net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  * Copyright 2013-2014  Intel Mobile Communications GmbH
   6  * Copyright 2015-2016  Intel Deutschland GmbH
   7  */
   8
   9 #include <linux/if.h>
  10 #include <linux/module.h>
  11 #include <linux/err.h>
  12 #include <linux/slab.h>
  13 #include <linux/list.h>
  14 #include <linux/if_ether.h>
  15 #include <linux/ieee80211.h>
  16 #include <linux/nl80211.h>
  17 #include <linux/rtnetlink.h>
  18 #include <linux/netlink.h>
  19 #include <linux/etherdevice.h>
  20 #include <net/net_namespace.h>
  21 #include <net/genetlink.h>
  22 #include <net/cfg80211.h>
  23 #include <net/sock.h>
  24 #include <net/inet_connection_sock.h>
  25 #include "core.h"
  26 #include "nl80211.h"
  27 #include "reg.h"
  28 #include "rdev-ops.h"
  29
  30 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  31                                    struct genl_info *info,
  32                                    struct cfg80211_crypto_settings *settings,
  33                                    int cipher_limit);
  34
  35 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
  36                             struct genl_info *info);
  37 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
  38                               struct genl_info *info);
  39
  40 /* the netlink family */
  41 static struct genl_family nl80211_fam = {
  42         .id = GENL_ID_GENERATE,         /* don't bother with a hardcoded ID */
  43         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
  44         .hdrsize = 0,                   /* no private header */
  45         .version = 1,                   /* no particular meaning now */
  46         .maxattr = NL80211_ATTR_MAX,
  47         .netnsok = true,
  48         .pre_doit = nl80211_pre_doit,
  49         .post_doit = nl80211_post_doit,
  50 };
  51
  52 /* multicast groups */
  53 enum nl80211_multicast_groups {
  54         NL80211_MCGRP_CONFIG,
  55         NL80211_MCGRP_SCAN,
  56         NL80211_MCGRP_REGULATORY,
  57         NL80211_MCGRP_MLME,
  58         NL80211_MCGRP_VENDOR,
  59         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  60 };
  61
  62 static const struct genl_multicast_group nl80211_mcgrps[] = {
  63         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  64         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  65         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  66         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  67         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  68 #ifdef CONFIG_NL80211_TESTMODE
  69         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  70 #endif
  71 };
  72
  73 /* returns ERR_PTR values */
  74 static struct wireless_dev *
  75 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  76 {
  77         struct cfg80211_registered_device *rdev;
  78         struct wireless_dev *result = NULL;
  79         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  80         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  81         u64 wdev_id;
  82         int wiphy_idx = -1;
  83         int ifidx = -1;
  84
  85         ASSERT_RTNL();
  86
  87         if (!have_ifidx && !have_wdev_id)
  88                 return ERR_PTR(-EINVAL);
  89
  90         if (have_ifidx)
  91                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  92         if (have_wdev_id) {
  93                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  94                 wiphy_idx = wdev_id >> 32;
  95         }
  96
  97         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  98                 struct wireless_dev *wdev;
  99
 100                 if (wiphy_net(&rdev->wiphy) != netns)
 101                         continue;
 102
 103                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
 104                         continue;
 105
 106                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
 107                         if (have_ifidx && wdev->netdev &&
 108                             wdev->netdev->ifindex == ifidx) {
 109                                 result = wdev;
 110                                 break;
 111                         }
 112                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 113                                 result = wdev;
 114                                 break;
 115                         }
 116                 }
 117
 118                 if (result)
 119                         break;
 120         }
 121
 122         if (result)
 123                 return result;
 124         return ERR_PTR(-ENODEV);
 125 }
 126
 127 static struct cfg80211_registered_device *
 128 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 129 {
 130         struct cfg80211_registered_device *rdev = NULL, *tmp;
 131         struct net_device *netdev;
 132
 133         ASSERT_RTNL();
 134
 135         if (!attrs[NL80211_ATTR_WIPHY] &&
 136             !attrs[NL80211_ATTR_IFINDEX] &&
 137             !attrs[NL80211_ATTR_WDEV])
 138                 return ERR_PTR(-EINVAL);
 139
 140         if (attrs[NL80211_ATTR_WIPHY])
 141                 rdev = cfg80211_rdev_by_wiphy_idx(
 142                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 143
 144         if (attrs[NL80211_ATTR_WDEV]) {
 145                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 146                 struct wireless_dev *wdev;
 147                 bool found = false;
 148
 149                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 150                 if (tmp) {
 151                         /* make sure wdev exists */
 152                         list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
 153                                 if (wdev->identifier != (u32)wdev_id)
 154                                         continue;
 155                                 found = true;
 156                                 break;
 157                         }
 158
 159                         if (!found)
 160                                 tmp = NULL;
 161
 162                         if (rdev && tmp != rdev)
 163                                 return ERR_PTR(-EINVAL);
 164                         rdev = tmp;
 165                 }
 166         }
 167
 168         if (attrs[NL80211_ATTR_IFINDEX]) {
 169                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 170                 netdev = __dev_get_by_index(netns, ifindex);
 171                 if (netdev) {
 172                         if (netdev->ieee80211_ptr)
 173                                 tmp = wiphy_to_rdev(
 174                                         netdev->ieee80211_ptr->wiphy);
 175                         else
 176                                 tmp = NULL;
 177
 178                         /* not wireless device -- return error */
 179                         if (!tmp)
 180                                 return ERR_PTR(-EINVAL);
 181
 182                         /* mismatch -- return error */
 183                         if (rdev && tmp != rdev)
 184                                 return ERR_PTR(-EINVAL);
 185
 186                         rdev = tmp;
 187                 }
 188         }
 189
 190         if (!rdev)
 191                 return ERR_PTR(-ENODEV);
 192
 193         if (netns != wiphy_net(&rdev->wiphy))
 194                 return ERR_PTR(-ENODEV);
 195
 196         return rdev;
 197 }
 198
 199 /*
 200  * This function returns a pointer to the driver
 201  * that the genl_info item that is passed refers to.
 202  *
 203  * The result of this can be a PTR_ERR and hence must
 204  * be checked with IS_ERR() for errors.
 205  */
 206 static struct cfg80211_registered_device *
 207 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 208 {
 209         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 210 }
 211
 212 /* policy for the attributes */
 213 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 214         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 215         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 216                                       .len = 20-1 },
 217         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 218
 219         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 220         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 221         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 222         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 223         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 224
 225         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 226         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 227         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 228         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 229         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 230         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 231
 232         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 233         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 234         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 235
 236         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 237         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 238
 239         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 240         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 241                                     .len = WLAN_MAX_KEY_LEN },
 242         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 243         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 244         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 245         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 246         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 247
 248         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 249         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 250         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 251                                        .len = IEEE80211_MAX_DATA_LEN },
 252         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 253                                        .len = IEEE80211_MAX_DATA_LEN },
 254         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 255         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 256         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 257         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 258                                                .len = NL80211_MAX_SUPP_RATES },
 259         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 260         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 261         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 262         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 263                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 264         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 265
 266         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 267         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 268
 269         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 270         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 271         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 272         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 273                                            .len = NL80211_MAX_SUPP_RATES },
 274         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 275
 276         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 277         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 278
 279         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 280
 281         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 282         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 283                               .len = IEEE80211_MAX_DATA_LEN },
 284         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 285         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 286
 287         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 288                                 .len = IEEE80211_MAX_SSID_LEN },
 289         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 290         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 291         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 292         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 293         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 294         [NL80211_ATTR_STA_FLAGS2] = {
 295                 .len = sizeof(struct nl80211_sta_flag_update),
 296         },
 297         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 298         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 299         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 300         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 301         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 302         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 303         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 304         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 305         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 306                                  .len = WLAN_PMKID_LEN },
 307         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 308         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 309         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 310         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 311                                  .len = IEEE80211_MAX_DATA_LEN },
 312         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 313         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 314         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 315         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 316         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 317         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 318         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 319         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 320         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 321         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 322         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 323         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 324         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 325         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 326         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 327         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 328         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 329         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 330         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 331         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 332                                          .len = IEEE80211_MAX_DATA_LEN },
 333         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 334                                          .len = IEEE80211_MAX_DATA_LEN },
 335         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 336         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 337         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 338         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 339         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 340         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 341         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 342         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 343         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 344         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 345         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 346                                       .len = IEEE80211_MAX_DATA_LEN },
 347         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 348         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 349         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 350                 .len = NL80211_HT_CAPABILITY_LEN
 351         },
 352         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 353         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 354         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 355         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 356         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 357         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 358         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 359         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 360         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 361         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 362         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 363         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 364         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 365         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 366         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 367         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 368         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 369                 .len = NL80211_VHT_CAPABILITY_LEN,
 370         },
 371         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 372         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 373                                   .len = IEEE80211_MAX_DATA_LEN },
 374         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 375         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 376         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 377         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 378         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
 379         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
 380         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 381         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 382         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 383         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 384         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 385         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 386         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 387         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 388                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 389         [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
 390         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 391         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 392         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 393         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 394         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 395         [NL80211_ATTR_TSID] = { .type = NLA_U8 },
 396         [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 },
 397         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 398         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 399         [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
 400         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 401         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 402         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 403         [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 404         [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
 405         [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
 406         [NL80211_ATTR_STA_SUPPORT_P2P_PS] = { .type = NLA_U8 },
 407 };
 408
 409 /* policy for the key attributes */
 410 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 411         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 412         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 413         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 414         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 415         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 416         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 417         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 418         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 419 };
 420
 421 /* policy for the key default flags */
 422 static const struct nla_policy
 423 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 424         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 425         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 426 };
 427
 428 /* policy for WoWLAN attributes */
 429 static const struct nla_policy
 430 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 431         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 432         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 433         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 434         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 435         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 436         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 437         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 438         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 439         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 440         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 441 };
 442
 443 static const struct nla_policy
 444 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 445         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 446         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 447         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 448         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 449         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 450         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 451         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 452                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 453         },
 454         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 455                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 456         },
 457         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 458         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 459         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 460 };
 461
 462 /* policy for coalesce rule attributes */
 463 static const struct nla_policy
 464 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 465         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 466         [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
 467         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 468 };
 469
 470 /* policy for GTK rekey offload attributes */
 471 static const struct nla_policy
 472 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 473         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 474         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 475         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 476 };
 477
 478 static const struct nla_policy
 479 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 480         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 481                                                  .len = IEEE80211_MAX_SSID_LEN },
 482         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 483 };
 484
 485 static const struct nla_policy
 486 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 487         [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 488         [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 489 };
 490
 491 static const struct nla_policy
 492 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
 493         [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
 494         [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
 495         [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
 496                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 497         },
 498 };
 499
 500 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 501                                      struct netlink_callback *cb,
 502                                      struct cfg80211_registered_device **rdev,
 503                                      struct wireless_dev **wdev)
 504 {
 505         int err;
 506
 507         rtnl_lock();
 508
 509         if (!cb->args[0]) {
 510                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 511                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
 512                                   nl80211_policy);
 513                 if (err)
 514                         goto out_unlock;
 515
 516                 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
 517                                                    nl80211_fam.attrbuf);
 518                 if (IS_ERR(*wdev)) {
 519                         err = PTR_ERR(*wdev);
 520                         goto out_unlock;
 521                 }
 522                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 523                 /* 0 is the first index - add 1 to parse only once */
 524                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 525                 cb->args[1] = (*wdev)->identifier;
 526         } else {
 527                 /* subtract the 1 again here */
 528                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 529                 struct wireless_dev *tmp;
 530
 531                 if (!wiphy) {
 532                         err = -ENODEV;
 533                         goto out_unlock;
 534                 }
 535                 *rdev = wiphy_to_rdev(wiphy);
 536                 *wdev = NULL;
 537
 538                 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
 539                         if (tmp->identifier == cb->args[1]) {
 540                                 *wdev = tmp;
 541                                 break;
 542                         }
 543                 }
 544
 545                 if (!*wdev) {
 546                         err = -ENODEV;
 547                         goto out_unlock;
 548                 }
 549         }
 550
 551         return 0;
 552  out_unlock:
 553         rtnl_unlock();
 554         return err;
 555 }
 556
 557 static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
 558 {
 559         rtnl_unlock();
 560 }
 561
 562 /* IE validation */
 563 static bool is_valid_ie_attr(const struct nlattr *attr)
 564 {
 565         const u8 *pos;
 566         int len;
 567
 568         if (!attr)
 569                 return true;
 570
 571         pos = nla_data(attr);
 572         len = nla_len(attr);
 573
 574         while (len) {
 575                 u8 elemlen;
 576
 577                 if (len < 2)
 578                         return false;
 579                 len -= 2;
 580
 581                 elemlen = pos[1];
 582                 if (elemlen > len)
 583                         return false;
 584
 585                 len -= elemlen;
 586                 pos += 2 + elemlen;
 587         }
 588
 589         return true;
 590 }
 591
 592 /* message building helper */
 593 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 594                                    int flags, u8 cmd)
 595 {
 596         /* since there is no private header just add the generic one */
 597         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 598 }
 599
 600 static int nl80211_msg_put_channel(struct sk_buff *msg,
 601                                    struct ieee80211_channel *chan,
 602                                    bool large)
 603 {
 604         /* Some channels must be completely excluded from the
 605          * list to protect old user-space tools from breaking
 606          */
 607         if (!large && chan->flags &
 608             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 609                 return 0;
 610
 611         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 612                         chan->center_freq))
 613                 goto nla_put_failure;
 614
 615         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 616             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 617                 goto nla_put_failure;
 618         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 619                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 620                         goto nla_put_failure;
 621                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 622                         goto nla_put_failure;
 623         }
 624         if (chan->flags & IEEE80211_CHAN_RADAR) {
 625                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 626                         goto nla_put_failure;
 627                 if (large) {
 628                         u32 time;
 629
 630                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 631
 632                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 633                                         chan->dfs_state))
 634                                 goto nla_put_failure;
 635                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 636                                         time))
 637                                 goto nla_put_failure;
 638                         if (nla_put_u32(msg,
 639                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 640                                         chan->dfs_cac_ms))
 641                                 goto nla_put_failure;
 642                 }
 643         }
 644
 645         if (large) {
 646                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 647                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 648                         goto nla_put_failure;
 649                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 650                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 651                         goto nla_put_failure;
 652                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 653                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 654                         goto nla_put_failure;
 655                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 656                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 657                         goto nla_put_failure;
 658                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 659                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 660                         goto nla_put_failure;
 661                 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
 662                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
 663                         goto nla_put_failure;
 664                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 665                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 666                         goto nla_put_failure;
 667                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 668                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 669                         goto nla_put_failure;
 670         }
 671
 672         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 673                         DBM_TO_MBM(chan->max_power)))
 674                 goto nla_put_failure;
 675
 676         return 0;
 677
 678  nla_put_failure:
 679         return -ENOBUFS;
 680 }
 681
 682 /* netlink command implementations */
 683
 684 struct key_parse {
 685         struct key_params p;
 686         int idx;
 687         int type;
 688         bool def, defmgmt;
 689         bool def_uni, def_multi;
 690 };
 691
 692 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 693 {
 694         struct nlattr *tb[NL80211_KEY_MAX + 1];
 695         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 696                                    nl80211_key_policy);
 697         if (err)
 698                 return err;
 699
 700         k->def = !!tb[NL80211_KEY_DEFAULT];
 701         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 702
 703         if (k->def) {
 704                 k->def_uni = true;
 705                 k->def_multi = true;
 706         }
 707         if (k->defmgmt)
 708                 k->def_multi = true;
 709
 710         if (tb[NL80211_KEY_IDX])
 711                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 712
 713         if (tb[NL80211_KEY_DATA]) {
 714                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 715                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 716         }
 717
 718         if (tb[NL80211_KEY_SEQ]) {
 719                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 720                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 721         }
 722
 723         if (tb[NL80211_KEY_CIPHER])
 724                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 725
 726         if (tb[NL80211_KEY_TYPE]) {
 727                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 728                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 729                         return -EINVAL;
 730         }
 731
 732         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 733                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 734                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 735                                        tb[NL80211_KEY_DEFAULT_TYPES],
 736                                        nl80211_key_default_policy);
 737                 if (err)
 738                         return err;
 739
 740                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 741                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 742         }
 743
 744         return 0;
 745 }
 746
 747 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 748 {
 749         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 750                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 751                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 752         }
 753
 754         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 755                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 756                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 757         }
 758
 759         if (info->attrs[NL80211_ATTR_KEY_IDX])
 760                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 761
 762         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 763                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 764
 765         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 766         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 767
 768         if (k->def) {
 769                 k->def_uni = true;
 770                 k->def_multi = true;
 771         }
 772         if (k->defmgmt)
 773                 k->def_multi = true;
 774
 775         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 776                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 777                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 778                         return -EINVAL;
 779         }
 780
 781         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 782                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 783                 int err = nla_parse_nested(
 784                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 785                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 786                                 nl80211_key_default_policy);
 787                 if (err)
 788                         return err;
 789
 790                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 791                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 792         }
 793
 794         return 0;
 795 }
 796
 797 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 798 {
 799         int err;
 800
 801         memset(k, 0, sizeof(*k));
 802         k->idx = -1;
 803         k->type = -1;
 804
 805         if (info->attrs[NL80211_ATTR_KEY])
 806                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 807         else
 808                 err = nl80211_parse_key_old(info, k);
 809
 810         if (err)
 811                 return err;
 812
 813         if (k->def && k->defmgmt)
 814                 return -EINVAL;
 815
 816         if (k->defmgmt) {
 817                 if (k->def_uni || !k->def_multi)
 818                         return -EINVAL;
 819         }
 820
 821         if (k->idx != -1) {
 822                 if (k->defmgmt) {
 823                         if (k->idx < 4 || k->idx > 5)
 824                                 return -EINVAL;
 825                 } else if (k->def) {
 826                         if (k->idx < 0 || k->idx > 3)
 827                                 return -EINVAL;
 828                 } else {
 829                         if (k->idx < 0 || k->idx > 5)
 830                                 return -EINVAL;
 831                 }
 832         }
 833
 834         return 0;
 835 }
 836
 837 static struct cfg80211_cached_keys *
 838 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 839                        struct nlattr *keys, bool *no_ht)
 840 {
 841         struct key_parse parse;
 842         struct nlattr *key;
 843         struct cfg80211_cached_keys *result;
 844         int rem, err, def = 0;
 845
 846         result = kzalloc(sizeof(*result), GFP_KERNEL);
 847         if (!result)
 848                 return ERR_PTR(-ENOMEM);
 849
 850         result->def = -1;
 851         result->defmgmt = -1;
 852
 853         nla_for_each_nested(key, keys, rem) {
 854                 memset(&parse, 0, sizeof(parse));
 855                 parse.idx = -1;
 856
 857                 err = nl80211_parse_key_new(key, &parse);
 858                 if (err)
 859                         goto error;
 860                 err = -EINVAL;
 861                 if (!parse.p.key)
 862                         goto error;
 863                 if (parse.idx < 0 || parse.idx > 4)
 864                         goto error;
 865                 if (parse.def) {
 866                         if (def)
 867                                 goto error;
 868                         def = 1;
 869                         result->def = parse.idx;
 870                         if (!parse.def_uni || !parse.def_multi)
 871                                 goto error;
 872                 } else if (parse.defmgmt)
 873                         goto error;
 874                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 875                                                      parse.idx, false, NULL);
 876                 if (err)
 877                         goto error;
 878                 result->params[parse.idx].cipher = parse.p.cipher;
 879                 result->params[parse.idx].key_len = parse.p.key_len;
 880                 result->params[parse.idx].key = result->data[parse.idx];
 881                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 882
 883                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 884                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 885                         if (no_ht)
 886                                 *no_ht = true;
 887                 }
 888         }
 889
 890         return result;
 891  error:
 892         kfree(result);
 893         return ERR_PTR(err);
 894 }
 895
 896 static int nl80211_key_allowed(struct wireless_dev *wdev)
 897 {
 898         ASSERT_WDEV_LOCK(wdev);
 899
 900         switch (wdev->iftype) {
 901         case NL80211_IFTYPE_AP:
 902         case NL80211_IFTYPE_AP_VLAN:
 903         case NL80211_IFTYPE_P2P_GO:
 904         case NL80211_IFTYPE_MESH_POINT:
 905                 break;
 906         case NL80211_IFTYPE_ADHOC:
 907         case NL80211_IFTYPE_STATION:
 908         case NL80211_IFTYPE_P2P_CLIENT:
 909                 if (!wdev->current_bss)
 910                         return -ENOLINK;
 911                 break;
 912         case NL80211_IFTYPE_UNSPECIFIED:
 913         case NL80211_IFTYPE_OCB:
 914         case NL80211_IFTYPE_MONITOR:
 915         case NL80211_IFTYPE_P2P_DEVICE:
 916         case NL80211_IFTYPE_WDS:
 917         case NUM_NL80211_IFTYPES:
 918                 return -EINVAL;
 919         }
 920
 921         return 0;
 922 }
 923
 924 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
 925                                                         struct nlattr *tb)
 926 {
 927         struct ieee80211_channel *chan;
 928
 929         if (tb == NULL)
 930                 return NULL;
 931         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
 932         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 933                 return NULL;
 934         return chan;
 935 }
 936
 937 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 938 {
 939         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 940         int i;
 941
 942         if (!nl_modes)
 943                 goto nla_put_failure;
 944
 945         i = 0;
 946         while (ifmodes) {
 947                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 948                         goto nla_put_failure;
 949                 ifmodes >>= 1;
 950                 i++;
 951         }
 952
 953         nla_nest_end(msg, nl_modes);
 954         return 0;
 955
 956 nla_put_failure:
 957         return -ENOBUFS;
 958 }
 959
 960 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 961                                           struct sk_buff *msg,
 962                                           bool large)
 963 {
 964         struct nlattr *nl_combis;
 965         int i, j;
 966
 967         nl_combis = nla_nest_start(msg,
 968                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 969         if (!nl_combis)
 970                 goto nla_put_failure;
 971
 972         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 973                 const struct ieee80211_iface_combination *c;
 974                 struct nlattr *nl_combi, *nl_limits;
 975
 976                 c = &wiphy->iface_combinations[i];
 977
 978                 nl_combi = nla_nest_start(msg, i + 1);
 979                 if (!nl_combi)
 980                         goto nla_put_failure;
 981
 982                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 983                 if (!nl_limits)
 984                         goto nla_put_failure;
 985
 986                 for (j = 0; j < c->n_limits; j++) {
 987                         struct nlattr *nl_limit;
 988
 989                         nl_limit = nla_nest_start(msg, j + 1);
 990                         if (!nl_limit)
 991                                 goto nla_put_failure;
 992                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 993                                         c->limits[j].max))
 994                                 goto nla_put_failure;
 995                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 996                                                 c->limits[j].types))
 997                                 goto nla_put_failure;
 998                         nla_nest_end(msg, nl_limit);
 999                 }
1000
1001                 nla_nest_end(msg, nl_limits);
1002
1003                 if (c->beacon_int_infra_match &&
1004                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1005                         goto nla_put_failure;
1006                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1007                                 c->num_different_channels) ||
1008                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1009                                 c->max_interfaces))
1010                         goto nla_put_failure;
1011                 if (large &&
1012                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1013                                 c->radar_detect_widths) ||
1014                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1015                                 c->radar_detect_regions)))
1016                         goto nla_put_failure;
1017
1018                 nla_nest_end(msg, nl_combi);
1019         }
1020
1021         nla_nest_end(msg, nl_combis);
1022
1023         return 0;
1024 nla_put_failure:
1025         return -ENOBUFS;
1026 }
1027
1028 #ifdef CONFIG_PM
1029 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1030                                         struct sk_buff *msg)
1031 {
1032         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1033         struct nlattr *nl_tcp;
1034
1035         if (!tcp)
1036                 return 0;
1037
1038         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1039         if (!nl_tcp)
1040                 return -ENOBUFS;
1041
1042         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1043                         tcp->data_payload_max))
1044                 return -ENOBUFS;
1045
1046         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1047                         tcp->data_payload_max))
1048                 return -ENOBUFS;
1049
1050         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1051                 return -ENOBUFS;
1052
1053         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1054                                 sizeof(*tcp->tok), tcp->tok))
1055                 return -ENOBUFS;
1056
1057         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1058                         tcp->data_interval_max))
1059                 return -ENOBUFS;
1060
1061         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1062                         tcp->wake_payload_max))
1063                 return -ENOBUFS;
1064
1065         nla_nest_end(msg, nl_tcp);
1066         return 0;
1067 }
1068
1069 static int nl80211_send_wowlan(struct sk_buff *msg,
1070                                struct cfg80211_registered_device *rdev,
1071                                bool large)
1072 {
1073         struct nlattr *nl_wowlan;
1074
1075         if (!rdev->wiphy.wowlan)
1076                 return 0;
1077
1078         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1079         if (!nl_wowlan)
1080                 return -ENOBUFS;
1081
1082         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1083              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1084             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1085              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1086             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1087              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1088             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1089              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1090             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1091              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1092             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1093              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1094             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1095              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1096             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1097              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1098                 return -ENOBUFS;
1099
1100         if (rdev->wiphy.wowlan->n_patterns) {
1101                 struct nl80211_pattern_support pat = {
1102                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1103                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1104                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1105                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1106                 };
1107
1108                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1109                             sizeof(pat), &pat))
1110                         return -ENOBUFS;
1111         }
1112
1113         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1114             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1115                         rdev->wiphy.wowlan->max_nd_match_sets))
1116                 return -ENOBUFS;
1117
1118         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1119                 return -ENOBUFS;
1120
