
13024                         }
13025
13026                         nla_nest_end(msg, nl_freqs);
13027                 }
13028
13029                 nla_nest_end(msg, nl_match);
13030         }
13031
13032 out:
13033         nla_nest_end(msg, nl_results);
13034         return 0;
13035 }
13036
13037 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
13038                                    struct cfg80211_wowlan_wakeup *wakeup,
13039                                    gfp_t gfp)
13040 {
13041         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
13042         struct sk_buff *msg;
13043         void *hdr;
13044         int size = 200;
13045
13046         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
13047
13048         if (wakeup)
13049                 size += wakeup->packet_present_len;
13050
13051         msg = nlmsg_new(size, gfp);
13052         if (!msg)
13053                 return;
13054
13055         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
13056         if (!hdr)
13057                 goto free_msg;
13058
13059         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13060             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
13061                 goto free_msg;
13062
13063         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13064                                         wdev->netdev->ifindex))
13065                 goto free_msg;
13066
13067         if (wakeup) {
13068                 struct nlattr *reasons;
13069
13070                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
13071                 if (!reasons)
13072                         goto free_msg;
13073
13074                 if (wakeup->disconnect &&
13075                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
13076                         goto free_msg;
13077                 if (wakeup->magic_pkt &&
13078                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
13079                         goto free_msg;
13080                 if (wakeup->gtk_rekey_failure &&
13081                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
13082                         goto free_msg;
13083                 if (wakeup->eap_identity_req &&
13084                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
13085                         goto free_msg;
13086                 if (wakeup->four_way_handshake &&
13087                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
13088                         goto free_msg;
13089                 if (wakeup->rfkill_release &&
13090                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
13091                         goto free_msg;
13092
13093                 if (wakeup->pattern_idx >= 0 &&
13094                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
13095                                 wakeup->pattern_idx))
13096                         goto free_msg;
13097
13098                 if (wakeup->tcp_match &&
13099                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
13100                         goto free_msg;
13101
13102                 if (wakeup->tcp_connlost &&
13103                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
13104                         goto free_msg;
13105
13106                 if (wakeup->tcp_nomoretokens &&
13107                     nla_put_flag(msg,
13108                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
13109                         goto free_msg;
13110
13111                 if (wakeup->packet) {
13112                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
13113                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
13114
13115                         if (!wakeup->packet_80211) {
13116                                 pkt_attr =
13117                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
13118                                 len_attr =
13119                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
13120                         }
13121
13122                         if (wakeup->packet_len &&
13123                             nla_put_u32(msg, len_attr, wakeup->packet_len))
13124                                 goto free_msg;
13125
13126                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
13127                                     wakeup->packet))
13128                                 goto free_msg;
13129                 }
13130
13131                 if (wakeup->net_detect &&
13132                     cfg80211_net_detect_results(msg, wakeup))
13133                                 goto free_msg;
13134
13135                 nla_nest_end(msg, reasons);
13136         }
13137
13138         genlmsg_end(msg, hdr);
13139
13140         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13141                                 NL80211_MCGRP_MLME, gfp);
13142         return;
13143
13144  free_msg:
13145         nlmsg_free(msg);
13146 }
13147 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
13148 #endif
13149
13150 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
13151                                 enum nl80211_tdls_operation oper,
13152                                 u16 reason_code, gfp_t gfp)
13153 {
13154         struct wireless_dev *wdev = dev->ieee80211_ptr;
13155         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
13156         struct sk_buff *msg;
13157         void *hdr;
13158
13159         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
13160                                          reason_code);
13161
13162         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13163         if (!msg)
13164                 return;
13165
13166         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
13167         if (!hdr) {
13168                 nlmsg_free(msg);
13169                 return;
13170         }
13171
13172         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13173             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
13174             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
13175             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
13176             (reason_code > 0 &&
13177              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
13178                 goto nla_put_failure;
13179
13180         genlmsg_end(msg, hdr);
13181
13182         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13183                                 NL80211_MCGRP_MLME, gfp);
13184         return;
13185
13186  nla_put_failure:
13187         genlmsg_cancel(msg, hdr);
13188         nlmsg_free(msg);
13189 }
13190 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
13191
13192 static int nl80211_netlink_notify(struct notifier_block * nb,
13193                                   unsigned long state,
13194                                   void *_notify)
13195 {
13196         struct netlink_notify *notify = _notify;
13197         struct cfg80211_registered_device *rdev;
13198         struct wireless_dev *wdev;
13199         struct cfg80211_beacon_registration *reg, *tmp;
13200
13201         if (state != NETLINK_URELEASE)
13202                 return NOTIFY_DONE;
13203
13204         rcu_read_lock();
13205
13206         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
13207                 bool schedule_destroy_work = false;
13208                 bool schedule_scan_stop = false;