1121         nla_nest_end(msg, nl_wowlan);
1122
1123         return 0;
1124 }
1125 #endif
1126
1127 static int nl80211_send_coalesce(struct sk_buff *msg,
1128                                  struct cfg80211_registered_device *rdev)
1129 {
1130         struct nl80211_coalesce_rule_support rule;
1131
1132         if (!rdev->wiphy.coalesce)
1133                 return 0;
1134
1135         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1136         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1137         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1138         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1139         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1140         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1141
1142         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1143                 return -ENOBUFS;
1144
1145         return 0;
1146 }
1147
1148 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1149                                       struct ieee80211_supported_band *sband)
1150 {
1151         struct nlattr *nl_rates, *nl_rate;
1152         struct ieee80211_rate *rate;
1153         int i;
1154
1155         /* add HT info */
1156         if (sband->ht_cap.ht_supported &&
1157             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1158                      sizeof(sband->ht_cap.mcs),
1159                      &sband->ht_cap.mcs) ||
1160              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1161                          sband->ht_cap.cap) ||
1162              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1163                         sband->ht_cap.ampdu_factor) ||
1164              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1165                         sband->ht_cap.ampdu_density)))
1166                 return -ENOBUFS;
1167
1168         /* add VHT info */
1169         if (sband->vht_cap.vht_supported &&
1170             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1171                      sizeof(sband->vht_cap.vht_mcs),
1172                      &sband->vht_cap.vht_mcs) ||
1173              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1174                          sband->vht_cap.cap)))
1175                 return -ENOBUFS;
1176
1177         /* add bitrates */
1178         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1179         if (!nl_rates)
1180                 return -ENOBUFS;
1181
1182         for (i = 0; i < sband->n_bitrates; i++) {
1183                 nl_rate = nla_nest_start(msg, i);
1184                 if (!nl_rate)
1185                         return -ENOBUFS;
1186
1187                 rate = &sband->bitrates[i];
1188                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1189                                 rate->bitrate))
1190                         return -ENOBUFS;
1191                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1192                     nla_put_flag(msg,
1193                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1194                         return -ENOBUFS;
1195
1196                 nla_nest_end(msg, nl_rate);
1197         }
1198
1199         nla_nest_end(msg, nl_rates);
1200
1201         return 0;
1202 }
1203
1204 static int
1205 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1206                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1207 {
1208         u16 stypes;
1209         struct nlattr *nl_ftypes, *nl_ifs;
1210         enum nl80211_iftype ift;
1211         int i;
1212
1213         if (!mgmt_stypes)
1214                 return 0;
1215
1216         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1217         if (!nl_ifs)
1218                 return -ENOBUFS;
1219
1220         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1221                 nl_ftypes = nla_nest_start(msg, ift);
1222                 if (!nl_ftypes)
1223                         return -ENOBUFS;
1224                 i = 0;
1225                 stypes = mgmt_stypes[ift].tx;
1226                 while (stypes) {
1227                         if ((stypes & 1) &&
1228                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1229                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1230                                 return -ENOBUFS;
1231                         stypes >>= 1;
1232                         i++;
1233                 }
1234                 nla_nest_end(msg, nl_ftypes);
1235         }
1236
1237         nla_nest_end(msg, nl_ifs);
1238
1239         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1240         if (!nl_ifs)
1241                 return -ENOBUFS;
1242
1243         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1244                 nl_ftypes = nla_nest_start(msg, ift);
1245                 if (!nl_ftypes)
1246                         return -ENOBUFS;
1247                 i = 0;
1248                 stypes = mgmt_stypes[ift].rx;
1249                 while (stypes) {
1250                         if ((stypes & 1) &&
1251                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1252                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1253                                 return -ENOBUFS;
1254                         stypes >>= 1;
1255                         i++;
1256                 }
1257                 nla_nest_end(msg, nl_ftypes);
1258         }
1259         nla_nest_end(msg, nl_ifs);
1260
1261         return 0;
1262 }
1263
1264 struct nl80211_dump_wiphy_state {
1265         s64 filter_wiphy;
1266         long start;
1267         long split_start, band_start, chan_start, capa_start;
1268         bool split;
1269 };
1270
1271 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1272                               enum nl80211_commands cmd,
1273                               struct sk_buff *msg, u32 portid, u32 seq,
1274                               int flags, struct nl80211_dump_wiphy_state *state)
1275 {
1276         void *hdr;
1277         struct nlattr *nl_bands, *nl_band;
1278         struct nlattr *nl_freqs, *nl_freq;
1279         struct nlattr *nl_cmds;
1280         enum nl80211_band band;
1281         struct ieee80211_channel *chan;
1282         int i;
1283         const struct ieee80211_txrx_stypes *mgmt_stypes =
1284                                 rdev->wiphy.mgmt_stypes;
1285         u32 features;
1286
1287         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1288         if (!hdr)
1289                 return -ENOBUFS;
1290
1291         if (WARN_ON(!state))
1292                 return -EINVAL;
1293
1294         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1295             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1296                            wiphy_name(&rdev->wiphy)) ||
1297             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1298                         cfg80211_rdev_list_generation))
1299                 goto nla_put_failure;
1300
1301         if (cmd != NL80211_CMD_NEW_WIPHY)
1302                 goto finish;
1303
1304         switch (state->split_start) {
1305         case 0:
1306                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1307                                rdev->wiphy.retry_short) ||
1308                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1309                                rdev->wiphy.retry_long) ||
1310                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1311                                 rdev->wiphy.frag_threshold) ||
1312                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1313                                 rdev->wiphy.rts_threshold) ||
1314                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1315                                rdev->wiphy.coverage_class) ||
1316                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1317                                rdev->wiphy.max_scan_ssids) ||
1318                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1319                                rdev->wiphy.max_sched_scan_ssids) ||
1320                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1321                                 rdev->wiphy.max_scan_ie_len) ||
1322                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1323                                 rdev->wiphy.max_sched_scan_ie_len) ||
1324                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1325                                rdev->wiphy.max_match_sets) ||
1326                     nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
1327                                 rdev->wiphy.max_sched_scan_plans) ||
1328                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
1329                                 rdev->wiphy.max_sched_scan_plan_interval) ||
1330                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
1331                                 rdev->wiphy.max_sched_scan_plan_iterations))
1332                         goto nla_put_failure;
1333
1334                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1335                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1336                         goto nla_put_failure;
1337                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1338                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1339                         goto nla_put_failure;
1340                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1341                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1342                         goto nla_put_failure;
1343                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1344                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1345                         goto nla_put_failure;
1346                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1347                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1348                         goto nla_put_failure;
1349                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1350                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1351                         goto nla_put_failure;
1352                 state->split_start++;
1353                 if (state->split)
1354                         break;
1355         case 1:
1356                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1357                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1358                             rdev->wiphy.cipher_suites))
1359                         goto nla_put_failure;
1360
1361                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1362                                rdev->wiphy.max_num_pmkids))
1363                         goto nla_put_failure;
1364
1365                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1366                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1367                         goto nla_put_failure;
1368
1369                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1370                                 rdev->wiphy.available_antennas_tx) ||
1371                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1372                                 rdev->wiphy.available_antennas_rx))
1373                         goto nla_put_failure;
1374
1375                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1376                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1377                                 rdev->wiphy.probe_resp_offload))
1378                         goto nla_put_failure;
1379
1380                 if ((rdev->wiphy.available_antennas_tx ||
1381                      rdev->wiphy.available_antennas_rx) &&
1382                     rdev->ops->get_antenna) {
1383                         u32 tx_ant = 0, rx_ant = 0;
1384                         int res;
1385                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1386                         if (!res) {
1387                                 if (nla_put_u32(msg,
1388                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1389                                                 tx_ant) ||
1390                                     nla_put_u32(msg,
1391                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1392                                                 rx_ant))
1393                                         goto nla_put_failure;
1394                         }
1395                 }
1396
1397                 state->split_start++;
1398                 if (state->split)
1399                         break;
1400         case 2:
1401                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1402                                         rdev->wiphy.interface_modes))
1403                                 goto nla_put_failure;
1404                 state->split_start++;
1405                 if (state->split)
1406                         break;
1407         case 3:
1408                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1409                 if (!nl_bands)
1410                         goto nla_put_failure;
1411
1412                 for (band = state->band_start;
1413                      band < NUM_NL80211_BANDS; band++) {
1414                         struct ieee80211_supported_band *sband;
1415
1416                         sband = rdev->wiphy.bands[band];
1417
1418                         if (!sband)
1419                                 continue;
1420
1421                         nl_band = nla_nest_start(msg, band);
1422                         if (!nl_band)
1423                                 goto nla_put_failure;
1424
1425                         switch (state->chan_start) {
1426                         case 0:
1427                                 if (nl80211_send_band_rateinfo(msg, sband))
1428                                         goto nla_put_failure;
1429                                 state->chan_start++;
1430                                 if (state->split)
1431                                         break;
1432                         default:
1433                                 /* add frequencies */
1434                                 nl_freqs = nla_nest_start(
1435                                         msg, NL80211_BAND_ATTR_FREQS);
1436                                 if (!nl_freqs)
1437                                         goto nla_put_failure;
1438
1439                                 for (i = state->chan_start - 1;
1440                                      i < sband->n_channels;
1441                                      i++) {
1442                                         nl_freq = nla_nest_start(msg, i);
1443                                         if (!nl_freq)
1444                                                 goto nla_put_failure;
1445
1446                                         chan = &sband->channels[i];
1447
1448                                         if (nl80211_msg_put_channel(
1449                                                         msg, chan,
1450                                                         state->split))
1451                                                 goto nla_put_failure;
1452
1453                                         nla_nest_end(msg, nl_freq);
1454                                         if (state->split)
1455                                                 break;
1456                                 }
1457                                 if (i < sband->n_channels)
1458                                         state->chan_start = i + 2;
1459                                 else
1460                                         state->chan_start = 0;
1461                                 nla_nest_end(msg, nl_freqs);
1462                         }
1463
1464                         nla_nest_end(msg, nl_band);
1465
1466                         if (state->split) {
1467                                 /* start again here */
1468                                 if (state->chan_start)
1469                                         band--;
1470                                 break;
1471                         }
1472                 }
1473                 nla_nest_end(msg, nl_bands);
1474
1475                 if (band < NUM_NL80211_BANDS)
1476                         state->band_start = band + 1;
1477                 else
1478                         state->band_start = 0;
1479
1480                 /* if bands & channels are done, continue outside */
1481                 if (state->band_start == 0 && state->chan_start == 0)
1482                         state->split_start++;
1483                 if (state->split)
1484                         break;
1485         case 4:
1486                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1487                 if (!nl_cmds)
1488                         goto nla_put_failure;
1489
1490                 i = 0;
1491 #define CMD(op, n)                                                      \
1492                  do {                                                   \
1493                         if (rdev->ops->op) {                            \
1494                                 i++;                                    \
1495                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1496                                         goto nla_put_failure;           \
1497                         }                                               \
1498                 } while (0)
1499
1500                 CMD(add_virtual_intf, NEW_INTERFACE);
1501                 CMD(change_virtual_intf, SET_INTERFACE);
1502                 CMD(add_key, NEW_KEY);
1503                 CMD(start_ap, START_AP);
1504                 CMD(add_station, NEW_STATION);
1505                 CMD(add_mpath, NEW_MPATH);
1506                 CMD(update_mesh_config, SET_MESH_CONFIG);
1507                 CMD(change_bss, SET_BSS);
1508                 CMD(auth, AUTHENTICATE);
1509                 CMD(assoc, ASSOCIATE);
1510                 CMD(deauth, DEAUTHENTICATE);
1511                 CMD(disassoc, DISASSOCIATE);
1512                 CMD(join_ibss, JOIN_IBSS);
1513                 CMD(join_mesh, JOIN_MESH);
1514                 CMD(set_pmksa, SET_PMKSA);
1515                 CMD(del_pmksa, DEL_PMKSA);
1516                 CMD(flush_pmksa, FLUSH_PMKSA);
1517                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1518                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1519                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1520                 CMD(mgmt_tx, FRAME);
1521                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1522                 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1523                         i++;
1524                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1525                                 goto nla_put_failure;
1526                 }
1527                 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1528                     rdev->ops->join_mesh) {
1529                         i++;
1530                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1531                                 goto nla_put_failure;
1532                 }
1533                 CMD(set_wds_peer, SET_WDS_PEER);
1534                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1535                         CMD(tdls_mgmt, TDLS_MGMT);
1536                         CMD(tdls_oper, TDLS_OPER);
1537                 }
1538                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1539                         CMD(sched_scan_start, START_SCHED_SCAN);
1540                 CMD(probe_client, PROBE_CLIENT);
1541                 CMD(set_noack_map, SET_NOACK_MAP);
1542                 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1543                         i++;
1544                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1545                                 goto nla_put_failure;
1546                 }
1547                 CMD(start_p2p_device, START_P2P_DEVICE);
1548                 CMD(set_mcast_rate, SET_MCAST_RATE);
1549 #ifdef CONFIG_NL80211_TESTMODE
1550                 CMD(testmode_cmd, TESTMODE);
1551 #endif
1552                 if (state->split) {
1553                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1554                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1555                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1556                                 CMD(channel_switch, CHANNEL_SWITCH);
1557                         CMD(set_qos_map, SET_QOS_MAP);
1558                         if (rdev->wiphy.features &
1559                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
1560                                 CMD(add_tx_ts, ADD_TX_TS);
1561                 }
1562                 /* add into the if now */
1563 #undef CMD
1564
1565                 if (rdev->ops->connect || rdev->ops->auth) {
1566                         i++;
1567                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1568                                 goto nla_put_failure;
1569                 }
1570
1571                 if (rdev->ops->disconnect || rdev->ops->deauth) {
1572                         i++;
1573                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1574                                 goto nla_put_failure;
1575                 }
1576
1577                 nla_nest_end(msg, nl_cmds);
1578                 state->split_start++;
1579                 if (state->split)
1580                         break;
1581         case 5:
1582                 if (rdev->ops->remain_on_channel &&
1583                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1584                     nla_put_u32(msg,
1585                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1586                                 rdev->wiphy.max_remain_on_channel_duration))
1587                         goto nla_put_failure;
1588
1589                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1590                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1591                         goto nla_put_failure;
1592
1593                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1594                         goto nla_put_failure;
1595                 state->split_start++;
1596                 if (state->split)
1597                         break;
1598         case 6:
1599 #ifdef CONFIG_PM
1600                 if (nl80211_send_wowlan(msg, rdev, state->split))
1601                         goto nla_put_failure;
1602                 state->split_start++;
1603                 if (state->split)
1604                         break;
1605 #else
1606                 state->split_start++;
1607 #endif
1608         case 7:
1609                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1610                                         rdev->wiphy.software_iftypes))
1611                         goto nla_put_failure;
1612
1613                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1614                                                    state->split))
1615                         goto nla_put_failure;
1616
1617                 state->split_start++;
1618                 if (state->split)
1619                         break;
1620         case 8:
1621                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1622                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1623                                 rdev->wiphy.ap_sme_capa))
1624                         goto nla_put_failure;
1625
1626                 features = rdev->wiphy.features;
1627                 /*
1628                  * We can only add the per-channel limit information if the
1629                  * dump is split, otherwise it makes it too big. Therefore
1630                  * only advertise it in that case.
1631                  */
1632                 if (state->split)
1633                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1634                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1635                         goto nla_put_failure;
1636
1637                 if (rdev->wiphy.ht_capa_mod_mask &&
1638                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1639                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
1640                             rdev->wiphy.ht_capa_mod_mask))
1641                         goto nla_put_failure;
1642
1643                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1644                     rdev->wiphy.max_acl_mac_addrs &&
1645                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1646                                 rdev->wiphy.max_acl_mac_addrs))
1647                         goto nla_put_failure;
1648
1649                 /*
1650                  * Any information below this point is only available to
1651                  * applications that can deal with it being split. This
1652                  * helps ensure that newly added capabilities don't break
1653                  * older tools by overrunning their buffers.
1654                  *
1655                  * We still increment split_start so that in the split
1656                  * case we'll continue with more data in the next round,
1657                  * but break unconditionally so unsplit data stops here.
1658                  */
1659                 state->split_start++;
1660                 break;
1661         case 9:
1662                 if (rdev->wiphy.extended_capabilities &&
1663                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1664                              rdev->wiphy.extended_capabilities_len,
1665                              rdev->wiphy.extended_capabilities) ||
1666                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1667                              rdev->wiphy.extended_capabilities_len,
1668                              rdev->wiphy.extended_capabilities_mask)))
1669                         goto nla_put_failure;
1670
1671                 if (rdev->wiphy.vht_capa_mod_mask &&
1672                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1673                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
1674                             rdev->wiphy.vht_capa_mod_mask))
1675                         goto nla_put_failure;
1676
1677                 state->split_start++;
1678                 break;
1679         case 10:
1680                 if (nl80211_send_coalesce(msg, rdev))
1681                         goto nla_put_failure;
1682
1683                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1684                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1685                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1686                         goto nla_put_failure;
1687
1688                 if (rdev->wiphy.max_ap_assoc_sta &&
1689                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1690                                 rdev->wiphy.max_ap_assoc_sta))
1691                         goto nla_put_failure;
1692
1693                 state->split_start++;
1694                 break;
1695         case 11:
1696                 if (rdev->wiphy.n_vendor_commands) {
1697                         const struct nl80211_vendor_cmd_info *info;
1698                         struct nlattr *nested;
1699
1700                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1701                         if (!nested)
1702                                 goto nla_put_failure;
1703
1704                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1705                                 info = &rdev->wiphy.vendor_commands[i].info;
1706                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1707                                         goto nla_put_failure;
1708                         }
1709                         nla_nest_end(msg, nested);
1710                 }
1711
1712                 if (rdev->wiphy.n_vendor_events) {
1713                         const struct nl80211_vendor_cmd_info *info;
1714                         struct nlattr *nested;
1715
1716                         nested = nla_nest_start(msg,
1717                                                 NL80211_ATTR_VENDOR_EVENTS);
1718                         if (!nested)
1719                                 goto nla_put_failure;
1720
1721                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
1722                                 info = &rdev->wiphy.vendor_events[i];
1723                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1724                                         goto nla_put_failure;
1725                         }
1726                         nla_nest_end(msg, nested);
1727                 }
1728                 state->split_start++;
1729                 break;
1730         case 12:
1731                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
1732                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
1733                                rdev->wiphy.max_num_csa_counters))
1734                         goto nla_put_failure;
1735
1736                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
1737                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
1738                         goto nla_put_failure;
1739
1740                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
1741                             sizeof(rdev->wiphy.ext_features),
1742                             rdev->wiphy.ext_features))
1743                         goto nla_put_failure;
1744
1745                 if (rdev->wiphy.bss_select_support) {
1746                         struct nlattr *nested;
1747                         u32 bss_select_support = rdev->wiphy.bss_select_support;
1748
1749                         nested = nla_nest_start(msg, NL80211_ATTR_BSS_SELECT);
1750                         if (!nested)
1751                                 goto nla_put_failure;
1752
1753                         i = 0;
1754                         while (bss_select_support) {
1755                                 if ((bss_select_support & 1) &&
1756                                     nla_put_flag(msg, i))
1757                                         goto nla_put_failure;
1758                                 i++;
1759                                 bss_select_support >>= 1;
1760                         }
1761                         nla_nest_end(msg, nested);
1762                 }
1763
1764                 state->split_start++;
1765                 break;
1766         case 13:
1767                 if (rdev->wiphy.num_iftype_ext_capab &&
1768                     rdev->wiphy.iftype_ext_capab) {
1769                         struct nlattr *nested_ext_capab, *nested;
1770
1771                         nested = nla_nest_start(msg,
1772                                                 NL80211_ATTR_IFTYPE_EXT_CAPA);
1773                         if (!nested)
1774                                 goto nla_put_failure;
1775
1776                         for (i = state->capa_start;
1777                              i < rdev->wiphy.num_iftype_ext_capab; i++) {
1778                                 const struct wiphy_iftype_ext_capab *capab;
1779
1780                                 capab = &rdev->wiphy.iftype_ext_capab[i];
1781
1782                                 nested_ext_capab = nla_nest_start(msg, i);
1783                                 if (!nested_ext_capab ||
1784                                     nla_put_u32(msg, NL80211_ATTR_IFTYPE,
1785                                                 capab->iftype) ||
1786                                     nla_put(msg, NL80211_ATTR_EXT_CAPA,
1787                                             capab->extended_capabilities_len,
1788                                             capab->extended_capabilities) ||
1789                                     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1790                                             capab->extended_capabilities_len,
1791                                             capab->extended_capabilities_mask))
1792                                         goto nla_put_failure;
1793
1794                                 nla_nest_end(msg, nested_ext_capab);
1795                                 if (state->split)
1796                                         break;
1797                         }
1798                         nla_nest_end(msg, nested);
1799                         if (i < rdev->wiphy.num_iftype_ext_capab) {
1800                                 state->capa_start = i + 1;
1801                                 break;
1802                         }
1803                 }
1804
1805                 /* done */
1806                 state->split_start = 0;
1807                 break;
1808         }
1809  finish:
1810         genlmsg_end(msg, hdr);
1811         return 0;
1812
1813  nla_put_failure:
1814         genlmsg_cancel(msg, hdr);
1815         return -EMSGSIZE;
1816 }
1817
1818 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1819                                     struct netlink_callback *cb,
1820                                     struct nl80211_dump_wiphy_state *state)
1821 {
1822         struct nlattr **tb = nl80211_fam.attrbuf;
1823         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1824                               tb, nl80211_fam.maxattr, nl80211_policy);
1825         /* ignore parse errors for backward compatibility */
1826         if (ret)
1827                 return 0;
1828
1829         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1830         if (tb[NL80211_ATTR_WIPHY])
1831                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1832         if (tb[NL80211_ATTR_WDEV])
1833                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1834         if (tb[NL80211_ATTR_IFINDEX]) {
1835                 struct net_device *netdev;
1836                 struct cfg80211_registered_device *rdev;
1837                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1838
1839                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1840                 if (!netdev)
1841                         return -ENODEV;
1842                 if (netdev->ieee80211_ptr) {
1843                         rdev = wiphy_to_rdev(
1844                                 netdev->ieee80211_ptr->wiphy);
1845                         state->filter_wiphy = rdev->wiphy_idx;
1846                 }
1847         }
1848
1849         return 0;
1850 }
1851
1852 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1853 {
1854         int idx = 0, ret;
1855         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1856         struct cfg80211_registered_device *rdev;
1857
1858         rtnl_lock();
1859         if (!state) {
1860                 state = kzalloc(sizeof(*state), GFP_KERNEL);
1861                 if (!state) {
1862                         rtnl_unlock();
1863                         return -ENOMEM;
1864                 }
1865                 state->filter_wiphy = -1;
1866                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1867                 if (ret) {
1868                         kfree(state);
1869                         rtnl_unlock();
1870                         return ret;
1871                 }
1872                 cb->args[0] = (long)state;
1873         }
1874
1875         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1876                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1877                         continue;
1878                 if (++idx <= state->start)
1879                         continue;
1880                 if (state->filter_wiphy != -1 &&
1881                     state->filter_wiphy != rdev->wiphy_idx)
1882                         continue;
1883                 /* attempt to fit multiple wiphy data chunks into the skb */
1884                 do {
1885                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
1886                                                  skb,
1887                                                  NETLINK_CB(cb->skb).portid,
1888                                                  cb->nlh->nlmsg_seq,
1889                                                  NLM_F_MULTI, state);
1890                         if (ret < 0) {
1891                                 /*
1892                                  * If sending the wiphy data didn't fit (ENOBUFS
1893                                  * or EMSGSIZE returned), this SKB is still
1894                                  * empty (so it's not too big because another
1895                                  * wiphy dataset is already in the skb) and
1896                                  * we've not tried to adjust the dump allocation
1897                                  * yet ... then adjust the alloc size to be
1898                                  * bigger, and return 1 but with the empty skb.
1899                                  * This results in an empty message being RX'ed
1900                                  * in userspace, but that is ignored.
1901                                  *
1902                                  * We can then retry with the larger buffer.
1903                                  */
1904                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1905                                     !skb->len && !state->split &&
1906                                     cb->min_dump_alloc < 4096) {
1907                                         cb->min_dump_alloc = 4096;
1908                                         state->split_start = 0;
1909                                         rtnl_unlock();
1910                                         return 1;
1911                                 }
1912                                 idx--;
1913                                 break;
1914                         }
1915                 } while (state->split_start > 0);
1916                 break;
1917         }
1918         rtnl_unlock();
1919
1920         state->start = idx;
1921
1922         return skb->len;
1923 }
1924
1925 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
1926 {
1927         kfree((void *)cb->args[0]);
1928         return 0;
1929 }
1930
1931 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1932 {
1933         struct sk_buff *msg;
1934         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1935         struct nl80211_dump_wiphy_state state = {};
1936
1937         msg = nlmsg_new(4096, GFP_KERNEL);
1938         if (!msg)
1939                 return -ENOMEM;
1940
1941         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
1942                                info->snd_portid, info->snd_seq, 0,
1943                                &state) < 0) {
1944                 nlmsg_free(msg);
1945                 return -ENOBUFS;
1946         }
1947
1948         return genlmsg_reply(msg, info);
1949 }
1950
1951 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1952         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1953         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1954         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1955         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1956         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1957 };
1958
1959 static int parse_txq_params(struct nlattr *tb[],
1960                             struct ieee80211_txq_params *txq_params)
1961 {
1962         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1963             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1964             !tb[NL80211_TXQ_ATTR_AIFS])
1965                 return -EINVAL;
1966
1967         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1968         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1969         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1970         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1971         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1972
1973         if (txq_params->ac >= NL80211_NUM_ACS)
1974                 return -EINVAL;
1975
1976         return 0;
1977 }
1978
1979 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1980 {
1981         /*
1982          * You can only set the channel explicitly for WDS interfaces,
1983          * all others have their channel managed via their respective
1984          * "establish a connection" command (connect, join, ...)
1985          *
1986          * For AP/GO and mesh mode, the channel can be set with the
1987          * channel userspace API, but is only stored and passed to the
1988          * low-level driver when the AP starts or the mesh is joined.
1989          * This is for backward compatibility, userspace can also give
1990          * the channel in the start-ap or join-mesh commands instead.
1991          *
1992          * Monitors are special as they are normally slaved to
1993          * whatever else is going on, so they have their own special
1994          * operation to set the monitor channel if possible.
1995          */
1996         return !wdev ||
1997                 wdev->iftype == NL80211_IFTYPE_AP ||
1998                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1999                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
2000                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
2001 }
2002
2003 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
2004                                  struct genl_info *info,
2005                                  struct cfg80211_chan_def *chandef)
2006 {
2007         u32 control_freq;
2008
2009         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
2010                 return -EINVAL;
2011
2012         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
2013
2014         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
2015         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
2016         chandef->center_freq1 = control_freq;
2017         chandef->center_freq2 = 0;
2018
2019         /* Primary channel not allowed */
2020         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
2021                 return -EINVAL;
2022
2023         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2024                 enum nl80211_channel_type chantype;
2025
2026                 chantype = nla_get_u32(
2027                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2028
2029                 switch (chantype) {
2030                 case NL80211_CHAN_NO_HT:
2031                 case NL80211_CHAN_HT20:
2032                 case NL80211_CHAN_HT40PLUS:
2033                 case NL80211_CHAN_HT40MINUS:
2034                         cfg80211_chandef_create(chandef, chandef->chan,
2035                                                 chantype);
2036                         break;
2037                 default:
2038                         return -EINVAL;
2039                 }
2040         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
2041                 chandef->width =
2042                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
2043                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
2044                         chandef->center_freq1 =
2045                                 nla_get_u32(
2046                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
2047                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
2048                         chandef->center_freq2 =
2049                                 nla_get_u32(
2050                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
2051         }
2052
2053         if (!cfg80211_chandef_valid(chandef))
2054                 return -EINVAL;
2055
2056         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
2057                                      IEEE80211_CHAN_DISABLED))
2058                 return -EINVAL;
2059
2060         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
2061              chandef->width == NL80211_CHAN_WIDTH_10) &&
2062             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
2063                 return -EINVAL;
2064
2065         return 0;
2066 }
2067
2068 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
2069                                  struct net_device *dev,
2070                                  struct genl_info *info)
2071 {
2072         struct cfg80211_chan_def chandef;
2073         int result;
2074         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
2075         struct wireless_dev *wdev = NULL;
2076
2077         if (dev)
2078                 wdev = dev->ieee80211_ptr;
2079         if (!nl80211_can_set_dev_channel(wdev))
2080                 return -EOPNOTSUPP;
2081         if (wdev)
2082                 iftype = wdev->iftype;
2083
2084         result = nl80211_parse_chandef(rdev, info, &chandef);
2085         if (result)
2086                 return result;
2087
2088         switch (iftype) {
2089         case NL80211_IFTYPE_AP:
2090         case NL80211_IFTYPE_P2P_GO:
2091                 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
2092                                                    iftype)) {
2093                         result = -EINVAL;
2094                         break;
2095                 }
2096                 if (wdev->beacon_interval) {
2097                         if (!dev || !rdev->ops->set_ap_chanwidth ||
2098                             !(rdev->wiphy.features &
2099                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2100                                 result = -EBUSY;
2101                                 break;
2102                         }
2103
2104                         /* Only allow dynamic channel width changes */
2105                         if (chandef.chan != wdev->preset_chandef.chan) {
2106                                 result = -EBUSY;
2107                                 break;
2108                         }
2109                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2110                         if (result)
2111                                 break;
2112                 }
2113                 wdev->preset_chandef = chandef;
2114                 result = 0;
2115                 break;
2116         case NL80211_IFTYPE_MESH_POINT:
2117                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2118                 break;
2119         case NL80211_IFTYPE_MONITOR:
2120                 result = cfg80211_set_monitor_channel(rdev, &chandef);
2121                 break;
2122         default:
2123                 result = -EINVAL;
2124         }
2125
2126         return result;
2127 }
2128
2129 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2130 {
2131         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2132         struct net_device *netdev = info->user_ptr[1];
2133
2134         return __nl80211_set_channel(rdev, netdev, info);
2135 }
2136
2137 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2138 {
2139         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2140         struct net_device *dev = info->user_ptr[1];
2141         struct wireless_dev *wdev = dev->ieee80211_ptr;
2142         const u8 *bssid;
2143
2144         if (!info->attrs[NL80211_ATTR_MAC])
2145                 return -EINVAL;
2146
2147         if (netif_running(dev))
2148                 return -EBUSY;
2149
2150         if (!rdev->ops->set_wds_peer)
2151                 return -EOPNOTSUPP;
2152
2153         if (wdev->iftype != NL80211_IFTYPE_WDS)
2154                 return -EOPNOTSUPP;
2155
2156         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2157         return rdev_set_wds_peer(rdev, dev, bssid);
2158 }
2159
2160
2161 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2162 {
2163         struct cfg80211_registered_device *rdev;
2164         struct net_device *netdev = NULL;
2165         struct wireless_dev *wdev;
2166         int result = 0, rem_txq_params = 0;
2167         struct nlattr *nl_txq_params;
2168         u32 changed;
2169         u8 retry_short = 0, retry_long = 0;
2170         u32 frag_threshold = 0, rts_threshold = 0;
2171         u8 coverage_class = 0;
2172
2173         ASSERT_RTNL();
2174
2175         /*
2176          * Try to find the wiphy and netdev. Normally this
2177          * function shouldn't need the netdev, but this is
2178          * done for backward compatibility -- previously
2179          * setting the channel was done per wiphy, but now
2180          * it is per netdev. Previous userland like hostapd
2181          * also passed a netdev to set_wiphy, so that it is
2182          * possible to let that go to the right netdev!
2183          */
2184
2185         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2186                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2187
2188                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2189                 if (netdev && netdev->ieee80211_ptr)
2190                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2191                 else
2192                         netdev = NULL;
2193         }
2194
2195         if (!netdev) {
2196                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2197                                                   info->attrs);
2198                 if (IS_ERR(rdev))
2199                         return PTR_ERR(rdev);
2200                 wdev = NULL;
2201                 netdev = NULL;
2202                 result = 0;
2203         } else
2204                 wdev = netdev->ieee80211_ptr;
2205
2206         /*
2207          * end workaround code, by now the rdev is available
2208          * and locked, and wdev may or may not be NULL.
2209          */
2210
2211         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2212                 result = cfg80211_dev_rename(
2213                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2214
2215         if (result)
2216                 return result;
2217
2218         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2219                 struct ieee80211_txq_params txq_params;
2220                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2221
2222                 if (!rdev->ops->set_txq_params)
2223                         return -EOPNOTSUPP;
2224
2225                 if (!netdev)
2226                         return -EINVAL;
2227
2228                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2229                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2230                         return -EINVAL;
2231
2232                 if (!netif_running(netdev))
2233                         return -ENETDOWN;
2234
2235                 nla_for_each_nested(nl_txq_params,
2236                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2237                                     rem_txq_params) {
2238                         result = nla_parse(tb, NL80211_TXQ_ATTR_MAX,
2239                                            nla_data(nl_txq_params),
2240                                            nla_len(nl_txq_params),
2241                                            txq_params_policy);
2242                         if (result)
2243                                 return result;
2244                         result = parse_txq_params(tb, &txq_params);
2245                         if (result)
2246                                 return result;
2247
2248                         result = rdev_set_txq_params(rdev, netdev,
2249                                                      &txq_params);
2250                         if (result)
2251                                 return result;
2252                 }
2253         }
2254
2255         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2256                 result = __nl80211_set_channel(
2257                         rdev,
2258                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2259                         info);
2260                 if (result)
2261                         return result;
2262         }
2263
2264         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2265                 struct wireless_dev *txp_wdev = wdev;
2266                 enum nl80211_tx_power_setting type;
2267                 int idx, mbm = 0;
2268
2269                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2270                         txp_wdev = NULL;
2271
2272                 if (!rdev->ops->set_tx_power)
2273                         return -EOPNOTSUPP;
2274
2275                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2276                 type = nla_get_u32(info->attrs[idx]);
2277
2278                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2279                     (type != NL80211_TX_POWER_AUTOMATIC))
2280                         return -EINVAL;
2281
2282                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2283                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2284                         mbm = nla_get_u32(info->attrs[idx]);
2285                 }
2286
2287                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2288                 if (result)
2289                         return result;
2290         }
2291
2292         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2293             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2294                 u32 tx_ant, rx_ant;
2295                 if ((!rdev->wiphy.available_antennas_tx &&
2296                      !rdev->wiphy.available_antennas_rx) ||
2297                     !rdev->ops->set_antenna)
2298                         return -EOPNOTSUPP;
2299
2300                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2301                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2302
2303                 /* reject antenna configurations which don't match the
2304                  * available antenna masks, except for the "all" mask */
2305                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2306                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2307                         return -EINVAL;
2308
2309                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2310                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2311
2312                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2313                 if (result)
2314                         return result;
2315         }
2316
2317         changed = 0;
2318
2319         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2320                 retry_short = nla_get_u8(
2321                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2322                 if (retry_short == 0)
2323                         return -EINVAL;
2324
2325                 changed |= WIPHY_PARAM_RETRY_SHORT;
2326         }
2327
2328         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2329                 retry_long = nla_get_u8(
2330                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2331                 if (retry_long == 0)
2332                         return -EINVAL;
2333
2334                 changed |= WIPHY_PARAM_RETRY_LONG;
2335         }
2336
2337         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2338                 frag_threshold = nla_get_u32(
2339                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2340                 if (frag_threshold < 256)
2341                         return -EINVAL;
2342
2343                 if (frag_threshold != (u32) -1) {
2344                         /*
2345                          * Fragments (apart from the last one) are required to
2346                          * have even length. Make the fragmentation code
2347                          * simpler by stripping LSB should someone try to use
2348                          * odd threshold value.
2349                          */
2350                         frag_threshold &= ~0x1;
2351                 }
2352                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2353         }
2354
2355         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2356                 rts_threshold = nla_get_u32(
2357                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2358                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2359         }
2360
2361         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2362                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2363                         return -EINVAL;
2364
2365                 coverage_class = nla_get_u8(
2366                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2367                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2368         }
2369
2370         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2371                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2372                         return -EOPNOTSUPP;
2373
2374                 changed |= WIPHY_PARAM_DYN_ACK;
2375         }
2376
2377         if (changed) {
2378                 u8 old_retry_short, old_retry_long;
2379                 u32 old_frag_threshold, old_rts_threshold;
2380                 u8 old_coverage_class;
2381
2382                 if (!rdev->ops->set_wiphy_params)
2383                         return -EOPNOTSUPP;
2384
2385                 old_retry_short = rdev->wiphy.retry_short;
2386                 old_retry_long = rdev->wiphy.retry_long;
2387                 old_frag_threshold = rdev->wiphy.frag_threshold;
2388                 old_rts_threshold = rdev->wiphy.rts_threshold;
2389                 old_coverage_class = rdev->wiphy.coverage_class;
2390
2391                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2392                         rdev->wiphy.retry_short = retry_short;
2393                 if (changed & WIPHY_PARAM_RETRY_LONG)
2394                         rdev->wiphy.retry_long = retry_long;
2395                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2396                         rdev->wiphy.frag_threshold = frag_threshold;
2397                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2398                         rdev->wiphy.rts_threshold = rts_threshold;
2399                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2400                         rdev->wiphy.coverage_class = coverage_class;
2401
2402                 result = rdev_set_wiphy_params(rdev, changed);
2403                 if (result) {
2404                         rdev->wiphy.retry_short = old_retry_short;
2405                         rdev->wiphy.retry_long = old_retry_long;
2406                         rdev->wiphy.frag_threshold = old_frag_threshold;
2407                         rdev->wiphy.rts_threshold = old_rts_threshold;
2408                         rdev->wiphy.coverage_class = old_coverage_class;
2409                         return result;
2410                 }
2411         }
2412         return 0;
2413 }
2414
2415 static inline u64 wdev_id(struct wireless_dev *wdev)
2416 {
2417         return (u64)wdev->identifier |
2418                ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2419 }
2420
2421 static int nl80211_send_chandef(struct sk_buff *msg,
2422                                 const struct cfg80211_chan_def *chandef)
2423 {
2424         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
2425                 return -EINVAL;
2426
2427         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2428                         chandef->chan->center_freq))
2429                 return -ENOBUFS;
2430         switch (chandef->width) {
2431         case NL80211_CHAN_WIDTH_20_NOHT:
2432         case NL80211_CHAN_WIDTH_20:
2433         case NL80211_CHAN_WIDTH_40:
2434                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2435                                 cfg80211_get_chandef_type(chandef)))
2436                         return -ENOBUFS;
2437                 break;
2438         default:
2439                 break;
2440         }
2441         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2442                 return -ENOBUFS;
2443         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2444                 return -ENOBUFS;
2445         if (chandef->center_freq2 &&
2446             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2447                 return -ENOBUFS;
2448         return 0;
2449 }
2450
2451 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2452                               struct cfg80211_registered_device *rdev,
2453                               struct wireless_dev *wdev, bool removal)
2454 {
2455         struct net_device *dev = wdev->netdev;
2456         u8 cmd = NL80211_CMD_NEW_INTERFACE;
2457         void *hdr;
2458
2459         if (removal)
2460                 cmd = NL80211_CMD_DEL_INTERFACE;
2461
2462         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2463         if (!hdr)
2464                 return -1;
2465
2466         if (dev &&
2467             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2468              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2469                 goto nla_put_failure;
2470
2471         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2472             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2473             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
2474                               NL80211_ATTR_PAD) ||
2475             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2476             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2477                         rdev->devlist_generation ^
2478                         (cfg80211_rdev_list_generation << 2)))
2479                 goto nla_put_failure;
2480
2481         if (rdev->ops->get_channel) {
2482                 int ret;
2483                 struct cfg80211_chan_def chandef;
2484
2485                 ret = rdev_get_channel(rdev, wdev, &chandef);
2486                 if (ret == 0) {
2487                         if (nl80211_send_chandef(msg, &chandef))
2488                                 goto nla_put_failure;
2489                 }
2490         }
2491
2492         if (rdev->ops->get_tx_power) {
2493                 int dbm, ret;
2494
2495                 ret = rdev_get_tx_power(rdev, wdev, &dbm);
2496                 if (ret == 0 &&
2497                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
2498                                 DBM_TO_MBM(dbm)))
2499                         goto nla_put_failure;
2500         }
2501
2502         if (wdev->ssid_len) {
2503                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2504                         goto nla_put_failure;
2505         }
2506
2507         genlmsg_end(msg, hdr);
2508         return 0;
2509
2510  nla_put_failure:
2511         genlmsg_cancel(msg, hdr);
2512         return -EMSGSIZE;
2513 }
2514
2515 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2516 {
2517         int wp_idx = 0;
2518         int if_idx = 0;
2519         int wp_start = cb->args[0];
2520         int if_start = cb->args[1];
2521         struct cfg80211_registered_device *rdev;
2522         struct wireless_dev *wdev;
2523
2524         rtnl_lock();
2525         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2526                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2527                         continue;
2528                 if (wp_idx < wp_start) {
2529                         wp_idx++;
2530                         continue;
2531                 }
2532                 if_idx = 0;
2533
2534                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
2535                         if (if_idx < if_start) {
2536                                 if_idx++;
2537                                 continue;
2538                         }
2539                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2540                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2541                                                rdev, wdev, false) < 0) {
2542                                 goto out;
2543                         }
2544                         if_idx++;
2545                 }
2546
2547                 wp_idx++;
2548         }
2549  out:
2550         rtnl_unlock();
2551
2552         cb->args[0] = wp_idx;
2553         cb->args[1] = if_idx;
2554
2555         return skb->len;
2556 }
2557
2558 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2559 {
2560         struct sk_buff *msg;
2561         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2562         struct wireless_dev *wdev = info->user_ptr[1];
2563
2564         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2565         if (!msg)
2566                 return -ENOMEM;
2567
2568         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2569                                rdev, wdev, false) < 0) {
2570                 nlmsg_free(msg);
2571                 return -ENOBUFS;
2572         }
2573
2574         return genlmsg_reply(msg, info);
2575 }
2576
2577 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2578         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2579         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2580         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2581         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2582         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2583         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2584 };
2585
2586 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2587 {
2588         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2589         int flag;
2590
2591         *mntrflags = 0;
2592
2593         if (!nla)
2594                 return -EINVAL;
2595
2596         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2597                              nla, mntr_flags_policy))
2598                 return -EINVAL;
2599
2600         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2601                 if (flags[flag])
2602                         *mntrflags |= (1<<flag);
2603
2604         return 0;
2605 }
2606
2607 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2608                                struct net_device *netdev, u8 use_4addr,
2609                                enum nl80211_iftype iftype)
2610 {
2611         if (!use_4addr) {
2612                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2613                         return -EBUSY;
2614                 return 0;
2615         }
2616
2617         switch (iftype) {
2618         case NL80211_IFTYPE_AP_VLAN:
2619                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2620                         return 0;
2621                 break;
2622         case NL80211_IFTYPE_STATION:
2623                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2624                         return 0;
2625                 break;
2626         default:
2627                 break;
2628         }
2629
2630         return -EOPNOTSUPP;
2631 }
2632
2633 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2634 {
2635         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2636         struct vif_params params;
2637         int err;
2638         enum nl80211_iftype otype, ntype;
2639         struct net_device *dev = info->user_ptr[1];
2640         u32 _flags, *flags = NULL;
2641         bool change = false;
2642
2643         memset(&params, 0, sizeof(params));
2644
2645         otype = ntype = dev->ieee80211_ptr->iftype;
2646
2647         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2648                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2649                 if (otype != ntype)
2650                         change = true;
2651                 if (ntype > NL80211_IFTYPE_MAX)
2652                         return -EINVAL;
2653         }
2654
2655         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2656                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2657
2658                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2659                         return -EINVAL;
2660                 if (netif_running(dev))
2661                         return -EBUSY;
2662
2663                 wdev_lock(wdev);
2664                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2665                              IEEE80211_MAX_MESH_ID_LEN);
2666                 wdev->mesh_id_up_len =
2667                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2668                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2669                        wdev->mesh_id_up_len);
2670                 wdev_unlock(wdev);
2671         }
2672
2673         if (info->attrs[NL80211_ATTR_4ADDR]) {
2674                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2675                 change = true;
2676                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2677                 if (err)
2678                         return err;
2679         } else {
2680                 params.use_4addr = -1;
2681         }
2682
2683         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2684                 if (ntype != NL80211_IFTYPE_MONITOR)
2685                         return -EINVAL;
2686                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2687                                           &_flags);
2688                 if (err)
2689                         return err;
2690
2691                 flags = &_flags;
2692                 change = true;
2693         }
2694
2695         if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
2696             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2697                 return -EOPNOTSUPP;
2698
2699         if (change)
2700                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2701         else
2702                 err = 0;
2703
2704         if (!err && params.use_4addr != -1)
2705                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2706
2707         return err;
2708 }
2709
2710 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2711 {
2712         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2713         struct vif_params params;
2714         struct wireless_dev *wdev;
2715         struct sk_buff *msg, *event;
2716         int err;
2717         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2718         u32 flags;
2719
2720         /* to avoid failing a new interface creation due to pending removal */
2721         cfg80211_destroy_ifaces(rdev);
2722
2723         memset(&params, 0, sizeof(params));
2724
2725         if (!info->attrs[NL80211_ATTR_IFNAME])
2726                 return -EINVAL;
2727
2728         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2729                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2730                 if (type > NL80211_IFTYPE_MAX)
2731                         return -EINVAL;
2732         }
2733
2734         if (!rdev->ops->add_virtual_intf ||
2735             !(rdev->wiphy.interface_modes & (1 << type)))
2736                 return -EOPNOTSUPP;
2737
2738         if ((type == NL80211_IFTYPE_P2P_DEVICE ||
2739              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
2740             info->attrs[NL80211_ATTR_MAC]) {
2741                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2742                            ETH_ALEN);
2743                 if (!is_valid_ether_addr(params.macaddr))
2744                         return -EADDRNOTAVAIL;
2745         }
2746
2747         if (info->attrs[NL80211_ATTR_4ADDR]) {
2748                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2749                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2750                 if (err)
2751                         return err;
2752         }
2753
2754         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2755                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2756                                   &flags);
2757
2758         if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
2759             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2760                 return -EOPNOTSUPP;
2761
2762         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2763         if (!msg)
2764                 return -ENOMEM;
2765
2766         wdev = rdev_add_virtual_intf(rdev,
2767                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2768                                 NET_NAME_USER, type, err ? NULL : &flags,
2769                                 &params);
2770         if (WARN_ON(!wdev)) {
2771                 nlmsg_free(msg);
2772                 return -EPROTO;
2773         } else if (IS_ERR(wdev)) {
2774                 nlmsg_free(msg);
2775                 return PTR_ERR(wdev);
2776         }
2777
2778         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
2779                 wdev->owner_nlportid = info->snd_portid;
2780
2781         switch (type) {
2782         case NL80211_IFTYPE_MESH_POINT:
2783                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2784                         break;
2785                 wdev_lock(wdev);
2786                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2787                              IEEE80211_MAX_MESH_ID_LEN);
2788                 wdev->mesh_id_up_len =
2789                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2790                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2791                        wdev->mesh_id_up_len);
2792                 wdev_unlock(wdev);
2793                 break;
2794         case NL80211_IFTYPE_P2P_DEVICE:
2795                 /*
2796                  * P2P Device doesn't have a netdev, so doesn't go
2797                  * through the netdev notifier and must be added here
2798                  */
2799                 mutex_init(&wdev->mtx);
2800                 INIT_LIST_HEAD(&wdev->event_list);
2801                 spin_lock_init(&wdev->event_lock);
2802                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2803                 spin_lock_init(&wdev->mgmt_registrations_lock);
2804
2805                 wdev->identifier = ++rdev->wdev_id;
2806                 list_add_rcu(&wdev->list, &rdev->wiphy.wdev_list);
2807                 rdev->devlist_generation++;
2808                 break;
2809         default:
2810                 break;
2811         }
2812
2813         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2814                                rdev, wdev, false) < 0) {
2815                 nlmsg_free(msg);
2816                 return -ENOBUFS;
2817         }
2818
2819         event = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2820         if (event) {
2821                 if (nl80211_send_iface(event, 0, 0, 0,
2822                                        rdev, wdev, false) < 0) {
2823                         nlmsg_free(event);
2824                         goto out;
2825                 }
2826
2827                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
2828                                         event, 0, NL80211_MCGRP_CONFIG,
2829                                         GFP_KERNEL);
2830         }
2831
2832 out:
2833         return genlmsg_reply(msg, info);
2834 }
2835
2836 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2837 {
2838         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2839         struct wireless_dev *wdev = info->user_ptr[1];
2840         struct sk_buff *msg;
2841         int status;
2842
2843         if (!rdev->ops->del_virtual_intf)
2844                 return -EOPNOTSUPP;
2845
2846         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2847         if (msg && nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, true) < 0) {
2848                 nlmsg_free(msg);
2849                 msg = NULL;
2850         }
2851
2852         /*
2853          * If we remove a wireless device without a netdev then clear
2854          * user_ptr[1] so that nl80211_post_doit won't dereference it
2855          * to check if it needs to do dev_put(). Otherwise it crashes
2856          * since the wdev has been freed, unlike with a netdev where
2857          * we need the dev_put() for the netdev to really be freed.
2858          */
2859         if (!wdev->netdev)
2860                 info->user_ptr[1] = NULL;
2861
2862         status = rdev_del_virtual_intf(rdev, wdev);
2863         if (status >= 0 && msg)
2864                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
2865                                         msg, 0, NL80211_MCGRP_CONFIG,
2866                                         GFP_KERNEL);
2867         else
2868                 nlmsg_free(msg);
2869
2870         return status;
2871 }
2872
2873 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2874 {
2875         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2876         struct net_device *dev = info->user_ptr[1];
2877         u16 noack_map;
2878
2879         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2880                 return -EINVAL;
2881
2882         if (!rdev->ops->set_noack_map)
2883                 return -EOPNOTSUPP;
2884
2885         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2886
2887         return rdev_set_noack_map(rdev, dev, noack_map);
2888 }
2889
2890 struct get_key_cookie {
2891         struct sk_buff *msg;
2892         int error;
2893         int idx;
2894 };
2895
2896 static void get_key_callback(void *c, struct key_params *params)
2897 {
2898         struct nlattr *key;
2899         struct get_key_cookie *cookie = c;
2900
2901         if ((params->key &&
2902              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2903                      params->key_len, params->key)) ||
2904             (params->seq &&
2905              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2906                      params->seq_len, params->seq)) ||
2907             (params->cipher &&
2908              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2909                          params->cipher)))
2910                 goto nla_put_failure;
2911
2912         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2913         if (!key)
2914                 goto nla_put_failure;
2915
2916         if ((params->key &&
2917              nla_put(cookie->msg, NL80211_KEY_DATA,
2918                      params->key_len, params->key)) ||
2919             (params->seq &&
2920              nla_put(cookie->msg, NL80211_KEY_SEQ,
2921                      params->seq_len, params->seq)) ||
2922             (params->cipher &&
2923              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2924                          params->cipher)))
2925                 goto nla_put_failure;
2926
2927         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2928                 goto nla_put_failure;
2929
2930         nla_nest_end(cookie->msg, key);
2931
2932         return;
2933  nla_put_failure:
2934         cookie->error = 1;
2935 }
2936
2937 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2938 {
2939         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2940         int err;
2941         struct net_device *dev = info->user_ptr[1];
2942         u8 key_idx = 0;
2943         const u8 *mac_addr = NULL;
2944         bool pairwise;
2945         struct get_key_cookie cookie = {
2946                 .error = 0,
2947         };
2948         void *hdr;
2949         struct sk_buff *msg;
2950
2951         if (info->attrs[NL80211_ATTR_KEY_IDX])
2952                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2953
2954         if (key_idx > 5)
2955                 return -EINVAL;
2956
2957         if (info->attrs[NL80211_ATTR_MAC])
2958                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2959
2960         pairwise = !!mac_addr;
2961         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2962                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2963                 if (kt >= NUM_NL80211_KEYTYPES)
2964                         return -EINVAL;
2965                 if (kt != NL80211_KEYTYPE_GROUP &&
2966                     kt != NL80211_KEYTYPE_PAIRWISE)
2967                         return -EINVAL;
2968                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2969         }
2970
2971         if (!rdev->ops->get_key)
2972                 return -EOPNOTSUPP;
2973
2974         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2975                 return -ENOENT;
2976
2977         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2978         if (!msg)
2979                 return -ENOMEM;
2980
2981         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2982                              NL80211_CMD_NEW_KEY);
2983         if (!hdr)
2984                 goto nla_put_failure;
2985
2986         cookie.msg = msg;
2987         cookie.idx = key_idx;
2988
2989         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2990             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2991                 goto nla_put_failure;
2992         if (mac_addr &&
2993             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2994                 goto nla_put_failure;
2995
2996         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2997                            get_key_callback);
2998
2999         if (err)
3000                 goto free_msg;
3001
3002         if (cookie.error)
3003                 goto nla_put_failure;
3004
3005         genlmsg_end(msg, hdr);
3006         return genlmsg_reply(msg, info);
3007
3008  nla_put_failure:
3009         err = -ENOBUFS;
3010  free_msg:
3011         nlmsg_free(msg);
3012         return err;
3013 }
3014
3015 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
3016 {
3017         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3018         struct key_parse key;
3019         int err;
3020         struct net_device *dev = info->user_ptr[1];
3021
3022         err = nl80211_parse_key(info, &key);
3023         if (err)
3024                 return err;
3025
3026         if (key.idx < 0)
3027                 return -EINVAL;
3028
3029         /* only support setting default key */
3030         if (!key.def && !key.defmgmt)
3031                 return -EINVAL;
3032
3033         wdev_lock(dev->ieee80211_ptr);
3034
3035         if (key.def) {
3036                 if (!rdev->ops->set_default_key) {
3037                         err = -EOPNOTSUPP;
3038                         goto out;
3039                 }
3040
3041                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3042                 if (err)
3043                         goto out;
3044
3045                 err = rdev_set_default_key(rdev, dev, key.idx,
3046                                                  key.def_uni, key.def_multi);
3047
3048                 if (err)
3049                         goto out;
3050
3051 #ifdef CONFIG_CFG80211_WEXT
3052                 dev->ieee80211_ptr->wext.default_key = key.idx;
3053 #endif
3054         } else {
3055                 if (key.def_uni || !key.def_multi) {
3056                         err = -EINVAL;
3057                         goto out;
3058                 }
3059
3060                 if (!rdev->ops->set_default_mgmt_key) {
3061                         err = -EOPNOTSUPP;
3062                         goto out;
3063                 }
3064
3065                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3066                 if (err)
3067                         goto out;
3068
3069                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
3070                 if (err)
3071                         goto out;
3072
3073 #ifdef CONFIG_CFG80211_WEXT
3074                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
3075 #endif
3076         }
3077
3078  out:
3079         wdev_unlock(dev->ieee80211_ptr);
3080
3081         return err;
3082 }
3083
3084 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
3085 {
3086         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3087         int err;
3088         struct net_device *dev = info->user_ptr[1];
3089         struct key_parse key;
3090         const u8 *mac_addr = NULL;
3091
3092         err = nl80211_parse_key(info, &key);
3093         if (err)
3094                 return err;
3095
3096         if (!key.p.key)
3097                 return -EINVAL;
3098
3099         if (info->attrs[NL80211_ATTR_MAC])
3100                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3101
3102         if (key.type == -1) {
3103                 if (mac_addr)
3104                         key.type = NL80211_KEYTYPE_PAIRWISE;
3105                 else
3106                         key.type = NL80211_KEYTYPE_GROUP;
3107         }
3108
3109         /* for now */
3110         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3111             key.type != NL80211_KEYTYPE_GROUP)
3112                 return -EINVAL;
3113
3114         if (!rdev->ops->add_key)
3115                 return -EOPNOTSUPP;
3116
3117         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3118                                            key.type == NL80211_KEYTYPE_PAIRWISE,
3119                                            mac_addr))
3120                 return -EINVAL;
3121
3122         wdev_lock(dev->ieee80211_ptr);
3123         err = nl80211_key_allowed(dev->ieee80211_ptr);
3124         if (!err)
3125                 err = rdev_add_key(rdev, dev, key.idx,
3126                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3127                                     mac_addr, &key.p);
3128         wdev_unlock(dev->ieee80211_ptr);
3129
3130         return err;
3131 }
3132
3133 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3134 {
3135         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3136         int err;
3137         struct net_device *dev = info->user_ptr[1];
3138         u8 *mac_addr = NULL;
3139         struct key_parse key;
3140
3141         err = nl80211_parse_key(info, &key);
3142         if (err)
3143                 return err;
3144
3145         if (info->attrs[NL80211_ATTR_MAC])
3146                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3147
3148         if (key.type == -1) {
3149                 if (mac_addr)
3150                         key.type = NL80211_KEYTYPE_PAIRWISE;
3151                 else
3152                         key.type = NL80211_KEYTYPE_GROUP;
3153         }
3154
3155         /* for now */
3156         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3157             key.type != NL80211_KEYTYPE_GROUP)
3158                 return -EINVAL;
3159
3160         if (!rdev->ops->del_key)
3161                 return -EOPNOTSUPP;
3162
3163         wdev_lock(dev->ieee80211_ptr);
3164         err = nl80211_key_allowed(dev->ieee80211_ptr);
3165
3166         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
3167             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3168                 err = -ENOENT;
3169
3170         if (!err)
3171                 err = rdev_del_key(rdev, dev, key.idx,
3172                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3173                                    mac_addr);
3174
3175 #ifdef CONFIG_CFG80211_WEXT
3176         if (!err) {
3177                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
3178                         dev->ieee80211_ptr->wext.default_key = -1;
3179                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3180                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3181         }
3182 #endif
3183         wdev_unlock(dev->ieee80211_ptr);
3184
3185         return err;
3186 }
3187
3188 /* This function returns an error or the number of nested attributes */
3189 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3190 {
3191         struct nlattr *attr;
3192         int n_entries = 0, tmp;
3193
3194         nla_for_each_nested(attr, nl_attr, tmp) {
3195                 if (nla_len(attr) != ETH_ALEN)
3196                         return -EINVAL;
3197
3198                 n_entries++;
3199         }
3200
3201         return n_entries;
3202 }
3203
3204 /*
3205  * This function parses ACL information and allocates memory for ACL data.