13209                 struct cfg80211_sched_scan_request *sched_scan_req =
13210                         rcu_dereference(rdev->sched_scan_req);
13211
13212                 if (sched_scan_req && notify->portid &&
13213                     sched_scan_req->owner_nlportid == notify->portid)
13214                         schedule_scan_stop = true;
13215
13216                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list) {
13217                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
13218
13219                         if (wdev->owner_nlportid == notify->portid)
13220                                 schedule_destroy_work = true;
13221                 }
13222
13223                 spin_lock_bh(&rdev->beacon_registrations_lock);
13224                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
13225                                          list) {
13226                         if (reg->nlportid == notify->portid) {
13227                                 list_del(&reg->list);
13228                                 kfree(reg);
13229                                 break;
13230                         }
13231                 }
13232                 spin_unlock_bh(&rdev->beacon_registrations_lock);
13233
13234                 if (schedule_destroy_work) {
13235                         struct cfg80211_iface_destroy *destroy;
13236
13237                         destroy = kzalloc(sizeof(*destroy), GFP_ATOMIC);
13238                         if (destroy) {
13239                                 destroy->nlportid = notify->portid;
13240                                 spin_lock(&rdev->destroy_list_lock);
13241                                 list_add(&destroy->list, &rdev->destroy_list);
13242                                 spin_unlock(&rdev->destroy_list_lock);
13243                                 schedule_work(&rdev->destroy_work);
13244                         }
13245                 } else if (schedule_scan_stop) {
13246                         sched_scan_req->owner_nlportid = 0;
13247
13248                         if (rdev->ops->sched_scan_stop &&
13249                             rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
13250                                 schedule_work(&rdev->sched_scan_stop_wk);
13251                 }
13252         }
13253
13254         rcu_read_unlock();
13255
13256         /*
13257          * It is possible that the user space process that is controlling the
13258          * indoor setting disappeared, so notify the regulatory core.
13259          */
13260         regulatory_netlink_notify(notify->portid);
13261         return NOTIFY_OK;
13262 }
13263
13264 static struct notifier_block nl80211_netlink_notifier = {
13265         .notifier_call = nl80211_netlink_notify,
13266 };
13267
13268 void cfg80211_ft_event(struct net_device *netdev,
13269                        struct cfg80211_ft_event_params *ft_event)
13270 {
13271         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
13272         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13273         struct sk_buff *msg;
13274         void *hdr;
13275
13276         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
13277
13278         if (!ft_event->target_ap)
13279                 return;
13280
13281         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13282         if (!msg)
13283                 return;
13284
13285         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
13286         if (!hdr)
13287                 goto out;
13288
13289         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13290             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13291             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
13292                 goto out;
13293
13294         if (ft_event->ies &&
13295             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
13296                 goto out;
13297         if (ft_event->ric_ies &&
13298             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
13299                     ft_event->ric_ies))
13300                 goto out;
13301
13302         genlmsg_end(msg, hdr);
13303
13304         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13305                                 NL80211_MCGRP_MLME, GFP_KERNEL);
13306         return;
13307  out:
13308         nlmsg_free(msg);
13309 }
13310 EXPORT_SYMBOL(cfg80211_ft_event);
13311
13312 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
13313 {
13314         struct cfg80211_registered_device *rdev;
13315         struct sk_buff *msg;
13316         void *hdr;
13317         u32 nlportid;
13318
13319         rdev = wiphy_to_rdev(wdev->wiphy);
13320         if (!rdev->crit_proto_nlportid)
13321                 return;
13322
13323         nlportid = rdev->crit_proto_nlportid;
13324         rdev->crit_proto_nlportid = 0;
13325
13326         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13327         if (!msg)
13328                 return;
13329
13330         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
13331         if (!hdr)
13332                 goto nla_put_failure;
13333
13334         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13335             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
13336                 goto nla_put_failure;
13337
13338         genlmsg_end(msg, hdr);
13339
13340         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
13341         return;
13342
13343  nla_put_failure:
13344         if (hdr)
13345                 genlmsg_cancel(msg, hdr);
13346         nlmsg_free(msg);
13347
13348 }
13349 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
13350
13351 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
13352 {
13353         struct wiphy *wiphy = wdev->wiphy;
13354         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13355         struct sk_buff *msg;
13356         void *hdr;
13357
13358         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13359         if (!msg)
13360                 return;
13361
13362         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
13363         if (!hdr)
13364                 goto out;
13365
13366         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13367             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
13368             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
13369                 goto out;
13370
13371         genlmsg_end(msg, hdr);
13372
13373         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
13374                                 NL80211_MCGRP_MLME, GFP_KERNEL);
13375         return;
13376  out:
13377         nlmsg_free(msg);
13378 }
13379
13380 /* initialisation/exit functions */
13381
13382 int nl80211_init(void)
13383 {
13384         int err;
13385
13386         err = genl_register_family_with_ops_groups(&nl80211_fam, nl80211_ops,
13387                                                    nl80211_mcgrps);
13388         if (err)
13389                 return err;
13390
13391         err = netlink_register_notifier(&nl80211_netlink_notifier);
13392         if (err)
13393                 goto err_out;
13394
13395         return 0;
13396  err_out:
13397         genl_unregister_family(&nl80211_fam);
13398         return err;
13399 }
13400
13401 void nl80211_exit(void)
13402 {
13403         netlink_unregister_notifier(&nl80211_netlink_notifier);
13404         genl_unregister_family(&nl80211_fam);
13405 }