3206  * On successful return, the calling function is responsible to free the
3207  * ACL buffer returned by this function.
3208  */
3209 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3210                                                 struct genl_info *info)
3211 {
3212         enum nl80211_acl_policy acl_policy;
3213         struct nlattr *attr;
3214         struct cfg80211_acl_data *acl;
3215         int i = 0, n_entries, tmp;
3216
3217         if (!wiphy->max_acl_mac_addrs)
3218                 return ERR_PTR(-EOPNOTSUPP);
3219
3220         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3221                 return ERR_PTR(-EINVAL);
3222
3223         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3224         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3225             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3226                 return ERR_PTR(-EINVAL);
3227
3228         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3229                 return ERR_PTR(-EINVAL);
3230
3231         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3232         if (n_entries < 0)
3233                 return ERR_PTR(n_entries);
3234
3235         if (n_entries > wiphy->max_acl_mac_addrs)
3236                 return ERR_PTR(-ENOTSUPP);
3237
3238         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3239                       GFP_KERNEL);
3240         if (!acl)
3241                 return ERR_PTR(-ENOMEM);
3242
3243         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3244                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3245                 i++;
3246         }
3247
3248         acl->n_acl_entries = n_entries;
3249         acl->acl_policy = acl_policy;
3250
3251         return acl;
3252 }
3253
3254 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3255 {
3256         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3257         struct net_device *dev = info->user_ptr[1];
3258         struct cfg80211_acl_data *acl;
3259         int err;
3260
3261         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3262             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3263                 return -EOPNOTSUPP;
3264
3265         if (!dev->ieee80211_ptr->beacon_interval)
3266                 return -EINVAL;
3267
3268         acl = parse_acl_data(&rdev->wiphy, info);
3269         if (IS_ERR(acl))
3270                 return PTR_ERR(acl);
3271
3272         err = rdev_set_mac_acl(rdev, dev, acl);
3273
3274         kfree(acl);
3275
3276         return err;
3277 }
3278
3279 static int nl80211_parse_beacon(struct nlattr *attrs[],
3280                                 struct cfg80211_beacon_data *bcn)
3281 {
3282         bool haveinfo = false;
3283
3284         if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
3285             !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
3286             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
3287             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
3288                 return -EINVAL;
3289
3290         memset(bcn, 0, sizeof(*bcn));
3291
3292         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
3293                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
3294                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
3295                 if (!bcn->head_len)
3296                         return -EINVAL;
3297                 haveinfo = true;
3298         }
3299
3300         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
3301                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
3302                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
3303                 haveinfo = true;
3304         }
3305
3306         if (!haveinfo)
3307                 return -EINVAL;
3308
3309         if (attrs[NL80211_ATTR_IE]) {
3310                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
3311                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3312         }
3313
3314         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3315                 bcn->proberesp_ies =
3316                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3317                 bcn->proberesp_ies_len =
3318                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3319         }
3320
3321         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3322                 bcn->assocresp_ies =
3323                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3324                 bcn->assocresp_ies_len =
3325                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3326         }
3327
3328         if (attrs[NL80211_ATTR_PROBE_RESP]) {
3329                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
3330                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3331         }
3332
3333         return 0;
3334 }
3335
3336 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
3337                                    struct cfg80211_ap_settings *params)
3338 {
3339         struct wireless_dev *wdev;
3340         bool ret = false;
3341
3342         list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
3343                 if (wdev->iftype != NL80211_IFTYPE_AP &&
3344                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
3345                         continue;
3346
3347                 if (!wdev->preset_chandef.chan)
3348                         continue;
3349
3350                 params->chandef = wdev->preset_chandef;
3351                 ret = true;
3352                 break;
3353         }
3354
3355         return ret;
3356 }
3357
3358 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3359                                     enum nl80211_auth_type auth_type,
3360                                     enum nl80211_commands cmd)
3361 {
3362         if (auth_type > NL80211_AUTHTYPE_MAX)
3363                 return false;
3364
3365         switch (cmd) {
3366         case NL80211_CMD_AUTHENTICATE:
3367                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3368                     auth_type == NL80211_AUTHTYPE_SAE)
3369                         return false;
3370                 return true;
3371         case NL80211_CMD_CONNECT:
3372         case NL80211_CMD_START_AP:
3373                 /* SAE not supported yet */
3374                 if (auth_type == NL80211_AUTHTYPE_SAE)
3375                         return false;
3376                 return true;
3377         default:
3378                 return false;
3379         }
3380 }
3381
3382 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3383 {
3384         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3385         struct net_device *dev = info->user_ptr[1];
3386         struct wireless_dev *wdev = dev->ieee80211_ptr;
3387         struct cfg80211_ap_settings params;
3388         int err;
3389
3390         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3391             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3392                 return -EOPNOTSUPP;
3393
3394         if (!rdev->ops->start_ap)
3395                 return -EOPNOTSUPP;
3396
3397         if (wdev->beacon_interval)
3398                 return -EALREADY;
3399
3400         memset(&params, 0, sizeof(params));
3401
3402         /* these are required for START_AP */
3403         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3404             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3405             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3406                 return -EINVAL;
3407
3408         err = nl80211_parse_beacon(info->attrs, &params.beacon);
3409         if (err)
3410                 return err;
3411
3412         params.beacon_interval =
3413                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3414         params.dtim_period =
3415                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3416
3417         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
3418         if (err)
3419                 return err;
3420
3421         /*
3422          * In theory, some of these attributes should be required here
3423          * but since they were not used when the command was originally
3424          * added, keep them optional for old user space programs to let
3425          * them continue to work with drivers that do not need the
3426          * additional information -- drivers must check!
3427          */
3428         if (info->attrs[NL80211_ATTR_SSID]) {
3429                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3430                 params.ssid_len =
3431                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3432                 if (params.ssid_len == 0 ||
3433                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3434                         return -EINVAL;
3435         }
3436
3437         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3438                 params.hidden_ssid = nla_get_u32(
3439                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3440                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3441                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3442                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3443                         return -EINVAL;
3444         }
3445
3446         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3447
3448         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3449                 params.auth_type = nla_get_u32(
3450                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3451                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3452                                              NL80211_CMD_START_AP))
3453                         return -EINVAL;
3454         } else
3455                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3456
3457         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3458                                       NL80211_MAX_NR_CIPHER_SUITES);
3459         if (err)
3460                 return err;
3461
3462         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3463                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3464                         return -EOPNOTSUPP;
3465                 params.inactivity_timeout = nla_get_u16(
3466                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3467         }
3468
3469         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3470                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3471                         return -EINVAL;
3472                 params.p2p_ctwindow =
3473                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3474                 if (params.p2p_ctwindow > 127)
3475                         return -EINVAL;
3476                 if (params.p2p_ctwindow != 0 &&
3477                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3478                         return -EINVAL;
3479         }
3480
3481         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3482                 u8 tmp;
3483
3484                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3485                         return -EINVAL;
3486                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3487                 if (tmp > 1)
3488                         return -EINVAL;
3489                 params.p2p_opp_ps = tmp;
3490                 if (params.p2p_opp_ps != 0 &&
3491                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3492                         return -EINVAL;
3493         }
3494
3495         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3496                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
3497                 if (err)
3498                         return err;
3499         } else if (wdev->preset_chandef.chan) {
3500                 params.chandef = wdev->preset_chandef;
3501         } else if (!nl80211_get_ap_channel(rdev, &params))
3502                 return -EINVAL;
3503
3504         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
3505                                            wdev->iftype))
3506                 return -EINVAL;
3507
3508         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
3509                 params.smps_mode =
3510                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
3511                 switch (params.smps_mode) {
3512                 case NL80211_SMPS_OFF:
3513                         break;
3514                 case NL80211_SMPS_STATIC:
3515                         if (!(rdev->wiphy.features &
3516                               NL80211_FEATURE_STATIC_SMPS))
3517                                 return -EINVAL;
3518                         break;
3519                 case NL80211_SMPS_DYNAMIC:
3520                         if (!(rdev->wiphy.features &
3521                               NL80211_FEATURE_DYNAMIC_SMPS))
3522                                 return -EINVAL;
3523                         break;
3524                 default:
3525                         return -EINVAL;
3526                 }
3527         } else {
3528                 params.smps_mode = NL80211_SMPS_OFF;
3529         }
3530
3531         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3532                 params.acl = parse_acl_data(&rdev->wiphy, info);
3533                 if (IS_ERR(params.acl))
3534                         return PTR_ERR(params.acl);
3535         }
3536
3537         params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
3538         if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
3539                 return -EOPNOTSUPP;
3540
3541         wdev_lock(wdev);
3542         err = rdev_start_ap(rdev, dev, &params);
3543         if (!err) {
3544                 wdev->preset_chandef = params.chandef;
3545                 wdev->beacon_interval = params.beacon_interval;
3546                 wdev->chandef = params.chandef;
3547                 wdev->ssid_len = params.ssid_len;
3548                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3549         }
3550         wdev_unlock(wdev);
3551
3552         kfree(params.acl);
3553
3554         return err;
3555 }
3556
3557 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3558 {
3559         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3560         struct net_device *dev = info->user_ptr[1];
3561         struct wireless_dev *wdev = dev->ieee80211_ptr;
3562         struct cfg80211_beacon_data params;
3563         int err;
3564
3565         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3566             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3567                 return -EOPNOTSUPP;
3568
3569         if (!rdev->ops->change_beacon)
3570                 return -EOPNOTSUPP;
3571
3572         if (!wdev->beacon_interval)
3573                 return -EINVAL;
3574
3575         err = nl80211_parse_beacon(info->attrs, &params);
3576         if (err)
3577                 return err;
3578
3579         wdev_lock(wdev);
3580         err = rdev_change_beacon(rdev, dev, &params);
3581         wdev_unlock(wdev);
3582
3583         return err;
3584 }
3585
3586 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3587 {
3588         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3589         struct net_device *dev = info->user_ptr[1];
3590
3591         return cfg80211_stop_ap(rdev, dev, false);
3592 }
3593
3594 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3595         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3596         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3597         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3598         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3599         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3600         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3601 };
3602
3603 static int parse_station_flags(struct genl_info *info,
3604                                enum nl80211_iftype iftype,
3605                                struct station_parameters *params)
3606 {
3607         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3608         struct nlattr *nla;
3609         int flag;
3610
3611         /*
3612          * Try parsing the new attribute first so userspace
3613          * can specify both for older kernels.
3614          */
3615         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3616         if (nla) {
3617                 struct nl80211_sta_flag_update *sta_flags;
3618
3619                 sta_flags = nla_data(nla);
3620                 params->sta_flags_mask = sta_flags->mask;
3621                 params->sta_flags_set = sta_flags->set;
3622                 params->sta_flags_set &= params->sta_flags_mask;
3623                 if ((params->sta_flags_mask |
3624                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3625                         return -EINVAL;
3626                 return 0;
3627         }
3628
3629         /* if present, parse the old attribute */
3630
3631         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3632         if (!nla)
3633                 return 0;
3634
3635         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3636                              nla, sta_flags_policy))
3637                 return -EINVAL;
3638
3639         /*
3640          * Only allow certain flags for interface types so that
3641          * other attributes are silently ignored. Remember that
3642          * this is backward compatibility code with old userspace
3643          * and shouldn't be hit in other cases anyway.
3644          */
3645         switch (iftype) {
3646         case NL80211_IFTYPE_AP:
3647         case NL80211_IFTYPE_AP_VLAN:
3648         case NL80211_IFTYPE_P2P_GO:
3649                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3650                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3651                                          BIT(NL80211_STA_FLAG_WME) |
3652                                          BIT(NL80211_STA_FLAG_MFP);
3653                 break;
3654         case NL80211_IFTYPE_P2P_CLIENT:
3655         case NL80211_IFTYPE_STATION:
3656                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3657                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3658                 break;
3659         case NL80211_IFTYPE_MESH_POINT:
3660                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3661                                          BIT(NL80211_STA_FLAG_MFP) |
3662                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3663         default:
3664                 return -EINVAL;
3665         }
3666
3667         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3668                 if (flags[flag]) {
3669                         params->sta_flags_set |= (1<<flag);
3670
3671                         /* no longer support new API additions in old API */
3672                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3673                                 return -EINVAL;
3674                 }
3675         }
3676
3677         return 0;
3678 }
3679
3680 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3681                                  int attr)
3682 {
3683         struct nlattr *rate;
3684         u32 bitrate;
3685         u16 bitrate_compat;
3686         enum nl80211_attrs rate_flg;
3687
3688         rate = nla_nest_start(msg, attr);
3689         if (!rate)
3690                 return false;
3691
3692         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3693         bitrate = cfg80211_calculate_bitrate(info);
3694         /* report 16-bit bitrate only if we can */
3695         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3696         if (bitrate > 0 &&
3697             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3698                 return false;
3699         if (bitrate_compat > 0 &&
3700             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3701                 return false;
3702
3703         switch (info->bw) {
3704         case RATE_INFO_BW_5:
3705                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
3706                 break;
3707         case RATE_INFO_BW_10:
3708                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
3709                 break;
3710         default:
3711                 WARN_ON(1);
3712                 /* fall through */
3713         case RATE_INFO_BW_20:
3714                 rate_flg = 0;
3715                 break;
3716         case RATE_INFO_BW_40:
3717                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
3718                 break;
3719         case RATE_INFO_BW_80:
3720                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
3721                 break;
3722         case RATE_INFO_BW_160:
3723                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
3724                 break;
3725         }
3726
3727         if (rate_flg && nla_put_flag(msg, rate_flg))
3728                 return false;
3729
3730         if (info->flags & RATE_INFO_FLAGS_MCS) {
3731                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3732                         return false;
3733                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3734                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3735                         return false;
3736         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3737                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3738                         return false;
3739                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3740                         return false;
3741                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3742                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3743                         return false;
3744         }
3745
3746         nla_nest_end(msg, rate);
3747         return true;
3748 }
3749
3750 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
3751                                int id)
3752 {
3753         void *attr;
3754         int i = 0;
3755
3756         if (!mask)
3757                 return true;
3758
3759         attr = nla_nest_start(msg, id);
3760         if (!attr)
3761                 return false;
3762
3763         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
3764                 if (!(mask & BIT(i)))
3765                         continue;
3766
3767                 if (nla_put_u8(msg, i, signal[i]))
3768                         return false;
3769         }
3770
3771         nla_nest_end(msg, attr);
3772
3773         return true;
3774 }
3775
3776 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
3777                                 u32 seq, int flags,
3778                                 struct cfg80211_registered_device *rdev,
3779                                 struct net_device *dev,
3780                                 const u8 *mac_addr, struct station_info *sinfo)
3781 {
3782         void *hdr;
3783         struct nlattr *sinfoattr, *bss_param;
3784
3785         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
3786         if (!hdr)
3787                 return -1;
3788
3789         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3790             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3791             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3792                 goto nla_put_failure;
3793
3794         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3795         if (!sinfoattr)
3796                 goto nla_put_failure;
3797
3798 #define PUT_SINFO(attr, memb, type) do {                                \
3799         BUILD_BUG_ON(sizeof(type) == sizeof(u64));                      \
3800         if (sinfo->filled & (1ULL << NL80211_STA_INFO_ ## attr) &&      \
3801             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
3802                              sinfo->memb))                              \
3803                 goto nla_put_failure;                                   \
3804         } while (0)
3805 #define PUT_SINFO_U64(attr, memb) do {                                  \
3806         if (sinfo->filled & (1ULL << NL80211_STA_INFO_ ## attr) &&      \
3807             nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,           \
3808                               sinfo->memb, NL80211_STA_INFO_PAD))       \
3809                 goto nla_put_failure;                                   \
3810         } while (0)
3811
3812         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
3813         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
3814
3815         if (sinfo->filled & (BIT(NL80211_STA_INFO_RX_BYTES) |
3816                              BIT(NL80211_STA_INFO_RX_BYTES64)) &&
3817             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3818                         (u32)sinfo->rx_bytes))
3819                 goto nla_put_failure;
3820
3821         if (sinfo->filled & (BIT(NL80211_STA_INFO_TX_BYTES) |
3822                              BIT(NL80211_STA_INFO_TX_BYTES64)) &&
3823             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3824                         (u32)sinfo->tx_bytes))
3825                 goto nla_put_failure;
3826
3827         PUT_SINFO_U64(RX_BYTES64, rx_bytes);
3828         PUT_SINFO_U64(TX_BYTES64, tx_bytes);
3829         PUT_SINFO(LLID, llid, u16);
3830         PUT_SINFO(PLID, plid, u16);
3831         PUT_SINFO(PLINK_STATE, plink_state, u8);
3832         PUT_SINFO_U64(RX_DURATION, rx_duration);
3833
3834         switch (rdev->wiphy.signal_type) {
3835         case CFG80211_SIGNAL_TYPE_MBM:
3836                 PUT_SINFO(SIGNAL, signal, u8);
3837                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
3838                 break;
3839         default:
3840                 break;
3841         }
3842         if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL)) {
3843                 if (!nl80211_put_signal(msg, sinfo->chains,
3844                                         sinfo->chain_signal,
3845                                         NL80211_STA_INFO_CHAIN_SIGNAL))
3846                         goto nla_put_failure;
3847         }
3848         if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
3849                 if (!nl80211_put_signal(msg, sinfo->chains,
3850                                         sinfo->chain_signal_avg,
3851                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
3852                         goto nla_put_failure;
3853         }
3854         if (sinfo->filled & BIT(NL80211_STA_INFO_TX_BITRATE)) {
3855                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3856                                           NL80211_STA_INFO_TX_BITRATE))
3857                         goto nla_put_failure;
3858         }
3859         if (sinfo->filled & BIT(NL80211_STA_INFO_RX_BITRATE)) {
3860                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3861                                           NL80211_STA_INFO_RX_BITRATE))
3862                         goto nla_put_failure;
3863         }
3864
3865         PUT_SINFO(RX_PACKETS, rx_packets, u32);
3866         PUT_SINFO(TX_PACKETS, tx_packets, u32);
3867         PUT_SINFO(TX_RETRIES, tx_retries, u32);
3868         PUT_SINFO(TX_FAILED, tx_failed, u32);
3869         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
3870         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
3871         PUT_SINFO(LOCAL_PM, local_pm, u32);
3872         PUT_SINFO(PEER_PM, peer_pm, u32);
3873         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
3874
3875         if (sinfo->filled & BIT(NL80211_STA_INFO_BSS_PARAM)) {
3876                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3877                 if (!bss_param)
3878                         goto nla_put_failure;
3879
3880                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3881                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3882                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3883                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3884                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3885                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3886                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3887                                sinfo->bss_param.dtim_period) ||
3888                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3889                                 sinfo->bss_param.beacon_interval))
3890                         goto nla_put_failure;
3891
3892                 nla_nest_end(msg, bss_param);
3893         }
3894         if ((sinfo->filled & BIT(NL80211_STA_INFO_STA_FLAGS)) &&
3895             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3896                     sizeof(struct nl80211_sta_flag_update),
3897                     &sinfo->sta_flags))
3898                 goto nla_put_failure;
3899
3900         PUT_SINFO_U64(T_OFFSET, t_offset);
3901         PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
3902         PUT_SINFO_U64(BEACON_RX, rx_beacon);
3903         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
3904
3905 #undef PUT_SINFO
3906 #undef PUT_SINFO_U64
3907
3908         if (sinfo->filled & BIT(NL80211_STA_INFO_TID_STATS)) {
3909                 struct nlattr *tidsattr;
3910                 int tid;
3911
3912                 tidsattr = nla_nest_start(msg, NL80211_STA_INFO_TID_STATS);
3913                 if (!tidsattr)
3914                         goto nla_put_failure;
3915
3916                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
3917                         struct cfg80211_tid_stats *tidstats;
3918                         struct nlattr *tidattr;
3919
3920                         tidstats = &sinfo->pertid[tid];
3921
3922                         if (!tidstats->filled)
3923                                 continue;
3924
3925                         tidattr = nla_nest_start(msg, tid + 1);
3926                         if (!tidattr)
3927                                 goto nla_put_failure;
3928
3929 #define PUT_TIDVAL_U64(attr, memb) do {                                 \
3930         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
3931             nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr,          \
3932                               tidstats->memb, NL80211_TID_STATS_PAD))   \
3933                 goto nla_put_failure;                                   \
3934         } while (0)
3935
3936                         PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
3937                         PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
3938                         PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
3939                         PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
3940
3941 #undef PUT_TIDVAL_U64
3942                         nla_nest_end(msg, tidattr);
3943                 }
3944
3945                 nla_nest_end(msg, tidsattr);
3946         }
3947
3948         nla_nest_end(msg, sinfoattr);
3949
3950         if (sinfo->assoc_req_ies_len &&
3951             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3952                     sinfo->assoc_req_ies))
3953                 goto nla_put_failure;
3954
3955         genlmsg_end(msg, hdr);
3956         return 0;
3957
3958  nla_put_failure:
3959         genlmsg_cancel(msg, hdr);
3960         return -EMSGSIZE;
3961 }
3962
3963 static int nl80211_dump_station(struct sk_buff *skb,
3964                                 struct netlink_callback *cb)
3965 {
3966         struct station_info sinfo;
3967         struct cfg80211_registered_device *rdev;
3968         struct wireless_dev *wdev;
3969         u8 mac_addr[ETH_ALEN];
3970         int sta_idx = cb->args[2];
3971         int err;
3972
3973         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
3974         if (err)
3975                 return err;
3976
3977         if (!wdev->netdev) {
3978                 err = -EINVAL;
3979                 goto out_err;
3980         }
3981
3982         if (!rdev->ops->dump_station) {
3983                 err = -EOPNOTSUPP;
3984                 goto out_err;
3985         }
3986
3987         while (1) {
3988                 memset(&sinfo, 0, sizeof(sinfo));
3989                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
3990                                         mac_addr, &sinfo);
3991                 if (err == -ENOENT)
3992                         break;
3993                 if (err)
3994                         goto out_err;
3995
3996                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
3997                                 NETLINK_CB(cb->skb).portid,
3998                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3999                                 rdev, wdev->netdev, mac_addr,
4000                                 &sinfo) < 0)
4001                         goto out;
4002
4003                 sta_idx++;
4004         }
4005
4006
4007  out:
4008         cb->args[2] = sta_idx;
4009         err = skb->len;
4010  out_err:
4011         nl80211_finish_wdev_dump(rdev);
4012
4013         return err;
4014 }
4015
4016 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
4017 {
4018         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4019         struct net_device *dev = info->user_ptr[1];
4020         struct station_info sinfo;
4021         struct sk_buff *msg;
4022         u8 *mac_addr = NULL;
4023         int err;
4024
4025         memset(&sinfo, 0, sizeof(sinfo));
4026
4027         if (!info->attrs[NL80211_ATTR_MAC])
4028                 return -EINVAL;
4029
4030         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4031
4032         if (!rdev->ops->get_station)
4033                 return -EOPNOTSUPP;
4034
4035         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
4036         if (err)
4037                 return err;
4038
4039         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4040         if (!msg)
4041                 return -ENOMEM;
4042
4043         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
4044                                  info->snd_portid, info->snd_seq, 0,
4045                                  rdev, dev, mac_addr, &sinfo) < 0) {
4046                 nlmsg_free(msg);
4047                 return -ENOBUFS;
4048         }
4049
4050         return genlmsg_reply(msg, info);
4051 }
4052
4053 int cfg80211_check_station_change(struct wiphy *wiphy,
4054                                   struct station_parameters *params,
4055                                   enum cfg80211_station_type statype)
4056 {
4057         if (params->listen_interval != -1 &&
4058             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4059                 return -EINVAL;
4060
4061         if (params->support_p2p_ps != -1 &&
4062             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4063                 return -EINVAL;
4064
4065         if (params->aid &&
4066             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
4067             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4068                 return -EINVAL;
4069
4070         /* When you run into this, adjust the code below for the new flag */
4071         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4072
4073         switch (statype) {
4074         case CFG80211_STA_MESH_PEER_KERNEL:
4075         case CFG80211_STA_MESH_PEER_USER:
4076                 /*
4077                  * No ignoring the TDLS flag here -- the userspace mesh
4078                  * code doesn't have the bug of including TDLS in the
4079                  * mask everywhere.
4080                  */
4081                 if (params->sta_flags_mask &
4082                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4083                                   BIT(NL80211_STA_FLAG_MFP) |
4084                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
4085                         return -EINVAL;
4086                 break;
4087         case CFG80211_STA_TDLS_PEER_SETUP:
4088         case CFG80211_STA_TDLS_PEER_ACTIVE:
4089                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4090                         return -EINVAL;
4091                 /* ignore since it can't change */
4092                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4093                 break;
4094         default:
4095                 /* disallow mesh-specific things */
4096                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
4097                         return -EINVAL;
4098                 if (params->local_pm)
4099                         return -EINVAL;
4100                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4101                         return -EINVAL;
4102         }
4103
4104         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4105             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
4106                 /* TDLS can't be set, ... */
4107                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4108                         return -EINVAL;
4109                 /*
4110                  * ... but don't bother the driver with it. This works around
4111                  * a hostapd/wpa_supplicant issue -- it always includes the
4112                  * TLDS_PEER flag in the mask even for AP mode.
4113                  */
4114                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4115         }
4116
4117         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4118             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4119                 /* reject other things that can't change */
4120                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
4121                         return -EINVAL;
4122                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
4123                         return -EINVAL;
4124                 if (params->supported_rates)
4125                         return -EINVAL;
4126                 if (params->ext_capab || params->ht_capa || params->vht_capa)
4127                         return -EINVAL;
4128         }
4129
4130         if (statype != CFG80211_STA_AP_CLIENT &&
4131             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4132                 if (params->vlan)
4133                         return -EINVAL;
4134         }
4135
4136         switch (statype) {
4137         case CFG80211_STA_AP_MLME_CLIENT:
4138                 /* Use this only for authorizing/unauthorizing a station */
4139                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
4140                         return -EOPNOTSUPP;
4141                 break;
4142         case CFG80211_STA_AP_CLIENT:
4143         case CFG80211_STA_AP_CLIENT_UNASSOC:
4144                 /* accept only the listed bits */
4145                 if (params->sta_flags_mask &
4146                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4147                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4148                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
4149                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4150                                   BIT(NL80211_STA_FLAG_WME) |
4151                                   BIT(NL80211_STA_FLAG_MFP)))
4152                         return -EINVAL;
4153
4154                 /* but authenticated/associated only if driver handles it */
4155                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4156                     params->sta_flags_mask &
4157                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4158                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4159                         return -EINVAL;
4160                 break;
4161         case CFG80211_STA_IBSS:
4162         case CFG80211_STA_AP_STA:
4163                 /* reject any changes other than AUTHORIZED */
4164                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
4165                         return -EINVAL;
4166                 break;
4167         case CFG80211_STA_TDLS_PEER_SETUP:
4168                 /* reject any changes other than AUTHORIZED or WME */
4169                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4170                                                BIT(NL80211_STA_FLAG_WME)))
4171                         return -EINVAL;
4172                 /* force (at least) rates when authorizing */
4173                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
4174                     !params->supported_rates)
4175                         return -EINVAL;
4176                 break;
4177         case CFG80211_STA_TDLS_PEER_ACTIVE:
4178                 /* reject any changes */
4179                 return -EINVAL;
4180         case CFG80211_STA_MESH_PEER_KERNEL:
4181                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4182                         return -EINVAL;
4183                 break;
4184         case CFG80211_STA_MESH_PEER_USER:
4185                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
4186                     params->plink_action != NL80211_PLINK_ACTION_BLOCK)
4187                         return -EINVAL;
4188                 break;
4189         }
4190
4191         return 0;
4192 }
4193 EXPORT_SYMBOL(cfg80211_check_station_change);
4194
4195 /*
4196  * Get vlan interface making sure it is running and on the right wiphy.
4197  */
4198 static struct net_device *get_vlan(struct genl_info *info,
4199                                    struct cfg80211_registered_device *rdev)
4200 {
4201         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
4202         struct net_device *v;
4203         int ret;
4204
4205         if (!vlanattr)
4206                 return NULL;
4207
4208         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
4209         if (!v)
4210                 return ERR_PTR(-ENODEV);
4211
4212         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
4213                 ret = -EINVAL;
4214                 goto error;
4215         }
4216
4217         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4218             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4219             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
4220                 ret = -EINVAL;
4221                 goto error;
4222         }
4223
4224         if (!netif_running(v)) {
4225                 ret = -ENETDOWN;
4226                 goto error;
4227         }
4228
4229         return v;
4230  error:
4231         dev_put(v);
4232         return ERR_PTR(ret);
4233 }
4234
4235 static const struct nla_policy
4236 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
4237         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
4238         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
4239 };
4240
4241 static int nl80211_parse_sta_wme(struct genl_info *info,
4242                                  struct station_parameters *params)
4243 {
4244         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
4245         struct nlattr *nla;
4246         int err;
4247
4248         /* parse WME attributes if present */
4249         if (!info->attrs[NL80211_ATTR_STA_WME])
4250                 return 0;
4251
4252         nla = info->attrs[NL80211_ATTR_STA_WME];
4253         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
4254                                nl80211_sta_wme_policy);
4255         if (err)
4256                 return err;
4257
4258         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
4259                 params->uapsd_queues = nla_get_u8(
4260                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
4261         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
4262                 return -EINVAL;
4263
4264         if (tb[NL80211_STA_WME_MAX_SP])
4265                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
4266
4267         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
4268                 return -EINVAL;
4269
4270         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
4271
4272         return 0;
4273 }
4274
4275 static int nl80211_parse_sta_channel_info(struct genl_info *info,
4276                                       struct station_parameters *params)
4277 {
4278         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
4279                 params->supported_channels =
4280                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4281                 params->supported_channels_len =
4282                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4283                 /*
4284                  * Need to include at least one (first channel, number of
4285                  * channels) tuple for each subband, and must have proper
4286                  * tuples for the rest of the data as well.
4287                  */
4288                 if (params->supported_channels_len < 2)
4289                         return -EINVAL;
4290                 if (params->supported_channels_len % 2)
4291                         return -EINVAL;
4292         }
4293
4294         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
4295                 params->supported_oper_classes =
4296                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4297                 params->supported_oper_classes_len =
4298                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4299                 /*
4300                  * The value of the Length field of the Supported Operating
4301                  * Classes element is between 2 and 253.
4302                  */
4303                 if (params->supported_oper_classes_len < 2 ||
4304                     params->supported_oper_classes_len > 253)
4305                         return -EINVAL;
4306         }
4307         return 0;
4308 }
4309
4310 static int nl80211_set_station_tdls(struct genl_info *info,
4311                                     struct station_parameters *params)
4312 {
4313         int err;
4314         /* Dummy STA entry gets updated once the peer capabilities are known */
4315         if (info->attrs[NL80211_ATTR_PEER_AID])
4316                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4317         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4318                 params->ht_capa =
4319                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4320         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4321                 params->vht_capa =
4322                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4323
4324         err = nl80211_parse_sta_channel_info(info, params);
4325         if (err)
4326                 return err;
4327
4328         return nl80211_parse_sta_wme(info, params);
4329 }
4330
4331 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
4332 {
4333         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4334         struct net_device *dev = info->user_ptr[1];
4335         struct station_parameters params;
4336         u8 *mac_addr;
4337         int err;
4338
4339         memset(&params, 0, sizeof(params));
4340
4341         if (!rdev->ops->change_station)
4342                 return -EOPNOTSUPP;
4343
4344         /*
4345          * AID and listen_interval properties can be set only for unassociated
4346          * station. Include these parameters here and will check them in
4347          * cfg80211_check_station_change().
4348          */
4349         if (info->attrs[NL80211_ATTR_STA_AID])
4350                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4351
4352         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4353                 params.listen_interval =
4354                      nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4355         else
4356                 params.listen_interval = -1;
4357
4358         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
4359                 u8 tmp;
4360
4361                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
4362                 if (tmp >= NUM_NL80211_P2P_PS_STATUS)
4363                         return -EINVAL;
4364
4365                 params.support_p2p_ps = tmp;
4366         } else {
4367                 params.support_p2p_ps = -1;
4368         }
4369
4370         if (!info->attrs[NL80211_ATTR_MAC])
4371                 return -EINVAL;
4372
4373         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4374
4375         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
4376                 params.supported_rates =
4377                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4378                 params.supported_rates_len =
4379                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4380         }
4381
4382         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4383                 params.capability =
4384                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4385                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4386         }
4387
4388         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4389                 params.ext_capab =
4390                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4391                 params.ext_capab_len =
4392                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4393         }
4394
4395         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4396                 return -EINVAL;
4397
4398         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4399                 params.plink_action =
4400                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4401                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4402                         return -EINVAL;
4403         }
4404
4405         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
4406                 params.plink_state =
4407                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
4408                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
4409                         return -EINVAL;
4410                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
4411         }
4412
4413         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
4414                 enum nl80211_mesh_power_mode pm = nla_get_u32(
4415                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
4416
4417                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
4418                     pm > NL80211_MESH_POWER_MAX)
4419                         return -EINVAL;
4420
4421                 params.local_pm = pm;
4422         }
4423
4424         /* Include parameters for TDLS peer (will check later) */
4425         err = nl80211_set_station_tdls(info, &params);
4426         if (err)
4427                 return err;
4428
4429         params.vlan = get_vlan(info, rdev);
4430         if (IS_ERR(params.vlan))
4431                 return PTR_ERR(params.vlan);
4432
4433         switch (dev->ieee80211_ptr->iftype) {
4434         case NL80211_IFTYPE_AP:
4435         case NL80211_IFTYPE_AP_VLAN:
4436         case NL80211_IFTYPE_P2P_GO:
4437         case NL80211_IFTYPE_P2P_CLIENT:
4438         case NL80211_IFTYPE_STATION:
4439         case NL80211_IFTYPE_ADHOC:
4440         case NL80211_IFTYPE_MESH_POINT:
4441                 break;
4442         default:
4443                 err = -EOPNOTSUPP;
4444                 goto out_put_vlan;
4445         }
4446
4447         /* driver will call cfg80211_check_station_change() */
4448         err = rdev_change_station(rdev, dev, mac_addr, &params);
4449
4450  out_put_vlan:
4451         if (params.vlan)
4452                 dev_put(params.vlan);
4453
4454         return err;
4455 }
4456
4457 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
4458 {
4459         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4460         int err;
4461         struct net_device *dev = info->user_ptr[1];
4462         struct station_parameters params;
4463         u8 *mac_addr = NULL;
4464         u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4465                          BIT(NL80211_STA_FLAG_ASSOCIATED);
4466
4467         memset(&params, 0, sizeof(params));
4468
4469         if (!rdev->ops->add_station)
4470                 return -EOPNOTSUPP;
4471
4472         if (!info->attrs[NL80211_ATTR_MAC])
4473                 return -EINVAL;
4474
4475         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4476                 return -EINVAL;
4477
4478         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
4479                 return -EINVAL;
4480
4481         if (!info->attrs[NL80211_ATTR_STA_AID] &&
4482             !info->attrs[NL80211_ATTR_PEER_AID])
4483                 return -EINVAL;
4484
4485         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4486         params.supported_rates =
4487                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4488         params.supported_rates_len =
4489                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4490         params.listen_interval =
4491                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4492
4493         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
4494                 u8 tmp;
4495
4496                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
4497                 if (tmp >= NUM_NL80211_P2P_PS_STATUS)
4498                         return -EINVAL;
4499
4500                 params.support_p2p_ps = tmp;
4501         } else {
4502                 /*
4503                  * if not specified, assume it's supported for P2P GO interface,
4504                  * and is NOT supported for AP interface
4505                  */
4506                 params.support_p2p_ps =
4507                         dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
4508         }
4509
4510         if (info->attrs[NL80211_ATTR_PEER_AID])
4511                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4512         else
4513                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4514         if (!params.aid || params.aid > IEEE80211_MAX_AID)
4515                 return -EINVAL;
4516
4517         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4518                 params.capability =
4519                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4520                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4521         }
4522
4523         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4524                 params.ext_capab =
4525                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4526                 params.ext_capab_len =
4527                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4528         }
4529
4530         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4531                 params.ht_capa =
4532                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4533
4534         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4535                 params.vht_capa =
4536                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4537
4538         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
4539                 params.opmode_notif_used = true;
4540                 params.opmode_notif =
4541                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
4542         }
4543
4544         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4545                 params.plink_action =
4546                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4547                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4548                         return -EINVAL;
4549         }
4550
4551         err = nl80211_parse_sta_channel_info(info, &params);
4552         if (err)
4553                 return err;
4554
4555         err = nl80211_parse_sta_wme(info, &params);
4556         if (err)
4557                 return err;
4558
4559         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4560                 return -EINVAL;
4561
4562         /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
4563          * as userspace might just pass through the capabilities from the IEs
4564          * directly, rather than enforcing this restriction and returning an
4565          * error in this case.
4566          */
4567         if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
4568                 params.ht_capa = NULL;
4569                 params.vht_capa = NULL;
4570         }
4571
4572         /* When you run into this, adjust the code below for the new flag */
4573         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4574
4575         switch (dev->ieee80211_ptr->iftype) {
4576         case NL80211_IFTYPE_AP:
4577         case NL80211_IFTYPE_AP_VLAN:
4578         case NL80211_IFTYPE_P2P_GO:
4579                 /* ignore WME attributes if iface/sta is not capable */
4580                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
4581                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
4582                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4583
4584                 /* TDLS peers cannot be added */
4585                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4586                     info->attrs[NL80211_ATTR_PEER_AID])
4587                         return -EINVAL;
4588                 /* but don't bother the driver with it */
4589                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4590
4591                 /* allow authenticated/associated only if driver handles it */
4592                 if (!(rdev->wiphy.features &
4593                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4594                     params.sta_flags_mask & auth_assoc)
4595                         return -EINVAL;
4596
4597                 /* Older userspace, or userspace wanting to be compatible with
4598                  * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
4599                  * and assoc flags in the mask, but assumes the station will be
4600                  * added as associated anyway since this was the required driver
4601                  * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
4602                  * introduced.
4603                  * In order to not bother drivers with this quirk in the API
4604                  * set the flags in both the mask and set for new stations in
4605                  * this case.
4606                  */
4607                 if (!(params.sta_flags_mask & auth_assoc)) {
4608                         params.sta_flags_mask |= auth_assoc;
4609                         params.sta_flags_set |= auth_assoc;
4610                 }
4611
4612                 /* must be last in here for error handling */
4613                 params.vlan = get_vlan(info, rdev);
4614                 if (IS_ERR(params.vlan))
4615                         return PTR_ERR(params.vlan);
4616                 break;
4617         case NL80211_IFTYPE_MESH_POINT:
4618                 /* ignore uAPSD data */
4619                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4620
4621                 /* associated is disallowed */
4622                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
4623                         return -EINVAL;
4624                 /* TDLS peers cannot be added */
4625                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4626                     info->attrs[NL80211_ATTR_PEER_AID])
4627                         return -EINVAL;
4628                 break;
4629         case NL80211_IFTYPE_STATION:
4630         case NL80211_IFTYPE_P2P_CLIENT:
4631                 /* ignore uAPSD data */
4632                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4633
4634                 /* these are disallowed */
4635                 if (params.sta_flags_mask &
4636                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
4637                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4638                         return -EINVAL;
4639                 /* Only TDLS peers can be added */
4640                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4641                         return -EINVAL;
4642                 /* Can only add if TDLS ... */
4643                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
4644                         return -EOPNOTSUPP;
4645                 /* ... with external setup is supported */
4646                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
4647                         return -EOPNOTSUPP;
4648                 /*
4649                  * Older wpa_supplicant versions always mark the TDLS peer
4650                  * as authorized, but it shouldn't yet be.
4651                  */
4652                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4653                 break;
4654         default:
4655                 return -EOPNOTSUPP;
4656         }
4657
4658         /* be aware of params.vlan when changing code here */
4659
4660         err = rdev_add_station(rdev, dev, mac_addr, &params);
4661
4662         if (params.vlan)
4663                 dev_put(params.vlan);
4664         return err;
4665 }
4666
4667 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
4668 {
4669         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4670         struct net_device *dev = info->user_ptr[1];
4671         struct station_del_parameters params;
4672
4673         memset(&params, 0, sizeof(params));
4674
4675         if (info->attrs[NL80211_ATTR_MAC])
4676                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
4677
4678         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4679             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4680             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4681             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4682                 return -EINVAL;
4683
4684         if (!rdev->ops->del_station)
4685                 return -EOPNOTSUPP;
4686
4687         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
4688                 params.subtype =
4689                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
4690                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
4691                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
4692                         return -EINVAL;
4693         } else {
4694                 /* Default to Deauthentication frame */
4695                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
4696         }
4697
4698         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
4699                 params.reason_code =
4700                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4701                 if (params.reason_code == 0)
4702                         return -EINVAL; /* 0 is reserved */
4703         } else {
4704                 /* Default to reason code 2 */
4705                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
4706         }
4707
4708         return rdev_del_station(rdev, dev, &params);
4709 }
4710
4711 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4712                                 int flags, struct net_device *dev,
4713                                 u8 *dst, u8 *next_hop,
4714                                 struct mpath_info *pinfo)
4715 {
4716         void *hdr;
4717         struct nlattr *pinfoattr;
4718
4719         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
4720         if (!hdr)
4721                 return -1;
4722
4723         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4724             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
4725             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
4726             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
4727                 goto nla_put_failure;
4728
4729         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
4730         if (!pinfoattr)
4731                 goto nla_put_failure;
4732         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
4733             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
4734                         pinfo->frame_qlen))
4735                 goto nla_put_failure;
4736         if (((pinfo->filled & MPATH_INFO_SN) &&
4737              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
4738             ((pinfo->filled & MPATH_INFO_METRIC) &&
4739              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
4740                          pinfo->metric)) ||
4741             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
4742              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
4743                          pinfo->exptime)) ||
4744             ((pinfo->filled & MPATH_INFO_FLAGS) &&
4745              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
4746                         pinfo->flags)) ||
4747             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
4748              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
4749                          pinfo->discovery_timeout)) ||
4750             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
4751              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
4752                         pinfo->discovery_retries)))
4753                 goto nla_put_failure;
4754
4755         nla_nest_end(msg, pinfoattr);
4756
4757         genlmsg_end(msg, hdr);
4758         return 0;
4759
4760  nla_put_failure:
4761         genlmsg_cancel(msg, hdr);
4762         return -EMSGSIZE;
4763 }
4764
4765 static int nl80211_dump_mpath(struct sk_buff *skb,
4766                               struct netlink_callback *cb)
4767 {
4768         struct mpath_info pinfo;
4769         struct cfg80211_registered_device *rdev;
4770         struct wireless_dev *wdev;
4771         u8 dst[ETH_ALEN];
4772         u8 next_hop[ETH_ALEN];
4773         int path_idx = cb->args[2];
4774         int err;
4775
4776         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4777         if (err)
4778                 return err;
4779
4780         if (!rdev->ops->dump_mpath) {
4781                 err = -EOPNOTSUPP;
4782                 goto out_err;
4783         }
4784
4785         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4786                 err = -EOPNOTSUPP;
4787                 goto out_err;
4788         }
4789
4790         while (1) {
4791                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
4792                                       next_hop, &pinfo);
4793                 if (err == -ENOENT)
4794                         break;
4795                 if (err)
4796                         goto out_err;
4797
4798                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4799                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4800                                        wdev->netdev, dst, next_hop,
4801                                        &pinfo) < 0)
4802                         goto out;
4803
4804                 path_idx++;
4805         }
4806
4807
4808  out:
4809         cb->args[2] = path_idx;
4810         err = skb->len;
4811  out_err:
4812         nl80211_finish_wdev_dump(rdev);
4813         return err;
4814 }
4815
4816 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
4817 {
4818         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4819         int err;
4820         struct net_device *dev = info->user_ptr[1];
4821         struct mpath_info pinfo;
4822         struct sk_buff *msg;
4823         u8 *dst = NULL;
4824         u8 next_hop[ETH_ALEN];
4825
4826         memset(&pinfo, 0, sizeof(pinfo));
4827
4828         if (!info->attrs[NL80211_ATTR_MAC])
4829                 return -EINVAL;
4830
4831         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4832
4833         if (!rdev->ops->get_mpath)
4834                 return -EOPNOTSUPP;
4835
4836         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4837                 return -EOPNOTSUPP;
4838
4839         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4840         if (err)
4841                 return err;
4842
4843         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4844         if (!msg)
4845                 return -ENOMEM;
4846
4847         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4848                                  dev, dst, next_hop, &pinfo) < 0) {
4849                 nlmsg_free(msg);
4850                 return -ENOBUFS;
4851         }
4852
4853         return genlmsg_reply(msg, info);
4854 }
4855
4856 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
4857 {
4858         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4859         struct net_device *dev = info->user_ptr[1];
4860         u8 *dst = NULL;
4861         u8 *next_hop = NULL;
4862
4863         if (!info->attrs[NL80211_ATTR_MAC])
4864                 return -EINVAL;
4865
4866         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4867                 return -EINVAL;
4868
4869         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4870         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4871
4872         if (!rdev->ops->change_mpath)
4873                 return -EOPNOTSUPP;
4874
4875         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4876                 return -EOPNOTSUPP;
4877
4878         return rdev_change_mpath(rdev, dev, dst, next_hop);
4879 }
4880
4881 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
4882 {
4883         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4884         struct net_device *dev = info->user_ptr[1];
4885         u8 *dst = NULL;
4886         u8 *next_hop = NULL;
4887
4888         if (!info->attrs[NL80211_ATTR_MAC])
4889                 return -EINVAL;
4890
4891         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4892                 return -EINVAL;
4893
4894         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4895         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4896
4897         if (!rdev->ops->add_mpath)
4898                 return -EOPNOTSUPP;
4899
4900         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4901                 return -EOPNOTSUPP;
4902
4903         return rdev_add_mpath(rdev, dev, dst, next_hop);
4904 }
4905
4906 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
4907 {
4908         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4909         struct net_device *dev = info->user_ptr[1];
4910         u8 *dst = NULL;
4911
4912         if (info->attrs[NL80211_ATTR_MAC])
4913                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4914
4915         if (!rdev->ops->del_mpath)
4916                 return -EOPNOTSUPP;
4917
4918         return rdev_del_mpath(rdev, dev, dst);
4919 }
4920
4921 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
4922 {
4923         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4924         int err;
4925         struct net_device *dev = info->user_ptr[1];
4926         struct mpath_info pinfo;
4927         struct sk_buff *msg;
4928         u8 *dst = NULL;
4929         u8 mpp[ETH_ALEN];
4930
4931         memset(&pinfo, 0, sizeof(pinfo));
4932
4933         if (!info->attrs[NL80211_ATTR_MAC])
4934                 return -EINVAL;
4935
4936         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4937
4938         if (!rdev->ops->get_mpp)
4939                 return -EOPNOTSUPP;
4940
4941         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4942                 return -EOPNOTSUPP;
4943
4944         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
4945         if (err)
4946                 return err;
4947
4948         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4949         if (!msg)
4950                 return -ENOMEM;
4951
4952         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4953                                dev, dst, mpp, &pinfo) < 0) {
4954                 nlmsg_free(msg);
4955                 return -ENOBUFS;
4956         }
4957
4958         return genlmsg_reply(msg, info);
4959 }
4960
4961 static int nl80211_dump_mpp(struct sk_buff *skb,
4962                             struct netlink_callback *cb)
4963 {
4964         struct mpath_info pinfo;
4965         struct cfg80211_registered_device *rdev;
4966         struct wireless_dev *wdev;
4967         u8 dst[ETH_ALEN];
4968         u8 mpp[ETH_ALEN];
4969         int path_idx = cb->args[2];
4970         int err;
4971
4972         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4973         if (err)
4974                 return err;
4975
4976         if (!rdev->ops->dump_mpp) {
4977                 err = -EOPNOTSUPP;
4978                 goto out_err;
4979         }
4980
4981         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4982                 err = -EOPNOTSUPP;
4983                 goto out_err;
4984         }
4985
4986         while (1) {
4987                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
4988                                     mpp, &pinfo);
4989                 if (err == -ENOENT)
4990                         break;
4991                 if (err)
4992                         goto out_err;
4993
4994                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4995                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4996                                        wdev->netdev, dst, mpp,
4997                                        &pinfo) < 0)
4998                         goto out;
4999
5000                 path_idx++;
5001         }
5002
5003  out:
5004         cb->args[2] = path_idx;
5005         err = skb->len;
5006  out_err:
5007         nl80211_finish_wdev_dump(rdev);
5008         return err;
5009 }
5010
5011 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
5012 {
5013         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5014         struct net_device *dev = info->user_ptr[1];
5015         struct wireless_dev *wdev = dev->ieee80211_ptr;
5016         struct bss_parameters params;
5017         int err;
5018
5019         memset(&params, 0, sizeof(params));
5020         /* default to not changing parameters */
5021         params.use_cts_prot = -1;
5022         params.use_short_preamble = -1;
5023         params.use_short_slot_time = -1;
5024         params.ap_isolate = -1;
5025         params.ht_opmode = -1;
5026         params.p2p_ctwindow = -1;
5027         params.p2p_opp_ps = -1;
5028
5029         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
5030                 params.use_cts_prot =
5031                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
5032         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
5033                 params.use_short_preamble =
5034                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
5035         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
5036                 params.use_short_slot_time =
5037                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
5038         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
5039                 params.basic_rates =
5040                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5041                 params.basic_rates_len =
5042                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5043         }
5044         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
5045                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
5046         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
5047                 params.ht_opmode =
5048                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
5049
5050         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
5051                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5052                         return -EINVAL;
5053                 params.p2p_ctwindow =
5054                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
5055                 if (params.p2p_ctwindow < 0)
5056                         return -EINVAL;
5057                 if (params.p2p_ctwindow != 0 &&
5058                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
5059                         return -EINVAL;
5060         }
5061
5062         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
5063                 u8 tmp;
5064
5065                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5066                         return -EINVAL;
5067                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
5068                 if (tmp > 1)
5069                         return -EINVAL;
5070                 params.p2p_opp_ps = tmp;
5071                 if (params.p2p_opp_ps &&
5072                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
5073                         return -EINVAL;
5074         }
5075
5076         if (!rdev->ops->change_bss)
5077                 return -EOPNOTSUPP;
5078
5079         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5080             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5081                 return -EOPNOTSUPP;
5082
5083         wdev_lock(wdev);
5084         err = rdev_change_bss(rdev, dev, &params);
5085         wdev_unlock(wdev);
5086
5087         return err;
5088 }
5089
5090 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
5091 {
5092         char *data = NULL;
5093         bool is_indoor;
5094         enum nl80211_user_reg_hint_type user_reg_hint_type;
5095         u32 owner_nlportid;
5096
5097
5098         /*
5099          * You should only get this when cfg80211 hasn't yet initialized
5100          * completely when built-in to the kernel right between the time
5101          * window between nl80211_init() and regulatory_init(), if that is
5102          * even possible.
5103          */
5104         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
5105                 return -EINPROGRESS;
5106
5107         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
5108                 user_reg_hint_type =
5109                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
5110         else
5111                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
5112
5113         switch (user_reg_hint_type) {
5114         case NL80211_USER_REG_HINT_USER:
5115         case NL80211_USER_REG_HINT_CELL_BASE:
5116                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5117                         return -EINVAL;
5118
5119                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5120                 return regulatory_hint_user(data, user_reg_hint_type);
5121         case NL80211_USER_REG_HINT_INDOOR:
5122                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
5123                         owner_nlportid = info->snd_portid;
5124                         is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
5125                 } else {
5126                         owner_nlportid = 0;
5127                         is_indoor = true;
5128                 }
5129
5130                 return regulatory_hint_indoor(is_indoor, owner_nlportid);
5131         default:
5132                 return -EINVAL;
5133         }
5134 }
5135
5136 static int nl80211_get_mesh_config(struct sk_buff *skb,
5137                                    struct genl_info *info)
5138 {
5139         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5140         struct net_device *dev = info->user_ptr[1];
5141         struct wireless_dev *wdev = dev->ieee80211_ptr;
5142         struct mesh_config cur_params;
5143         int err = 0;
5144         void *hdr;
5145         struct nlattr *pinfoattr;
5146         struct sk_buff *msg;
5147
5148         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5149                 return -EOPNOTSUPP;
5150
5151         if (!rdev->ops->get_mesh_config)
5152                 return -EOPNOTSUPP;
5153
5154         wdev_lock(wdev);
5155         /* If not connected, get default parameters */
5156         if (!wdev->mesh_id_len)
5157                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
5158         else
5159                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
5160         wdev_unlock(wdev);
5161
5162         if (err)
5163                 return err;
5164
5165         /* Draw up a netlink message to send back */
5166         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5167         if (!msg)
5168                 return -ENOMEM;
5169         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5170                              NL80211_CMD_GET_MESH_CONFIG);
5171         if (!hdr)
5172                 goto out;
5173         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
5174         if (!pinfoattr)
5175                 goto nla_put_failure;
5176         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5177             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
5178                         cur_params.dot11MeshRetryTimeout) ||
5179             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5180                         cur_params.dot11MeshConfirmTimeout) ||
5181             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
5182                         cur_params.dot11MeshHoldingTimeout) ||
5183             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
5184                         cur_params.dot11MeshMaxPeerLinks) ||
5185             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
5186                        cur_params.dot11MeshMaxRetries) ||
5187             nla_put_u8(msg, NL80211_MESHCONF_TTL,
5188                        cur_params.dot11MeshTTL) ||
5189             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
5190                        cur_params.element_ttl) ||
5191             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5192                        cur_params.auto_open_plinks) ||
5193             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5194                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
5195             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5196                        cur_params.dot11MeshHWMPmaxPREQretries) ||
5197             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
5198                         cur_params.path_refresh_time) ||
5199             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5200                         cur_params.min_discovery_timeout) ||
5201             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5202                         cur_params.dot11MeshHWMPactivePathTimeout) ||
5203             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5204                         cur_params.dot11MeshHWMPpreqMinInterval) ||
5205             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5206                         cur_params.dot11MeshHWMPperrMinInterval) ||
5207             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5208                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
5209             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
5210                        cur_params.dot11MeshHWMPRootMode) ||
5211             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5212                         cur_params.dot11MeshHWMPRannInterval) ||
5213             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5214                        cur_params.dot11MeshGateAnnouncementProtocol) ||
5215             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
5216                        cur_params.dot11MeshForwarding) ||
5217             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
5218                         cur_params.rssi_threshold) ||
5219             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
5220                         cur_params.ht_opmode) ||
5221             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5222                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
5223             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5224                         cur_params.dot11MeshHWMProotInterval) ||
5225             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5226                         cur_params.dot11MeshHWMPconfirmationInterval) ||
5227             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
5228                         cur_params.power_mode) ||
5229             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
5230                         cur_params.dot11MeshAwakeWindowDuration) ||
5231             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
5232                         cur_params.plink_timeout))
5233                 goto nla_put_failure;
5234         nla_nest_end(msg, pinfoattr);
5235         genlmsg_end(msg, hdr);
5236         return genlmsg_reply(msg, info);
5237
5238  nla_put_failure:
5239         genlmsg_cancel(msg, hdr);
5240  out:
5241         nlmsg_free(msg);
5242         return -ENOBUFS;
5243 }
5244
5245 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
5246         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
5247         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
5248         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
5249         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
5250         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
5251         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
5252         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
5253         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
5254         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
5255         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
5256         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
5257         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
5258         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
5259         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
5260         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
5261         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
5262         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
5263         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
5264         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
5265         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
5266         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
5267         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
5268         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
5269         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
5270         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
5271         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
5272         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
5273         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
5274 };
5275
5276 static const struct nla_policy
5277         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
5278         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
5279         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
5280         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
5281         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
5282         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
5283         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
5284         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
5285                                     .len = IEEE80211_MAX_DATA_LEN },
5286         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
5287 };
5288
5289 static int nl80211_parse_mesh_config(struct genl_info *info,
5290                                      struct mesh_config *cfg,
5291                                      u32 *mask_out)
5292 {
5293         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
5294         u32 mask = 0;
5295
5296 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
5297 do {                                                                        \
5298         if (tb[attr]) {                                                     \
5299                 if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
5300                         return -EINVAL;                                     \
5301                 cfg->param = fn(tb[attr]);                                  \
5302                 mask |= (1 << (attr - 1));                                  \
5303         }                                                                   \
5304 } while (0)
5305
5306
5307         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
5308                 return -EINVAL;
5309         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
5310                              info->attrs[NL80211_ATTR_MESH_CONFIG],
5311                              nl80211_meshconf_params_policy))
5312                 return -EINVAL;
5313
5314         /* This makes sure that there aren't more than 32 mesh config
5315          * parameters (otherwise our bitfield scheme would not work.) */
5316         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
5317
5318         /* Fill in the params struct */
5319         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
5320                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
5321                                   nla_get_u16);
5322         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
5323                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5324                                   nla_get_u16);
5325         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
5326                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
5327                                   nla_get_u16);
5328         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
5329                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
5330                                   nla_get_u16);
5331         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
5332                                   mask, NL80211_MESHCONF_MAX_RETRIES,
5333                                   nla_get_u8);
5334         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
5335                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
5336         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
5337                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
5338                                   nla_get_u8);
5339         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
5340                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5341                                   nla_get_u8);
5342         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
5343                                   1, 255, mask,
5344                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5345                                   nla_get_u32);
5346         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
5347                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5348                                   nla_get_u8);
5349         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
5350                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
5351                                   nla_get_u32);
5352         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
5353                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5354                                   nla_get_u16);
5355         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
5356                                   1, 65535, mask,
5357                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5358                                   nla_get_u32);
5359         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
5360                                   1, 65535, mask,
5361                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5362                                   nla_get_u16);
5363         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
5364                                   1, 65535, mask,
5365                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5366                                   nla_get_u16);
5367         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5368                                   dot11MeshHWMPnetDiameterTraversalTime,
5369                                   1, 65535, mask,
5370                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5371                                   nla_get_u16);
5372         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
5373                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
5374                                   nla_get_u8);
5375         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
5376                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5377                                   nla_get_u16);
5378         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5379                                   dot11MeshGateAnnouncementProtocol, 0, 1,
5380                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5381                                   nla_get_u8);
5382         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
5383                                   mask, NL80211_MESHCONF_FORWARDING,
5384                                   nla_get_u8);
5385         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
5386                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
5387                                   nla_get_s32);
5388         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
5389                                   mask, NL80211_MESHCONF_HT_OPMODE,
5390                                   nla_get_u16);
5391         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
5392                                   1, 65535, mask,
5393                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5394                                   nla_get_u32);
5395         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
5396                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5397                                   nla_get_u16);
5398         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5399                                   dot11MeshHWMPconfirmationInterval,
5400                                   1, 65535, mask,
5401                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5402                                   nla_get_u16);
5403         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
5404                                   NL80211_MESH_POWER_ACTIVE,
5405                                   NL80211_MESH_POWER_MAX,
5406                                   mask, NL80211_MESHCONF_POWER_MODE,
5407                                   nla_get_u32);
5408         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
5409                                   0, 65535, mask,
5410                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
5411         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 0, 0xffffffff,
5412                                   mask, NL80211_MESHCONF_PLINK_TIMEOUT,
5413                                   nla_get_u32);
5414         if (mask_out)
5415                 *mask_out = mask;
5416
5417         return 0;
5418
5419 #undef FILL_IN_MESH_PARAM_IF_SET
5420 }
5421
5422 static int nl80211_parse_mesh_setup(struct genl_info *info,
5423                                      struct mesh_setup *setup)
5424 {
5425         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5426         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
5427
5428         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
5429                 return -EINVAL;
5430         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
5431                              info->attrs[NL80211_ATTR_MESH_SETUP],
5432                              nl80211_mesh_setup_params_policy))
5433                 return -EINVAL;
5434
5435         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
5436                 setup->sync_method =
5437                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
5438                  IEEE80211_SYNC_METHOD_VENDOR :
5439                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
5440
5441         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
5442                 setup->path_sel_proto =
5443                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
5444                  IEEE80211_PATH_PROTOCOL_VENDOR :
5445                  IEEE80211_PATH_PROTOCOL_HWMP;
5446
5447         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
5448                 setup->path_metric =
5449                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
5450                  IEEE80211_PATH_METRIC_VENDOR :
5451                  IEEE80211_PATH_METRIC_AIRTIME;
5452
5453
5454         if (tb[NL80211_MESH_SETUP_IE]) {
5455                 struct nlattr *ieattr =
5456                         tb[NL80211_MESH_SETUP_IE];
5457                 if (!is_valid_ie_attr(ieattr))
5458                         return -EINVAL;
5459                 setup->ie = nla_data(ieattr);
5460                 setup->ie_len = nla_len(ieattr);
5461         }
5462         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
5463             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
5464                 return -EINVAL;
5465         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
5466         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
5467         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
5468         if (setup->is_secure)
5469                 setup->user_mpm = true;
5470
5471         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
5472                 if (!setup->user_mpm)
5473                         return -EINVAL;
5474                 setup->auth_id =
5475                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
5476         }
5477
5478         return 0;
5479 }
5480
5481 static int nl80211_update_mesh_config(struct sk_buff *skb,
5482                                       struct genl_info *info)
5483 {
5484         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5485         struct net_device *dev = info->user_ptr[1];
5486         struct wireless_dev *wdev = dev->ieee80211_ptr;
5487         struct mesh_config cfg;
5488         u32 mask;
5489         int err;
5490
5491         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5492                 return -EOPNOTSUPP;
5493
5494         if (!rdev->ops->update_mesh_config)
5495                 return -EOPNOTSUPP;
5496
5497         err = nl80211_parse_mesh_config(info, &cfg, &mask);
5498         if (err)
5499                 return err;
5500
5501         wdev_lock(wdev);
5502         if (!wdev->mesh_id_len)
5503                 err = -ENOLINK;
5504
5505         if (!err)
5506                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
5507
5508         wdev_unlock(wdev);
5509
5510         return err;
5511 }
5512
5513 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
5514                               struct sk_buff *msg)
5515 {
5516         struct nlattr *nl_reg_rules;
5517         unsigned int i;
5518
5519         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
5520             (regdom->dfs_region &&
5521              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
5522                 goto nla_put_failure;
5523
5524         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
5525         if (!nl_reg_rules)
5526                 goto nla_put_failure;
5527
5528         for (i = 0; i < regdom->n_reg_rules; i++) {
5529                 struct nlattr *nl_reg_rule;
5530                 const struct ieee80211_reg_rule *reg_rule;
5531                 const struct ieee80211_freq_range *freq_range;
5532                 const struct ieee80211_power_rule *power_rule;
5533                 unsigned int max_bandwidth_khz;
5534
5535                 reg_rule = &regdom->reg_rules[i];
5536                 freq_range = &reg_rule->freq_range;
5537                 power_rule = &reg_rule->power_rule;
5538
5539                 nl_reg_rule = nla_nest_start(msg, i);
5540                 if (!nl_reg_rule)
5541                         goto nla_put_failure;
5542
5543                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
5544                 if (!max_bandwidth_khz)
5545                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
5546                                                                   reg_rule);
5547
5548                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
5549                                 reg_rule->flags) ||
5550                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
5551                                 freq_range->start_freq_khz) ||
5552                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
5553                                 freq_range->end_freq_khz) ||
5554                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
5555                                 max_bandwidth_khz) ||
5556                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
5557                                 power_rule->max_antenna_gain) ||
5558                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
5559                                 power_rule->max_eirp) ||
5560                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
5561                                 reg_rule->dfs_cac_ms))
5562                         goto nla_put_failure;
5563
5564                 nla_nest_end(msg, nl_reg_rule);
5565         }
5566
5567         nla_nest_end(msg, nl_reg_rules);
5568         return 0;
5569
5570 nla_put_failure:
5571         return -EMSGSIZE;
5572 }
5573
5574 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
5575 {
5576         const struct ieee80211_regdomain *regdom = NULL;
5577         struct cfg80211_registered_device *rdev;
5578         struct wiphy *wiphy = NULL;
5579         struct sk_buff *msg;
5580         void *hdr;
5581
5582         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5583         if (!msg)
5584                 return -ENOBUFS;
5585
5586         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5587                              NL80211_CMD_GET_REG);
5588         if (!hdr)
5589                 goto put_failure;
5590
5591         if (info->attrs[NL80211_ATTR_WIPHY]) {
5592                 bool self_managed;
5593
5594                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
5595                 if (IS_ERR(rdev)) {
5596                         nlmsg_free(msg);
5597                         return PTR_ERR(rdev);
5598                 }
5599
5600                 wiphy = &rdev->wiphy;
5601                 self_managed = wiphy->regulatory_flags &
5602                                REGULATORY_WIPHY_SELF_MANAGED;
5603                 regdom = get_wiphy_regdom(wiphy);
5604
5605                 /* a self-managed-reg device must have a private regdom */
5606                 if (WARN_ON(!regdom && self_managed)) {
5607                         nlmsg_free(msg);
5608                         return -EINVAL;
5609                 }
5610
5611                 if (regdom &&
5612                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
5613                         goto nla_put_failure;
5614         }
5615
5616         if (!wiphy && reg_last_request_cell_base() &&
5617             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
5618                         NL80211_USER_REG_HINT_CELL_BASE))
5619                 goto nla_put_failure;
5620
5621         rcu_read_lock();
5622
5623         if (!regdom)
5624                 regdom = rcu_dereference(cfg80211_regdomain);
5625
5626         if (nl80211_put_regdom(regdom, msg))
5627                 goto nla_put_failure_rcu;
5628
5629         rcu_read_unlock();
5630
5631         genlmsg_end(msg, hdr);
5632         return genlmsg_reply(msg, info);
5633
5634 nla_put_failure_rcu:
5635         rcu_read_unlock();
5636 nla_put_failure:
5637         genlmsg_cancel(msg, hdr);
5638 put_failure:
5639         nlmsg_free(msg);
5640         return -EMSGSIZE;
5641 }
5642
5643 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
5644                                u32 seq, int flags, struct wiphy *wiphy,
5645                                const struct ieee80211_regdomain *regdom)
5646 {
5647         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
5648                                    NL80211_CMD_GET_REG);
5649
5650         if (!hdr)
5651                 return -1;
5652
5653         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
5654
5655         if (nl80211_put_regdom(regdom, msg))
5656                 goto nla_put_failure;
5657
5658         if (!wiphy && reg_last_request_cell_base() &&
5659             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
5660                         NL80211_USER_REG_HINT_CELL_BASE))
5661                 goto nla_put_failure;
5662
5663         if (wiphy &&
5664             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
5665                 goto nla_put_failure;
5666
5667         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
5668             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
5669                 goto nla_put_failure;
5670
5671         genlmsg_end(msg, hdr);
5672         return 0;
5673
5674 nla_put_failure:
5675         genlmsg_cancel(msg, hdr);
5676         return -EMSGSIZE;
5677 }
5678
5679 static int nl80211_get_reg_dump(struct sk_buff *skb,
5680                                 struct netlink_callback *cb)
5681 {
5682         const struct ieee80211_regdomain *regdom = NULL;
5683         struct cfg80211_registered_device *rdev;
5684         int err, reg_idx, start = cb->args[2];
5685
5686         rtnl_lock();
5687
5688         if (cfg80211_regdomain && start == 0) {
5689                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
5690                                           NLM_F_MULTI, NULL,
5691                                           rtnl_dereference(cfg80211_regdomain));
5692                 if (err < 0)
5693                         goto out_err;
5694         }
5695
5696         /* the global regdom is idx 0 */
5697         reg_idx = 1;
5698         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
5699                 regdom = get_wiphy_regdom(&rdev->wiphy);
5700                 if (!regdom)
5701                         continue;
5702
5703                 if (++reg_idx <= start)
5704                         continue;
5705
5706                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
5707                                           NLM_F_MULTI, &rdev->wiphy, regdom);
5708                 if (err < 0) {
5709                         reg_idx--;
5710                         break;
5711                 }
5712         }
5713
5714         cb->args[2] = reg_idx;
5715         err = skb->len;
5716 out_err:
5717         rtnl_unlock();
5718         return err;
5719 }
5720
5721 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
5722 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
5723         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
5724         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
5725         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
5726         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
5727         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
5728         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
5729         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
5730 };
5731
5732 static int parse_reg_rule(struct nlattr *tb[],
5733         struct ieee80211_reg_rule *reg_rule)
5734 {
5735         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
5736         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
5737
5738         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
5739                 return -EINVAL;
5740         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
5741                 return -EINVAL;
5742         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
5743                 return -EINVAL;
5744         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
5745                 return -EINVAL;
5746         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
5747                 return -EINVAL;
5748
5749         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
5750
5751         freq_range->start_freq_khz =
5752                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
5753         freq_range->end_freq_khz =
5754                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
5755         freq_range->max_bandwidth_khz =
5756                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
5757
5758         power_rule->max_eirp =
5759                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
5760
5761         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
5762                 power_rule->max_antenna_gain =
5763                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
5764
5765         if (tb[NL80211_ATTR_DFS_CAC_TIME])
5766                 reg_rule->dfs_cac_ms =
5767                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
5768
5769         return 0;
5770 }
5771
5772 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
5773 {
5774         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
5775         struct nlattr *nl_reg_rule;
5776         char *alpha2;
5777         int rem_reg_rules, r;
5778         u32 num_rules = 0, rule_idx = 0, size_of_regd;
5779         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
5780         struct ieee80211_regdomain *rd;
5781
5782         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5783                 return -EINVAL;
5784
5785         if (!info->attrs[NL80211_ATTR_REG_RULES])
5786                 return -EINVAL;
5787
5788         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5789
5790         if (info->attrs[NL80211_ATTR_DFS_REGION])
5791                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
5792
5793         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5794                             rem_reg_rules) {
5795                 num_rules++;
5796                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
5797                         return -EINVAL;
5798         }
5799
5800         if (!reg_is_valid_request(alpha2))
5801                 return -EINVAL;
5802
5803         size_of_regd = sizeof(struct ieee80211_regdomain) +
5804                        num_rules * sizeof(struct ieee80211_reg_rule);
5805
5806         rd = kzalloc(size_of_regd, GFP_KERNEL);
5807         if (!rd)
5808                 return -ENOMEM;
5809
5810         rd->n_reg_rules = num_rules;
5811         rd->alpha2[0] = alpha2[0];
5812         rd->alpha2[1] = alpha2[1];
5813
5814         /*
5815          * Disable DFS master mode if the DFS region was
5816          * not supported or known on this kernel.
5817          */
5818         if (reg_supported_dfs_region(dfs_region))
5819                 rd->dfs_region = dfs_region;
5820
5821         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5822                             rem_reg_rules) {
5823                 r = nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
5824                               nla_data(nl_reg_rule), nla_len(nl_reg_rule),
5825                               reg_rule_policy);
5826                 if (r)
5827                         goto bad_reg;
5828                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
5829                 if (r)
5830                         goto bad_reg;
5831
5832                 rule_idx++;
5833
5834                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
5835                         r = -EINVAL;
5836                         goto bad_reg;
5837                 }
5838         }
5839
5840         r = set_regdom(rd, REGD_SOURCE_CRDA);
5841         /* set_regdom took ownership */
5842         rd = NULL;
5843
5844  bad_reg:
5845         kfree(rd);
5846         return r;
5847 }
5848 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
5849
5850 static int validate_scan_freqs(struct nlattr *freqs)
5851 {
5852         struct nlattr *attr1, *attr2;
5853         int n_channels = 0, tmp1, tmp2;
5854
5855         nla_for_each_nested(attr1, freqs, tmp1) {
5856                 n_channels++;
5857                 /*
5858                  * Some hardware has a limited channel list for
5859                  * scanning, and it is pretty much nonsensical
5860                  * to scan for a channel twice, so disallow that
5861                  * and don't require drivers to check that the
5862                  * channel list they get isn't longer than what
5863                  * they can scan, as long as they can scan all
5864                  * the channels they registered at once.
5865                  */
5866                 nla_for_each_nested(attr2, freqs, tmp2)
5867                         if (attr1 != attr2 &&
5868                             nla_get_u32(attr1) == nla_get_u32(attr2))
5869                                 return 0;
5870         }
5871
5872         return n_channels;
5873 }
5874
5875 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
5876 {
5877         return b < NUM_NL80211_BANDS && wiphy->bands[b];
5878 }
5879
5880 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
5881                             struct cfg80211_bss_selection *bss_select)
5882 {
5883         struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
5884         struct nlattr *nest;
5885         int err;
5886         bool found = false;
5887         int i;
5888
5889         /* only process one nested attribute */
5890         nest = nla_data(nla);
5891         if (!nla_ok(nest, nla_len(nest)))
5892                 return -EINVAL;
5893
5894         err = nla_parse(attr, NL80211_BSS_SELECT_ATTR_MAX, nla_data(nest),
5895                         nla_len(nest), nl80211_bss_select_policy);
5896         if (err)
5897                 return err;
5898
5899         /* only one attribute may be given */
5900         for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
5901                 if (attr[i]) {
5902                         if (found)
5903                                 return -EINVAL;
5904                         found = true;
5905                 }
5906         }
5907
5908         bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
5909
5910         if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
5911                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
5912
5913         if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
5914                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
5915                 bss_select->param.band_pref =
5916                         nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
5917                 if (!is_band_valid(wiphy, bss_select->param.band_pref))
5918                         return -EINVAL;
5919         }
5920
5921         if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
5922                 struct nl80211_bss_select_rssi_adjust *adj_param;
5923
5924                 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
5925                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
5926                 bss_select->param.adjust.band = adj_param->band;
5927                 bss_select->param.adjust.delta = adj_param->delta;
5928                 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
5929                         return -EINVAL;
5930         }
5931
5932         /* user-space did not provide behaviour attribute */
5933         if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
5934                 return -EINVAL;
5935
5936         if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
5937                 return -EINVAL;
5938
5939         return 0;
5940 }
5941
5942 static int nl80211_parse_random_mac(struct nlattr **attrs,
5943                                     u8 *mac_addr, u8 *mac_addr_mask)
5944 {
5945         int i;
5946
5947         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
5948                 eth_zero_addr(mac_addr);
5949                 eth_zero_addr(mac_addr_mask);
5950                 mac_addr[0] = 0x2;
5951                 mac_addr_mask[0] = 0x3;
5952
5953                 return 0;
5954         }
5955
5956         /* need both or none */
5957         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
5958                 return -EINVAL;
5959
5960         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
5961         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
5962
5963         /* don't allow or configure an mcast address */
5964         if (!is_multicast_ether_addr(mac_addr_mask) ||
5965             is_multicast_ether_addr(mac_addr))
5966                 return -EINVAL;
5967
5968         /*
5969          * allow users to pass a MAC address that has bits set outside
5970          * of the mask, but don't bother drivers with having to deal
5971          * with such bits
5972          */
5973         for (i = 0; i < ETH_ALEN; i++)
5974                 mac_addr[i] &= mac_addr_mask[i];
5975
5976         return 0;
5977 }
5978
5979 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
5980 {
5981         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5982         struct wireless_dev *wdev = info->user_ptr[1];
5983         struct cfg80211_scan_request *request;
5984         struct nlattr *attr;
5985         struct wiphy *wiphy;
5986         int err, tmp, n_ssids = 0, n_channels, i;
5987         size_t ie_len;
5988
5989         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5990                 return -EINVAL;
5991
5992         wiphy = &rdev->wiphy;
5993
5994         if (!rdev->ops->scan)
5995                 return -EOPNOTSUPP;
5996
5997         if (rdev->scan_req || rdev->scan_msg) {
5998                 err = -EBUSY;
5999                 goto unlock;
6000         }
6001
6002         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6003                 n_channels = validate_scan_freqs(
6004                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
6005                 if (!n_channels) {
6006                         err = -EINVAL;
6007                         goto unlock;
6008                 }
6009         } else {
6010                 n_channels = ieee80211_get_num_supported_channels(wiphy);
6011         }
6012
6013         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
6014                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
6015                         n_ssids++;
6016
6017         if (n_ssids > wiphy->max_scan_ssids) {
6018                 err = -EINVAL;
6019                 goto unlock;
6020         }
6021
6022         if (info->attrs[NL80211_ATTR_IE])
6023                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6024         else
6025                 ie_len = 0;
6026
6027         if (ie_len > wiphy->max_scan_ie_len) {
6028                 err = -EINVAL;
6029                 goto unlock;
6030         }
6031
6032         request = kzalloc(sizeof(*request)
6033                         + sizeof(*request->ssids) * n_ssids
6034                         + sizeof(*request->channels) * n_channels
6035                         + ie_len, GFP_KERNEL);
6036         if (!request) {
6037                 err = -ENOMEM;
6038                 goto unlock;
6039         }
6040
6041         if (n_ssids)
6042                 request->ssids = (void *)&request->channels[n_channels];
6043         request->n_ssids = n_ssids;
6044         if (ie_len) {
6045                 if (n_ssids)
6046                         request->ie = (void *)(request->ssids + n_ssids);
6047                 else
6048                         request->ie = (void *)(request->channels + n_channels);
6049         }
6050
6051         i = 0;
6052         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6053                 /* user specified, bail out if channel not found */
6054                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
6055                         struct ieee80211_channel *chan;
6056
6057                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
6058
6059                         if (!chan) {
6060                                 err = -EINVAL;
6061                                 goto out_free;
6062                         }
6063
6064                         /* ignore disabled channels */
6065                         if (chan->flags & IEEE80211_CHAN_DISABLED)
6066                                 continue;
6067
6068                         request->channels[i] = chan;
6069                         i++;
6070                 }
6071         } else {
6072                 enum nl80211_band band;
6073
6074                 /* all channels */
6075                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
6076                         int j;
6077                         if (!wiphy->bands[band])
6078                                 continue;
6079                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
6080                                 struct ieee80211_channel *chan;
6081
6082                                 chan = &wiphy->bands[band]->channels[j];
6083
6084                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
6085                                         continue;
6086
6087                                 request->channels[i] = chan;
6088                                 i++;
6089                         }
6090                 }
6091         }
6092
6093         if (!i) {
6094                 err = -EINVAL;
6095                 goto out_free;
6096         }
6097
6098         request->n_channels = i;
6099
6100         i = 0;
6101         if (n_ssids) {
6102                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
6103                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
6104                                 err = -EINVAL;
6105                                 goto out_free;
6106                         }
6107                         request->ssids[i].ssid_len = nla_len(attr);
6108                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
6109                         i++;
6110                 }
6111         }
6112
6113         if (info->attrs[NL80211_ATTR_IE]) {
6114                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6115                 memcpy((void *)request->ie,
6116                        nla_data(info->attrs[NL80211_ATTR_IE]),
6117                        request->ie_len);
6118         }
6119
6120         for (i = 0; i < NUM_NL80211_BANDS; i++)
6121                 if (wiphy->bands[i])
6122                         request->rates[i] =
6123                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
6124
6125         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
6126                 nla_for_each_nested(attr,
6127                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
6128                                     tmp) {
6129                         enum nl80211_band band = nla_type(attr);
6130
6131                         if (band < 0 || band >= NUM_NL80211_BANDS) {
6132                                 err = -EINVAL;
6133                                 goto out_free;
6134                         }
6135
6136                         if (!wiphy->bands[band])
6137                                 continue;
6138
6139                         err = ieee80211_get_ratemask(wiphy->bands[band],
6140                                                      nla_data(attr),
6141                                                      nla_len(attr),
6142                                                      &request->rates[band]);
6143                         if (err)
6144                                 goto out_free;
6145                 }
6146         }
6147
6148         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
6149                 request->flags = nla_get_u32(
6150                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
6151                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
6152                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
6153                         err = -EOPNOTSUPP;
6154                         goto out_free;
6155                 }
6156
6157                 if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
6158                         if (!(wiphy->features &
6159                                         NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR)) {
6160                                 err = -EOPNOTSUPP;
6161                                 goto out_free;
6162                         }
6163
6164                         if (wdev->current_bss) {
6165                                 err = -EOPNOTSUPP;
6166                                 goto out_free;
6167                         }
6168
6169                         err = nl80211_parse_random_mac(info->attrs,
6170                                                        request->mac_addr,
6171                                                        request->mac_addr_mask);
6172                         if (err)
6173                                 goto out_free;
6174                 }
6175         }
6176
6177         request->no_cck =
6178                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
6179
6180         if (info->attrs[NL80211_ATTR_MAC])
6181                 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
6182                        ETH_ALEN);
6183         else
6184                 eth_broadcast_addr(request->bssid);
6185
6186         request->wdev = wdev;
6187         request->wiphy = &rdev->wiphy;
6188         request->scan_start = jiffies;
6189
6190         rdev->scan_req = request;
6191         err = rdev_scan(rdev, request);
6192
6193         if (!err) {
6194                 nl80211_send_scan_start(rdev, wdev);
6195                 if (wdev->netdev)
6196                         dev_hold(wdev->netdev);
6197         } else {
6198  out_free:
6199                 rdev->scan_req = NULL;
6200                 kfree(request);
6201         }
6202
6203  unlock:
6204         return err;
6205 }
6206
6207 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
6208 {
6209         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6210         struct wireless_dev *wdev = info->user_ptr[1];
6211
6212         if (!rdev->ops->abort_scan)
6213                 return -EOPNOTSUPP;
6214
6215         if (rdev->scan_msg)
6216                 return 0;
6217
6218         if (!rdev->scan_req)
6219                 return -ENOENT;
6220
6221         rdev_abort_scan(rdev, wdev);
6222         return 0;
6223 }
6224
6225 static int
6226 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
6227                                struct cfg80211_sched_scan_request *request,
6228                                struct nlattr **attrs)
6229 {
6230         int tmp, err, i = 0;
6231         struct nlattr *attr;
6232
6233         if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
6234                 u32 interval;
6235
6236                 /*
6237                  * If scan plans are not specified,
6238                  * %NL80211_ATTR_SCHED_SCAN_INTERVAL must be specified. In this
6239                  * case one scan plan will be set with the specified scan
6240                  * interval and infinite number of iterations.
6241                  */
6242                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
6243                         return -EINVAL;
6244
6245                 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
6246                 if (!interval)
6247                         return -EINVAL;
6248
6249                 request->scan_plans[0].interval =
6250                         DIV_ROUND_UP(interval, MSEC_PER_SEC);
6251                 if (!request->scan_plans[0].interval)
6252                         return -EINVAL;
6253
6254                 if (request->scan_plans[0].interval >
6255                     wiphy->max_sched_scan_plan_interval)
6256                         request->scan_plans[0].interval =
6257                                 wiphy->max_sched_scan_plan_interval;
6258
6259                 return 0;
6260         }
6261
6262         nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
6263                 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
6264
6265                 if (WARN_ON(i >= n_plans))
6266                         return -EINVAL;
6267
6268                 err = nla_parse(plan, NL80211_SCHED_SCAN_PLAN_MAX,
6269                                 nla_data(attr), nla_len(attr),
6270                                 nl80211_plan_policy);
6271                 if (err)
6272                         return err;
6273
6274                 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
6275                         return -EINVAL;
6276
6277                 request->scan_plans[i].interval =
6278                         nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
6279                 if (!request->scan_plans[i].interval ||
6280                     request->scan_plans[i].interval >
6281                     wiphy->max_sched_scan_plan_interval)
6282                         return -EINVAL;
6283
6284                 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
6285                         request->scan_plans[i].iterations =
6286                                 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
6287                         if (!request->scan_plans[i].iterations ||
6288                             (request->scan_plans[i].iterations >
6289                              wiphy->max_sched_scan_plan_iterations))
6290                                 return -EINVAL;
6291                 } else if (i < n_plans - 1) {
6292                         /*
6293                          * All scan plans but the last one must specify
6294                          * a finite number of iterations
6295                          */
6296                         return -EINVAL;
6297                 }
6298
6299                 i++;
6300         }
6301
6302         /*
6303          * The last scan plan must not specify the number of
6304          * iterations, it is supposed to run infinitely
6305          */
6306         if (request->scan_plans[n_plans - 1].iterations)
6307                 return  -EINVAL;
6308
6309         return 0;
6310 }
6311
6312 static struct cfg80211_sched_scan_request *
6313 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
6314                          struct nlattr **attrs)
6315 {
6316         struct cfg80211_sched_scan_request *request;
6317         struct nlattr *attr;
6318         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
6319         enum nl80211_band band;
6320         size_t ie_len;
6321         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
6322         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
6323
6324         if (!is_valid_ie_attr(attrs[NL80211_ATTR_IE]))
6325                 return ERR_PTR(-EINVAL);
6326
6327         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6328                 n_channels = validate_scan_freqs(
6329                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
6330                 if (!n_channels)
6331                         return ERR_PTR(-EINVAL);
6332         } else {
6333                 n_channels = ieee80211_get_num_supported_channels(wiphy);
6334         }
6335
6336         if (attrs[NL80211_ATTR_SCAN_SSIDS])
6337                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
6338                                     tmp)
6339                         n_ssids++;
6340
6341         if (n_ssids > wiphy->max_sched_scan_ssids)
6342                 return ERR_PTR(-EINVAL);
6343
6344         /*
6345          * First, count the number of 'real' matchsets. Due to an issue with
6346          * the old implementation, matchsets containing only the RSSI attribute
6347          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
6348          * RSSI for all matchsets, rather than their own matchset for reporting
6349          * all APs with a strong RSSI. This is needed to be compatible with
6350          * older userspace that treated a matchset with only the RSSI as the
6351          * global RSSI for all other matchsets - if there are other matchsets.
6352          */
6353         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
6354                 nla_for_each_nested(attr,
6355                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
6356                                     tmp) {
6357                         struct nlattr *rssi;
6358
6359                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
6360                                         nla_data(attr), nla_len(attr),
6361                                         nl80211_match_policy);
6362                         if (err)
6363                                 return ERR_PTR(err);
6364                         /* add other standalone attributes here */
6365                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]) {
6366                                 n_match_sets++;
6367                                 continue;
6368                         }
6369                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
6370                         if (rssi)
6371                                 default_match_rssi = nla_get_s32(rssi);
6372                 }
6373         }
6374
6375         /* However, if there's no other matchset, add the RSSI one */
6376         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
6377                 n_match_sets = 1;
6378
6379         if (n_match_sets > wiphy->max_match_sets)
6380                 return ERR_PTR(-EINVAL);
6381
6382         if (attrs[NL80211_ATTR_IE])
6383                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
6384         else
6385                 ie_len = 0;
6386
6387         if (ie_len > wiphy->max_sched_scan_ie_len)
6388                 return ERR_PTR(-EINVAL);
6389
6390         if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
6391                 /*
6392                  * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
6393                  * each scan plan already specifies its own interval
6394                  */
6395                 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
6396                         return ERR_PTR(-EINVAL);
6397
6398                 nla_for_each_nested(attr,
6399                                     attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
6400                         n_plans++;
6401         } else {
6402                 /*
6403                  * The scan interval attribute is kept for backward
6404                  * compatibility. If no scan plans are specified and sched scan
6405                  * interval is specified, one scan plan will be set with this
6406                  * scan interval and infinite number of iterations.
6407                  */
6408                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
6409                         return ERR_PTR(-EINVAL);
6410
6411                 n_plans = 1;
6412         }
6413
6414         if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
6415                 return ERR_PTR(-EINVAL);
6416
6417         request = kzalloc(sizeof(*request)
6418                         + sizeof(*request->ssids) * n_ssids
6419                         + sizeof(*request->match_sets) * n_match_sets
6420                         + sizeof(*request->scan_plans) * n_plans
6421                         + sizeof(*request->channels) * n_channels
6422                         + ie_len, GFP_KERNEL);
6423         if (!request)
6424                 return ERR_PTR(-ENOMEM);
6425
6426         if (n_ssids)
6427                 request->ssids = (void *)&request->channels[n_channels];
6428         request->n_ssids = n_ssids;
6429         if (ie_len) {
6430                 if (n_ssids)
6431                         request->ie = (void *)(request->ssids + n_ssids);
6432                 else
6433                         request->ie = (void *)(request->channels + n_channels);
6434         }
6435
6436         if (n_match_sets) {
6437                 if (request->ie)
6438                         request->match_sets = (void *)(request->ie + ie_len);
6439                 else if (n_ssids)
6440                         request->match_sets =
6441                                 (void *)(request->ssids + n_ssids);
6442                 else
6443                         request->match_sets =
6444                                 (void *)(request->channels + n_channels);
6445         }
6446         request->n_match_sets = n_match_sets;
6447
6448         if (n_match_sets)
6449                 request->scan_plans = (void *)(request->match_sets +
6450                                                n_match_sets);
6451         else if (request->ie)
6452                 request->scan_plans = (void *)(request->ie + ie_len);
6453         else if (n_ssids)
6454                 request->scan_plans = (void *)(request->ssids + n_ssids);
6455         else
6456                 request->scan_plans = (void *)(request->channels + n_channels);
6457
6458         request->n_scan_plans = n_plans;
6459
6460         i = 0;
6461         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6462                 /* user specified, bail out if channel not found */
6463                 nla_for_each_nested(attr,
6464                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
6465                                     tmp) {
6466                         struct ieee80211_channel *chan;
6467
6468                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
6469
6470                         if (!chan) {
6471                                 err = -EINVAL;
6472                                 goto out_free;
6473                         }
6474
6475                         /* ignore disabled channels */
6476                         if (chan->flags & IEEE80211_CHAN_DISABLED)
6477                                 continue;
6478
6479                         request->channels[i] = chan;
6480                         i++;
6481                 }
6482         } else {
6483                 /* all channels */
6484                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
6485                         int j;
6486                         if (!wiphy->bands[band])
6487                                 continue;
6488                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
6489                                 struct ieee80211_channel *chan;
6490
6491                                 chan = &wiphy->bands[band]->channels[j];
6492
6493                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
6494                                         continue;
6495
6496                                 request->channels[i] = chan;
6497                                 i++;
6498                         }
6499                 }
6500         }
6501
6502         if (!i) {
6503                 err = -EINVAL;
6504                 goto out_free;
6505         }
6506
6507         request->n_channels = i;
6508
6509         i = 0;
6510         if (n_ssids) {
6511                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
6512                                     tmp) {
6513                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
6514                                 err = -EINVAL;
6515                                 goto out_free;
6516                         }
6517                         request->ssids[i].ssid_len = nla_len(attr);
6518                         memcpy(request->ssids[i].ssid, nla_data(attr),
6519                                nla_len(attr));
6520                         i++;
6521                 }
6522         }
6523
6524         i = 0;
6525         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
6526                 nla_for_each_nested(attr,
6527                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
6528                                     tmp) {
6529                         struct nlattr *ssid, *rssi;
6530
6531                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
6532                                         nla_data(attr), nla_len(attr),
6533                                         nl80211_match_policy);
6534                         if (err)
6535                                 goto out_free;
6536                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
6537                         if (ssid) {
6538                                 if (WARN_ON(i >= n_match_sets)) {
6539                                         /* this indicates a programming error,
6540                                          * the loop above should have verified
6541                                          * things properly
6542                                          */
6543                                         err = -EINVAL;
6544                                         goto out_free;
6545                                 }
6546
6547                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
6548                                         err = -EINVAL;
6549                                         goto out_free;
6550                                 }
6551                                 memcpy(request->match_sets[i].ssid.ssid,
6552                                        nla_data(ssid), nla_len(ssid));
6553                                 request->match_sets[i].ssid.ssid_len =
6554                                         nla_len(ssid);
6555                                 /* special attribute - old implemenation w/a */
6556                                 request->match_sets[i].rssi_thold =
6557                                         default_match_rssi;
6558                                 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
6559                                 if (rssi)
6560                                         request->match_sets[i].rssi_thold =
6561                                                 nla_get_s32(rssi);
6562                         }
6563                         i++;
6564                 }
6565
6566                 /* there was no other matchset, so the RSSI one is alone */
6567                 if (i == 0 && n_match_sets)
6568                         request->match_sets[0].rssi_thold = default_match_rssi;
6569
6570                 request->min_rssi_thold = INT_MAX;
6571                 for (i = 0; i < n_match_sets; i++)
6572                         request->min_rssi_thold =
6573                                 min(request->match_sets[i].rssi_thold,
6574                                     request->min_rssi_thold);
6575         } else {
6576                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
6577         }
6578
6579         if (ie_len) {
6580                 request->ie_len = ie_len;
6581                 memcpy((void *)request->ie,
6582                        nla_data(attrs[NL80211_ATTR_IE]),
6583                        request->ie_len);
6584         }
6585
6586         if (attrs[NL80211_ATTR_SCAN_FLAGS]) {
6587                 request->flags = nla_get_u32(
6588                         attrs[NL80211_ATTR_SCAN_FLAGS]);
6589                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
6590                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
6591                         err = -EOPNOTSUPP;
6592                         goto out_free;
6593                 }
6594
6595                 if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
6596                         u32 flg = NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
6597
6598                         if (!wdev) /* must be net-detect */
6599                                 flg = NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
6600
6601                         if (!(wiphy->features & flg)) {
6602                                 err = -EOPNOTSUPP;
6603                                 goto out_free;
6604                         }
6605
6606                         if (wdev && wdev->current_bss) {
6607                                 err = -EOPNOTSUPP;
6608                                 goto out_free;
6609                         }
6610
6611                         err = nl80211_parse_random_mac(attrs, request->mac_addr,
6612                                                        request->mac_addr_mask);
6613                         if (err)
6614                                 goto out_free;
6615                 }
6616         }
6617
6618         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
6619                 request->delay =
6620                         nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
6621
6622         err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
6623         if (err)
6624                 goto out_free;
6625
6626         request->scan_start = jiffies;
6627
6628         return request;
6629
6630 out_free:
6631         kfree(request);
6632         return ERR_PTR(err);
6633 }
6634
6635 static int nl80211_start_sched_scan(struct sk_buff *skb,
6636                                     struct genl_info *info)
6637 {
6638         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6639         struct net_device *dev = info->user_ptr[1];
6640         struct wireless_dev *wdev = dev->ieee80211_ptr;
6641         struct cfg80211_sched_scan_request *sched_scan_req;
6642         int err;
6643
6644         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
6645             !rdev->ops->sched_scan_start)
6646                 return -EOPNOTSUPP;
6647
6648         if (rdev->sched_scan_req)
6649                 return -EINPROGRESS;
6650
6651         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
6652                                                   info->attrs);
6653
6654         err = PTR_ERR_OR_ZERO(sched_scan_req);
6655         if (err)
6656                 goto out_err;
6657
6658         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
6659         if (err)
6660                 goto out_free;
6661
6662         sched_scan_req->dev = dev;
6663         sched_scan_req->wiphy = &rdev->wiphy;
6664
6665         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
6666                 sched_scan_req->owner_nlportid = info->snd_portid;
6667
6668         rcu_assign_pointer(rdev->sched_scan_req, sched_scan_req);
6669
6670         nl80211_send_sched_scan(rdev, dev,
6671                                 NL80211_CMD_START_SCHED_SCAN);
6672         return 0;
6673
6674 out_free:
6675         kfree(sched_scan_req);
6676 out_err:
6677         return err;
6678 }
6679
6680 static int nl80211_stop_sched_scan(struct sk_buff *skb,
6681                                    struct genl_info *info)
6682 {
6683         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6684
6685         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
6686             !rdev->ops->sched_scan_stop)
6687                 return -EOPNOTSUPP;
6688
6689         return __cfg80211_stop_sched_scan(rdev, false);
6690 }
6691
6692 static int nl80211_start_radar_detection(struct sk_buff *skb,
6693                                          struct genl_info *info)
6694 {
6695         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6696         struct net_device *dev = info->user_ptr[1];
6697         struct wireless_dev *wdev = dev->ieee80211_ptr;
6698         struct cfg80211_chan_def chandef;
6699         enum nl80211_dfs_regions dfs_region;
6700         unsigned int cac_time_ms;
6701         int err;
6702
6703         dfs_region = reg_get_dfs_region(wdev->wiphy);
6704         if (dfs_region == NL80211_DFS_UNSET)
6705                 return -EINVAL;
6706
6707         err = nl80211_parse_chandef(rdev, info, &chandef);
6708         if (err)
6709                 return err;
6710
6711         if (netif_carrier_ok(dev))
6712                 return -EBUSY;
6713
6714         if (wdev->cac_started)
6715                 return -EBUSY;
6716
6717         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef,
6718                                             wdev->iftype);
6719         if (err < 0)
6720                 return err;
6721
6722         if (err == 0)
6723                 return -EINVAL;
6724
6725         if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef))
6726                 return -EINVAL;
6727
6728         if (!rdev->ops->start_radar_detection)
6729                 return -EOPNOTSUPP;
6730
6731         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
6732         if (WARN_ON(!cac_time_ms))
6733                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
6734
6735         err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
6736         if (!err) {
6737                 wdev->chandef = chandef;
6738                 wdev->cac_started = true;
6739                 wdev->cac_start_time = jiffies;
6740                 wdev->cac_time_ms = cac_time_ms;
6741         }
6742         return err;
6743 }
6744
6745 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
6746 {
6747         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6748         struct net_device *dev = info->user_ptr[1];
6749         struct wireless_dev *wdev = dev->ieee80211_ptr;
6750         struct cfg80211_csa_settings params;
6751         /* csa_attrs is defined static to avoid waste of stack size - this
6752          * function is called under RTNL lock, so this should not be a problem.
6753          */
6754         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
6755         int err;
6756         bool need_new_beacon = false;
6757         int len, i;
6758         u32 cs_count;
6759
6760         if (!rdev->ops->channel_switch ||
6761             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
6762                 return -EOPNOTSUPP;
6763
6764         switch (dev->ieee80211_ptr->iftype) {
6765         case NL80211_IFTYPE_AP:
6766         case NL80211_IFTYPE_P2P_GO:
6767                 need_new_beacon = true;
6768
6769                 /* useless if AP is not running */
6770                 if (!wdev->beacon_interval)
6771                         return -ENOTCONN;
6772                 break;
6773         case NL80211_IFTYPE_ADHOC:
6774                 if (!wdev->ssid_len)
6775                         return -ENOTCONN;
6776                 break;
6777         case NL80211_IFTYPE_MESH_POINT:
6778                 if (!wdev->mesh_id_len)
6779                         return -ENOTCONN;
6780                 break;
6781         default:
6782                 return -EOPNOTSUPP;
6783         }
6784
6785         memset(&params, 0, sizeof(params));
6786
6787         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
6788             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
6789                 return -EINVAL;
6790
6791         /* only important for AP, IBSS and mesh create IEs internally */
6792         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
6793                 return -EINVAL;
6794
6795         /* Even though the attribute is u32, the specification says
6796          * u8, so let's make sure we don't overflow.
6797          */
6798         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
6799         if (cs_count > 255)
6800                 return -EINVAL;
6801
6802         params.count = cs_count;
6803
6804         if (!need_new_beacon)
6805                 goto skip_beacons;
6806
6807         err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
6808         if (err)
6809                 return err;
6810
6811         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
6812                                info->attrs[NL80211_ATTR_CSA_IES],
6813                                nl80211_policy);
6814         if (err)
6815                 return err;
6816
6817         err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
6818         if (err)
6819                 return err;
6820
6821         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
6822                 return -EINVAL;
6823
6824         len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
6825         if (!len || (len % sizeof(u16)))
6826                 return -EINVAL;
6827
6828         params.n_counter_offsets_beacon = len / sizeof(u16);
6829         if (rdev->wiphy.max_num_csa_counters &&
6830             (params.n_counter_offsets_beacon >
6831              rdev->wiphy.max_num_csa_counters))
6832                 return -EINVAL;
6833
6834         params.counter_offsets_beacon =
6835                 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
6836
6837         /* sanity checks - counters should fit and be the same */
6838         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
6839                 u16 offset = params.counter_offsets_beacon[i];
6840
6841                 if (offset >= params.beacon_csa.tail_len)
6842                         return -EINVAL;
6843
6844                 if (params.beacon_csa.tail[offset] != params.count)
6845                         return -EINVAL;
6846         }
6847
6848         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
6849                 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
6850                 if (!len || (len % sizeof(u16)))
6851                         return -EINVAL;
6852
6853                 params.n_counter_offsets_presp = len / sizeof(u16);
6854                 if (rdev->wiphy.max_num_csa_counters &&
6855                     (params.n_counter_offsets_beacon >
6856                      rdev->wiphy.max_num_csa_counters))
6857                         return -EINVAL;
6858
6859                 params.counter_offsets_presp =
6860                         nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
6861
6862                 /* sanity checks - counters should fit and be the same */
6863                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
6864                         u16 offset = params.counter_offsets_presp[i];
6865
6866                         if (offset >= params.beacon_csa.probe_resp_len)
6867                                 return -EINVAL;
6868
6869                         if (params.beacon_csa.probe_resp[offset] !=
6870                             params.count)
6871                                 return -EINVAL;
6872                 }
6873         }
6874
6875 skip_beacons:
6876         err = nl80211_parse_chandef(rdev, info, &params.chandef);
6877         if (err)
6878                 return err;
6879
6880         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
6881                                            wdev->iftype))
6882                 return -EINVAL;
6883
6884         err = cfg80211_chandef_dfs_required(wdev->wiphy,
6885                                             &params.chandef,
6886                                             wdev->iftype);
6887         if (err < 0)
6888                 return err;
6889
6890         if (err > 0)
6891                 params.radar_required = true;
6892
6893         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
6894                 params.block_tx = true;
6895
6896         wdev_lock(wdev);
6897         err = rdev_channel_switch(rdev, dev, &params);
6898         wdev_unlock(wdev);
6899
6900         return err;
6901 }
6902
6903 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
6904                             u32 seq, int flags,
6905                             struct cfg80211_registered_device *rdev,
6906                             struct wireless_dev *wdev,
6907                             struct cfg80211_internal_bss *intbss)
6908 {
6909         struct cfg80211_bss *res = &intbss->pub;
6910         const struct cfg80211_bss_ies *ies;
6911         void *hdr;
6912         struct nlattr *bss;
6913
6914         ASSERT_WDEV_LOCK(wdev);
6915
6916         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6917                              NL80211_CMD_NEW_SCAN_RESULTS);
6918         if (!hdr)
6919                 return -1;
6920
6921         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
6922
6923         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
6924                 goto nla_put_failure;
6925         if (wdev->netdev &&
6926             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
6927                 goto nla_put_failure;
6928         if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
6929                               NL80211_ATTR_PAD))
6930                 goto nla_put_failure;
6931
6932         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
6933         if (!bss)
6934                 goto nla_put_failure;
6935         if ((!is_zero_ether_addr(res->bssid) &&
6936              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
6937                 goto nla_put_failure;
6938
6939         rcu_read_lock();
6940         /* indicate whether we have probe response data or not */
6941         if (rcu_access_pointer(res->proberesp_ies) &&
6942             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
6943                 goto fail_unlock_rcu;
6944
6945         /* this pointer prefers to be pointed to probe response data
6946          * but is always valid
6947          */
6948         ies = rcu_dereference(res->ies);
6949         if (ies) {
6950                 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
6951                                       NL80211_BSS_PAD))
6952                         goto fail_unlock_rcu;
6953                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
6954                                         ies->len, ies->data))
6955                         goto fail_unlock_rcu;
6956         }
6957
6958         /* and this pointer is always (unless driver didn't know) beacon data */
6959         ies = rcu_dereference(res->beacon_ies);
6960         if (ies && ies->from_beacon) {
6961                 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
6962                                       NL80211_BSS_PAD))
6963                         goto fail_unlock_rcu;
6964                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
6965                                         ies->len, ies->data))
6966                         goto fail_unlock_rcu;
6967         }
6968         rcu_read_unlock();
6969
6970         if (res->beacon_interval &&
6971             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
6972                 goto nla_put_failure;
6973         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
6974             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
6975             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
6976             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
6977                         jiffies_to_msecs(jiffies - intbss->ts)))
6978                 goto nla_put_failure;
6979
6980         if (intbss->ts_boottime &&
6981             nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
6982                               intbss->ts_boottime, NL80211_BSS_PAD))
6983                 goto nla_put_failure;
6984
6985         switch (rdev->wiphy.signal_type) {
6986         case CFG80211_SIGNAL_TYPE_MBM:
6987                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
6988                         goto nla_put_failure;
6989                 break;
6990         case CFG80211_SIGNAL_TYPE_UNSPEC:
6991                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
6992                         goto nla_put_failure;
6993                 break;
6994         default:
6995                 break;
6996         }
6997
6998         switch (wdev->iftype) {
6999         case NL80211_IFTYPE_P2P_CLIENT:
7000         case NL80211_IFTYPE_STATION:
7001                 if (intbss == wdev->current_bss &&
7002                     nla_put_u32(msg, NL80211_BSS_STATUS,
7003                                 NL80211_BSS_STATUS_ASSOCIATED))
7004                         goto nla_put_failure;
7005                 break;
7006         case NL80211_IFTYPE_ADHOC:
7007                 if (intbss == wdev->current_bss &&
7008                     nla_put_u32(msg, NL80211_BSS_STATUS,
7009                                 NL80211_BSS_STATUS_IBSS_JOINED))
7010                         goto nla_put_failure;
7011                 break;
7012         default:
7013                 break;
7014         }
7015
7016         nla_nest_end(msg, bss);
7017
7018         genlmsg_end(msg, hdr);
7019         return 0;
7020
7021  fail_unlock_rcu:
7022         rcu_read_unlock();
7023  nla_put_failure:
7024         genlmsg_cancel(msg, hdr);
7025         return -EMSGSIZE;
7026 }
7027
7028 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
7029 {
7030         struct cfg80211_registered_device *rdev;
7031         struct cfg80211_internal_bss *scan;
7032         struct wireless_dev *wdev;
7033         int start = cb->args[2], idx = 0;
7034         int err;
7035
7036         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
7037         if (err)
7038                 return err;
7039
7040         wdev_lock(wdev);
7041         spin_lock_bh(&rdev->bss_lock);
7042         cfg80211_bss_expire(rdev);
7043
7044         cb->seq = rdev->bss_generation;
7045
7046         list_for_each_entry(scan, &rdev->bss_list, list) {
7047                 if (++idx <= start)
7048                         continue;
7049                 if (nl80211_send_bss(skb, cb,
7050                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
7051                                 rdev, wdev, scan) < 0) {
7052                         idx--;
7053                         break;
7054                 }
7055         }
7056
7057         spin_unlock_bh(&rdev->bss_lock);
7058         wdev_unlock(wdev);
7059
7060         cb->args[2] = idx;
7061         nl80211_finish_wdev_dump(rdev);
7062
7063         return skb->len;
7064 }
7065
7066 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
7067                                int flags, struct net_device *dev,
7068                                bool allow_radio_stats,
7069                                struct survey_info *survey)
7070 {
7071         void *hdr;
7072         struct nlattr *infoattr;
7073
7074         /* skip radio stats if userspace didn't request them */
7075         if (!survey->channel && !allow_radio_stats)
7076                 return 0;
7077
7078         hdr = nl80211hdr_put(msg, portid, seq, flags,
7079                              NL80211_CMD_NEW_SURVEY_RESULTS);
7080         if (!hdr)
7081                 return -ENOMEM;
7082
7083         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
7084                 goto nla_put_failure;
7085
7086         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
7087         if (!infoattr)
7088                 goto nla_put_failure;
7089
7090         if (survey->channel &&
7091             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
7092                         survey->channel->center_freq))
7093                 goto nla_put_failure;
7094
7095         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
7096             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
7097                 goto nla_put_failure;
7098         if ((survey->filled & SURVEY_INFO_IN_USE) &&
7099             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
7100                 goto nla_put_failure;
7101         if ((survey->filled & SURVEY_INFO_TIME) &&
7102             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
7103                         survey->time, NL80211_SURVEY_INFO_PAD))
7104                 goto nla_put_failure;
7105         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
7106             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
7107                               survey->time_busy, NL80211_SURVEY_INFO_PAD))
7108                 goto nla_put_failure;
7109         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
7110             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
7111                               survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
7112                 goto nla_put_failure;
7113         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
7114             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
7115                               survey->time_rx, NL80211_SURVEY_INFO_PAD))
7116                 goto nla_put_failure;
7117         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
7118             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
7119                               survey->time_tx, NL80211_SURVEY_INFO_PAD))
7120                 goto nla_put_failure;
7121         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
7122             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
7123                               survey->time_scan, NL80211_SURVEY_INFO_PAD))
7124                 goto nla_put_failure;
7125
7126         nla_nest_end(msg, infoattr);
7127
7128         genlmsg_end(msg, hdr);
7129         return 0;
7130
7131  nla_put_failure:
7132         genlmsg_cancel(msg, hdr);
7133         return -EMSGSIZE;
7134 }
7135
7136 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
7137 {
7138         struct survey_info survey;
7139         struct cfg80211_registered_device *rdev;
7140         struct wireless_dev *wdev;
7141         int survey_idx = cb->args[2];
7142         int res;
7143         bool radio_stats;
7144
7145         res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
7146         if (res)
7147                 return res;
7148
7149         /* prepare_wdev_dump parsed the attributes */
7150         radio_stats = nl80211_fam.attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
7151
7152         if (!wdev->netdev) {
7153                 res = -EINVAL;
7154                 goto out_err;
7155         }
7156
7157         if (!rdev->ops->dump_survey) {
7158                 res = -EOPNOTSUPP;
7159                 goto out_err;
7160         }
7161
7162         while (1) {
7163                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
7164                 if (res == -ENOENT)
7165                         break;
7166                 if (res)
7167                         goto out_err;
7168
7169                 /* don't send disabled channels, but do send non-channel data */
7170                 if (survey.channel &&
7171                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
7172                         survey_idx++;
7173                         continue;
7174                 }
7175
7176                 if (nl80211_send_survey(skb,
7177                                 NETLINK_CB(cb->skb).portid,
7178                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
7179                                 wdev->netdev, radio_stats, &survey) < 0)
7180                         goto out;
7181                 survey_idx++;
7182         }
7183
7184  out:
7185         cb->args[2] = survey_idx;
7186         res = skb->len;
7187  out_err:
7188         nl80211_finish_wdev_dump(rdev);
7189         return res;
7190 }
7191
7192 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
7193 {
7194         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
7195                                   NL80211_WPA_VERSION_2));
7196 }
7197
7198 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
7199 {
7200         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7201         struct net_device *dev = info->user_ptr[1];
7202         struct ieee80211_channel *chan;
7203         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
7204         int err, ssid_len, ie_len = 0, sae_data_len = 0;
7205         enum nl80211_auth_type auth_type;
7206         struct key_parse key;
7207         bool local_state_change;
7208
7209         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7210                 return -EINVAL;
7211
7212         if (!info->attrs[NL80211_ATTR_MAC])
7213                 return -EINVAL;
7214
7215         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
7216                 return -EINVAL;
7217
7218         if (!info->attrs[NL80211_ATTR_SSID])
7219                 return -EINVAL;
7220
7221         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
7222                 return -EINVAL;
7223
7224         err = nl80211_parse_key(info, &key);
7225         if (err)
7226                 return err;
7227
7228         if (key.idx >= 0) {
7229                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
7230                         return -EINVAL;
7231                 if (!key.p.key || !key.p.key_len)
7232                         return -EINVAL;
7233                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
7234                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
7235                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
7236                      key.p.key_len != WLAN_KEY_LEN_WEP104))
7237                         return -EINVAL;
7238                 if (key.idx > 4)
7239                         return -EINVAL;
7240         } else {
7241                 key.p.key_len = 0;
7242                 key.p.key = NULL;
7243         }
7244
7245         if (key.idx >= 0) {
7246                 int i;
7247                 bool ok = false;
7248                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
7249                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
7250                                 ok = true;
7251                                 break;
7252                         }
7253                 }
7254                 if (!ok)
7255                         return -EINVAL;
7256         }
7257
7258         if (!rdev->ops->auth)
7259                 return -EOPNOTSUPP;
7260
7261         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7262             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7263                 return -EOPNOTSUPP;
7264
7265         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7266         chan = nl80211_get_valid_chan(&rdev->wiphy,
7267                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7268         if (!chan)
7269                 return -EINVAL;
7270
7271         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7272         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7273
7274         if (info->attrs[NL80211_ATTR_IE]) {
7275                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7276                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7277         }
7278
7279         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
7280         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
7281                 return -EINVAL;
7282
7283         if (auth_type == NL80211_AUTHTYPE_SAE &&
7284             !info->attrs[NL80211_ATTR_SAE_DATA])
7285                 return -EINVAL;
7286
7287         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
7288                 if (auth_type != NL80211_AUTHTYPE_SAE)
7289                         return -EINVAL;
7290                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
7291                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
7292                 /* need to include at least Auth Transaction and Status Code */
7293                 if (sae_data_len < 4)
7294                         return -EINVAL;
7295         }
7296
7297         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
7298
7299         /*
7300          * Since we no longer track auth state, ignore
7301          * requests to only change local state.
7302          */
7303         if (local_state_change)
7304                 return 0;
7305
7306         wdev_lock(dev->ieee80211_ptr);
7307         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
7308                                  ssid, ssid_len, ie, ie_len,
7309                                  key.p.key, key.p.key_len, key.idx,
7310                                  sae_data, sae_data_len);
7311         wdev_unlock(dev->ieee80211_ptr);
7312         return err;
7313 }
7314
7315 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
7316                                    struct genl_info *info,
7317                                    struct cfg80211_crypto_settings *settings,
7318                                    int cipher_limit)
7319 {
7320         memset(settings, 0, sizeof(*settings));
7321
7322         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
7323
7324         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
7325                 u16 proto;
7326                 proto = nla_get_u16(
7327                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
7328                 settings->control_port_ethertype = cpu_to_be16(proto);
7329                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
7330                     proto != ETH_P_PAE)
7331                         return -EINVAL;
7332                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
7333                         settings->control_port_no_encrypt = true;
7334         } else
7335                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
7336
7337         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
7338                 void *data;
7339                 int len, i;
7340
7341                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
7342                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
7343                 settings->n_ciphers_pairwise = len / sizeof(u32);
7344
7345                 if (len % sizeof(u32))
7346                         return -EINVAL;
7347
7348                 if (settings->n_ciphers_pairwise > cipher_limit)
7349                         return -EINVAL;
7350
7351                 memcpy(settings->ciphers_pairwise, data, len);
7352
7353                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
7354                         if (!cfg80211_supported_cipher_suite(
7355                                         &rdev->wiphy,
7356                                         settings->ciphers_pairwise[i]))
7357                                 return -EINVAL;
7358         }
7359
7360         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
7361                 settings->cipher_group =
7362                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
7363                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
7364                                                      settings->cipher_group))
7365                         return -EINVAL;
7366         }
7367
7368         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
7369                 settings->wpa_versions =
7370                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
7371                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
7372                         return -EINVAL;
7373         }
7374
7375         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
7376                 void *data;
7377                 int len;
7378
7379                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
7380                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
7381                 settings->n_akm_suites = len / sizeof(u32);
7382
7383                 if (len % sizeof(u32))
7384                         return -EINVAL;
7385
7386                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
7387                         return -EINVAL;
7388
7389                 memcpy(settings->akm_suites, data, len);
7390         }
7391
7392         return 0;
7393 }
7394
7395 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
7396 {
7397         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7398         struct net_device *dev = info->user_ptr[1];
7399         struct ieee80211_channel *chan;
7400         struct cfg80211_assoc_request req = {};
7401         const u8 *bssid, *ssid;
7402         int err, ssid_len = 0;
7403
7404         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7405                 return -EINVAL;
7406
7407         if (!info->attrs[NL80211_ATTR_MAC] ||
7408             !info->attrs[NL80211_ATTR_SSID] ||
7409             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
7410                 return -EINVAL;
7411
7412         if (!rdev->ops->assoc)
7413                 return -EOPNOTSUPP;
7414
7415         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7416             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7417                 return -EOPNOTSUPP;
7418
7419         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7420
7421         chan = nl80211_get_valid_chan(&rdev->wiphy,
7422                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7423         if (!chan)
7424                 return -EINVAL;
7425
7426         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7427         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7428
7429         if (info->attrs[NL80211_ATTR_IE]) {
7430                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7431                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7432         }
7433
7434         if (info->attrs[NL80211_ATTR_USE_MFP]) {
7435                 enum nl80211_mfp mfp =
7436                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
7437                 if (mfp == NL80211_MFP_REQUIRED)
7438                         req.use_mfp = true;
7439                 else if (mfp != NL80211_MFP_NO)
7440                         return -EINVAL;
7441         }
7442
7443         if (info->attrs[NL80211_ATTR_PREV_BSSID])
7444                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
7445
7446         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
7447                 req.flags |= ASSOC_REQ_DISABLE_HT;
7448
7449         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7450                 memcpy(&req.ht_capa_mask,
7451                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7452                        sizeof(req.ht_capa_mask));
7453
7454         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7455                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7456                         return -EINVAL;
7457                 memcpy(&req.ht_capa,
7458                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7459                        sizeof(req.ht_capa));
7460         }
7461
7462         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
7463                 req.flags |= ASSOC_REQ_DISABLE_VHT;
7464
7465         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7466                 memcpy(&req.vht_capa_mask,
7467                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
7468                        sizeof(req.vht_capa_mask));
7469
7470         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
7471                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7472                         return -EINVAL;
7473                 memcpy(&req.vht_capa,
7474                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
7475                        sizeof(req.vht_capa));
7476         }
7477
7478         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
7479                 if (!((rdev->wiphy.features &
7480                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
7481                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
7482                     !wiphy_ext_feature_isset(&rdev->wiphy,
7483                                              NL80211_EXT_FEATURE_RRM))
7484                         return -EINVAL;
7485                 req.flags |= ASSOC_REQ_USE_RRM;
7486         }
7487
7488         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
7489         if (!err) {
7490                 wdev_lock(dev->ieee80211_ptr);
7491                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
7492                                           ssid, ssid_len, &req);
7493                 wdev_unlock(dev->ieee80211_ptr);
7494         }
7495
7496         return err;
7497 }
7498
7499 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
7500 {
7501         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7502         struct net_device *dev = info->user_ptr[1];
7503         const u8 *ie = NULL, *bssid;
7504         int ie_len = 0, err;
7505         u16 reason_code;
7506         bool local_state_change;
7507
7508         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7509                 return -EINVAL;
7510
7511         if (!info->attrs[NL80211_ATTR_MAC])
7512                 return -EINVAL;
7513
7514         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7515                 return -EINVAL;
7516
7517         if (!rdev->ops->deauth)
7518                 return -EOPNOTSUPP;
7519
7520         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7521             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7522                 return -EOPNOTSUPP;
7523
7524         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7525
7526         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7527         if (reason_code == 0) {
7528                 /* Reason Code 0 is reserved */
7529                 return -EINVAL;
7530         }
7531
7532         if (info->attrs[NL80211_ATTR_IE]) {
7533                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7534                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7535         }
7536
7537         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
7538
7539         wdev_lock(dev->ieee80211_ptr);
7540         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
7541                                    local_state_change);
7542         wdev_unlock(dev->ieee80211_ptr);
7543         return err;
7544 }
7545
7546 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
7547 {
7548         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7549         struct net_device *dev = info->user_ptr[1];
7550         const u8 *ie = NULL, *bssid;
7551         int ie_len = 0, err;
7552         u16 reason_code;
7553         bool local_state_change;
7554
7555         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7556                 return -EINVAL;
7557
7558         if (!info->attrs[NL80211_ATTR_MAC])
7559                 return -EINVAL;
7560
7561         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7562                 return -EINVAL;
7563
7564         if (!rdev->ops->disassoc)
7565                 return -EOPNOTSUPP;
7566
7567         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7568             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7569                 return -EOPNOTSUPP;
7570
7571         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7572
7573         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7574         if (reason_code == 0) {
7575                 /* Reason Code 0 is reserved */
7576                 return -EINVAL;
7577         }
7578
7579         if (info->attrs[NL80211_ATTR_IE]) {
7580                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7581                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7582         }
7583
7584         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
7585
7586         wdev_lock(dev->ieee80211_ptr);
7587         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
7588                                      local_state_change);
7589         wdev_unlock(dev->ieee80211_ptr);
7590         return err;
7591 }
7592
7593 static bool
7594 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
7595                          int mcast_rate[NUM_NL80211_BANDS],
7596                          int rateval)
7597 {
7598         struct wiphy *wiphy = &rdev->wiphy;
7599         bool found = false;
7600         int band, i;
7601
7602         for (band = 0; band < NUM_NL80211_BANDS; band++) {
7603                 struct ieee80211_supported_band *sband;
7604
7605                 sband = wiphy->bands[band];
7606                 if (!sband)
7607                         continue;
7608
7609                 for (i = 0; i < sband->n_bitrates; i++) {
7610                         if (sband->bitrates[i].bitrate == rateval) {
7611                                 mcast_rate[band] = i + 1;
7612                                 found = true;
7613                                 break;
7614                         }
7615                 }
7616         }
7617
7618         return found;
7619 }
7620
7621 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
7622 {
7623         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7624         struct net_device *dev = info->user_ptr[1];
7625         struct cfg80211_ibss_params ibss;
7626         struct wiphy *wiphy;
7627         struct cfg80211_cached_keys *connkeys = NULL;
7628         int err;
7629
7630         memset(&ibss, 0, sizeof(ibss));
7631
7632         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7633                 return -EINVAL;
7634
7635         if (!info->attrs[NL80211_ATTR_SSID] ||
7636             !nla_len(info->attrs[NL80211_ATTR_SSID]))
7637                 return -EINVAL;
7638
7639         ibss.beacon_interval = 100;
7640
7641         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
7642                 ibss.beacon_interval =
7643                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
7644                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
7645                         return -EINVAL;
7646         }
7647
7648         if (!rdev->ops->join_ibss)
7649                 return -EOPNOTSUPP;
7650
7651         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
7652                 return -EOPNOTSUPP;
7653
7654         wiphy = &rdev->wiphy;
7655
7656         if (info->attrs[NL80211_ATTR_MAC]) {
7657                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7658
7659                 if (!is_valid_ether_addr(ibss.bssid))
7660                         return -EINVAL;
7661         }
7662         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7663         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7664
7665         if (info->attrs[NL80211_ATTR_IE]) {
7666                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7667                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7668         }
7669
7670         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
7671         if (err)
7672                 return err;
7673
7674         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
7675                                      NL80211_IFTYPE_ADHOC))
7676                 return -EINVAL;
7677
7678         switch (ibss.chandef.width) {
7679         case NL80211_CHAN_WIDTH_5:
7680         case NL80211_CHAN_WIDTH_10:
7681         case NL80211_CHAN_WIDTH_20_NOHT:
7682                 break;
7683         case NL80211_CHAN_WIDTH_20:
7684         case NL80211_CHAN_WIDTH_40:
7685                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
7686                         return -EINVAL;
7687                 break;
7688         case NL80211_CHAN_WIDTH_80:
7689         case NL80211_CHAN_WIDTH_80P80:
7690         case NL80211_CHAN_WIDTH_160:
7691                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
7692                         return -EINVAL;
7693                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
7694                                              NL80211_EXT_FEATURE_VHT_IBSS))
7695                         return -EINVAL;
7696                 break;
7697         default:
7698                 return -EINVAL;
7699         }
7700
7701         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
7702         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
7703
7704         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
7705                 u8 *rates =
7706                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7707                 int n_rates =
7708                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7709                 struct ieee80211_supported_band *sband =
7710                         wiphy->bands[ibss.chandef.chan->band];
7711
7712                 err = ieee80211_get_ratemask(sband, rates, n_rates,
7713                                              &ibss.basic_rates);
7714                 if (err)
7715                         return err;
7716         }
7717
7718         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7719                 memcpy(&ibss.ht_capa_mask,
7720                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7721                        sizeof(ibss.ht_capa_mask));
7722
7723         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7724                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7725                         return -EINVAL;
7726                 memcpy(&ibss.ht_capa,
7727                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7728                        sizeof(ibss.ht_capa));
7729         }
7730
7731         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
7732             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
7733                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
7734                 return -EINVAL;
7735
7736         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
7737                 bool no_ht = false;
7738
7739                 connkeys = nl80211_parse_connkeys(rdev,
7740                                           info->attrs[NL80211_ATTR_KEYS],
7741                                           &no_ht);
7742                 if (IS_ERR(connkeys))
7743                         return PTR_ERR(connkeys);
7744
7745                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
7746                     no_ht) {
7747                         kzfree(connkeys);
7748                         return -EINVAL;
7749                 }
7750         }
7751
7752         ibss.control_port =
7753                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
7754
7755         ibss.userspace_handles_dfs =
7756                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
7757
7758         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
7759         if (err)
7760                 kzfree(connkeys);
7761         return err;
7762 }
7763
7764 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
7765 {
7766         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7767         struct net_device *dev = info->user_ptr[1];
7768
7769         if (!rdev->ops->leave_ibss)
7770                 return -EOPNOTSUPP;
7771
7772         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
7773                 return -EOPNOTSUPP;
7774
7775         return cfg80211_leave_ibss(rdev, dev, false);
7776 }
7777
7778 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
7779 {
7780         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7781         struct net_device *dev = info->user_ptr[1];
7782         int mcast_rate[NUM_NL80211_BANDS];
7783         u32 nla_rate;
7784         int err;
7785
7786         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
7787             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
7788             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
7789                 return -EOPNOTSUPP;
7790
7791         if (!rdev->ops->set_mcast_rate)
7792                 return -EOPNOTSUPP;
7793
7794         memset(mcast_rate, 0, sizeof(mcast_rate));
7795
7796         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
7797                 return -EINVAL;
7798
7799         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
7800         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
7801                 return -EINVAL;
7802
7803         err = rdev_set_mcast_rate(rdev, dev, mcast_rate);
7804
7805         return err;
7806 }
7807
7808 static struct sk_buff *
7809 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
7810                             struct wireless_dev *wdev, int approxlen,
7811                             u32 portid, u32 seq, enum nl80211_commands cmd,
7812                             enum nl80211_attrs attr,
7813                             const struct nl80211_vendor_cmd_info *info,
7814                             gfp_t gfp)
7815 {
7816         struct sk_buff *skb;
7817         void *hdr;
7818         struct nlattr *data;
7819
7820         skb = nlmsg_new(approxlen + 100, gfp);
7821         if (!skb)
7822                 return NULL;
7823
7824         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
7825         if (!hdr) {
7826                 kfree_skb(skb);
7827                 return NULL;
7828         }
7829
7830         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
7831                 goto nla_put_failure;
7832
7833         if (info) {
7834                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
7835                                 info->vendor_id))
7836                         goto nla_put_failure;
7837                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
7838                                 info->subcmd))
7839                         goto nla_put_failure;
7840         }
7841
7842         if (wdev) {
7843                 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
7844                                       wdev_id(wdev), NL80211_ATTR_PAD))
7845                         goto nla_put_failure;
7846                 if (wdev->netdev &&
7847                     nla_put_u32(skb, NL80211_ATTR_IFINDEX,
7848                                 wdev->netdev->ifindex))
7849                         goto nla_put_failure;
7850         }
7851
7852         data = nla_nest_start(skb, attr);
7853
7854         ((void **)skb->cb)[0] = rdev;
7855         ((void **)skb->cb)[1] = hdr;
7856         ((void **)skb->cb)[2] = data;
7857
7858         return skb;
7859
7860  nla_put_failure:
7861         kfree_skb(skb);
7862         return NULL;
7863 }
7864
7865 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
7866                                            struct wireless_dev *wdev,
7867                                            enum nl80211_commands cmd,
7868                                            enum nl80211_attrs attr,
7869                                            int vendor_event_idx,
7870                                            int approxlen, gfp_t gfp)
7871 {
7872         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
7873         const struct nl80211_vendor_cmd_info *info;
7874
7875         switch (cmd) {
7876         case NL80211_CMD_TESTMODE:
7877                 if (WARN_ON(vendor_event_idx != -1))
7878                         return NULL;
7879                 info = NULL;
7880                 break;
7881         case NL80211_CMD_VENDOR:
7882                 if (WARN_ON(vendor_event_idx < 0 ||
7883                             vendor_event_idx >= wiphy->n_vendor_events))
7884                         return NULL;
7885                 info = &wiphy->vendor_events[vendor_event_idx];
7886                 break;
7887         default:
7888                 WARN_ON(1);
7889                 return NULL;
7890         }
7891
7892         return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, 0, 0,
7893                                            cmd, attr, info, gfp);
7894 }
7895 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
7896
7897 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
7898 {
7899         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
7900         void *hdr = ((void **)skb->cb)[1];
7901         struct nlattr *data = ((void **)skb->cb)[2];
7902         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
7903
7904         /* clear CB data for netlink core to own from now on */
7905         memset(skb->cb, 0, sizeof(skb->cb));
7906
7907         nla_nest_end(skb, data);
7908         genlmsg_end(skb, hdr);
7909
7910         if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
7911                 mcgrp = NL80211_MCGRP_VENDOR;
7912
7913         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
7914                                 mcgrp, gfp);
7915 }
7916 EXPORT_SYMBOL(__cfg80211_send_event_skb);
7917
7918 #ifdef CONFIG_NL80211_TESTMODE
7919 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
7920 {
7921         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7922         struct wireless_dev *wdev =
7923                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
7924         int err;
7925
7926         if (!rdev->ops->testmode_cmd)
7927                 return -EOPNOTSUPP;
7928
7929         if (IS_ERR(wdev)) {
7930                 err = PTR_ERR(wdev);
7931                 if (err != -EINVAL)
7932                         return err;
7933                 wdev = NULL;
7934         } else if (wdev->wiphy != &rdev->wiphy) {
7935                 return -EINVAL;
7936         }
7937
7938         if (!info->attrs[NL80211_ATTR_TESTDATA])
7939                 return -EINVAL;
7940
7941         rdev->cur_cmd_info = info;
7942         err = rdev_testmode_cmd(rdev, wdev,
7943                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
7944                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
7945         rdev->cur_cmd_info = NULL;
7946
7947         return err;
7948 }
7949
7950 static int nl80211_testmode_dump(struct sk_buff *skb,
7951                                  struct netlink_callback *cb)
7952 {
7953         struct cfg80211_registered_device *rdev;
7954         int err;
7955         long phy_idx;
7956         void *data = NULL;
7957         int data_len = 0;
7958
7959         rtnl_lock();
7960
7961         if (cb->args[0]) {
7962                 /*
7963                  * 0 is a valid index, but not valid for args[0],
7964                  * so we need to offset by 1.
7965                  */
7966                 phy_idx = cb->args[0] - 1;
7967         } else {
7968                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
7969                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
7970                                   nl80211_policy);
7971                 if (err)
7972                         goto out_err;
7973
7974                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
7975                                                   nl80211_fam.attrbuf);
7976                 if (IS_ERR(rdev)) {
7977                         err = PTR_ERR(rdev);
7978                         goto out_err;
7979                 }
7980                 phy_idx = rdev->wiphy_idx;
7981                 rdev = NULL;
7982
7983                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
7984                         cb->args[1] =
7985                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
7986         }
7987
7988         if (cb->args[1]) {
7989                 data = nla_data((void *)cb->args[1]);
7990                 data_len = nla_len((void *)cb->args[1]);
7991         }
7992
7993         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
7994         if (!rdev) {
7995                 err = -ENOENT;
7996                 goto out_err;
7997         }
7998
7999         if (!rdev->ops->testmode_dump) {
8000                 err = -EOPNOTSUPP;
8001                 goto out_err;
8002         }
8003
8004         while (1) {
8005                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
8006                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
8007                                            NL80211_CMD_TESTMODE);
8008                 struct nlattr *tmdata;
8009
8010                 if (!hdr)
8011                         break;
8012
8013                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
8014                         genlmsg_cancel(skb, hdr);
8015                         break;
8016                 }
8017
8018                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
8019                 if (!tmdata) {
8020                         genlmsg_cancel(skb, hdr);
8021                         break;
8022                 }
8023                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
8024                 nla_nest_end(skb, tmdata);
8025
8026                 if (err == -ENOBUFS || err == -ENOENT) {
8027                         genlmsg_cancel(skb, hdr);
8028                         break;
8029                 } else if (err) {
8030                         genlmsg_cancel(skb, hdr);
8031                         goto out_err;
8032                 }
8033
8034                 genlmsg_end(skb, hdr);
8035         }
8036
8037         err = skb->len;
8038         /* see above */
8039         cb->args[0] = phy_idx + 1;
8040  out_err:
8041         rtnl_unlock();
8042         return err;
8043 }
8044 #endif
8045
8046 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
8047 {
8048         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8049         struct net_device *dev = info->user_ptr[1];
8050         struct cfg80211_connect_params connect;
8051         struct wiphy *wiphy;
8052         struct cfg80211_cached_keys *connkeys = NULL;
8053         int err;
8054
8055         memset(&connect, 0, sizeof(connect));
8056
8057         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8058                 return -EINVAL;
8059
8060         if (!info->attrs[NL80211_ATTR_SSID] ||
8061             !nla_len(info->attrs[NL80211_ATTR_SSID]))
8062                 return -EINVAL;
8063
8064         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
8065                 connect.auth_type =
8066                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
8067                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
8068                                              NL80211_CMD_CONNECT))
8069                         return -EINVAL;
8070         } else
8071                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
8072
8073         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
8074
8075         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
8076                                       NL80211_MAX_NR_CIPHER_SUITES);
8077         if (err)
8078                 return err;
8079
8080         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8081             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8082                 return -EOPNOTSUPP;
8083
8084         wiphy = &rdev->wiphy;
8085
8086         connect.bg_scan_period = -1;
8087         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
8088                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
8089                 connect.bg_scan_period =
8090                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
8091         }
8092
8093         if (info->attrs[NL80211_ATTR_MAC])
8094                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8095         else if (info->attrs[NL80211_ATTR_MAC_HINT])
8096                 connect.bssid_hint =
8097                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
8098         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8099         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8100
8101         if (info->attrs[NL80211_ATTR_IE]) {
8102                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8103                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8104         }
8105
8106         if (info->attrs[NL80211_ATTR_USE_MFP]) {
8107                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
8108                 if (connect.mfp != NL80211_MFP_REQUIRED &&
8109                     connect.mfp != NL80211_MFP_NO)
8110                         return -EINVAL;
8111         } else {
8112                 connect.mfp = NL80211_MFP_NO;
8113         }
8114
8115         if (info->attrs[NL80211_ATTR_PREV_BSSID])
8116                 connect.prev_bssid =
8117                         nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
8118
8119         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8120                 connect.channel = nl80211_get_valid_chan(
8121                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8122                 if (!connect.channel)
8123                         return -EINVAL;
8124         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
8125                 connect.channel_hint = nl80211_get_valid_chan(
8126                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
8127                 if (!connect.channel_hint)
8128                         return -EINVAL;
8129         }
8130
8131         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
8132                 connkeys = nl80211_parse_connkeys(rdev,
8133                                           info->attrs[NL80211_ATTR_KEYS], NULL);
8134                 if (IS_ERR(connkeys))
8135                         return PTR_ERR(connkeys);
8136         }
8137
8138         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
8139                 connect.flags |= ASSOC_REQ_DISABLE_HT;
8140
8141         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8142                 memcpy(&connect.ht_capa_mask,
8143                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8144                        sizeof(connect.ht_capa_mask));
8145
8146         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8147                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
8148                         kzfree(connkeys);
8149                         return -EINVAL;
8150                 }
8151                 memcpy(&connect.ht_capa,
8152                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8153                        sizeof(connect.ht_capa));
8154         }
8155
8156         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
8157                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
8158
8159         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8160                 memcpy(&connect.vht_capa_mask,
8161                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
8162                        sizeof(connect.vht_capa_mask));
8163
8164         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
8165                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
8166                         kzfree(connkeys);
8167                         return -EINVAL;
8168                 }
8169                 memcpy(&connect.vht_capa,
8170                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
8171                        sizeof(connect.vht_capa));
8172         }
8173
8174         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
8175                 if (!((rdev->wiphy.features &
8176                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
8177                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
8178                     !wiphy_ext_feature_isset(&rdev->wiphy,
8179                                              NL80211_EXT_FEATURE_RRM)) {
8180                         kzfree(connkeys);
8181                         return -EINVAL;
8182                 }
8183                 connect.flags |= ASSOC_REQ_USE_RRM;
8184         }
8185
8186         connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
8187         if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
8188                 kzfree(connkeys);
8189                 return -EOPNOTSUPP;
8190         }
8191
8192         if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
8193                 /* bss selection makes no sense if bssid is set */
8194                 if (connect.bssid) {
8195                         kzfree(connkeys);
8196                         return -EINVAL;
8197                 }
8198
8199                 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
8200                                        wiphy, &connect.bss_select);
8201                 if (err) {
8202                         kzfree(connkeys);
8203                         return err;
8204                 }
8205         }
8206
8207         wdev_lock(dev->ieee80211_ptr);
8208         err = cfg80211_connect(rdev, dev, &connect, connkeys,
8209                                connect.prev_bssid);
8210         wdev_unlock(dev->ieee80211_ptr);
8211         if (err)
8212                 kzfree(connkeys);
8213         return err;
8214 }
8215
8216 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
8217 {
8218         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8219         struct net_device *dev = info->user_ptr[1];
8220         u16 reason;
8221         int ret;
8222
8223         if (!info->attrs[NL80211_ATTR_REASON_CODE])
8224                 reason = WLAN_REASON_DEAUTH_LEAVING;
8225         else
8226                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8227
8228         if (reason == 0)
8229                 return -EINVAL;
8230
8231         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8232             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8233                 return -EOPNOTSUPP;
8234
8235         wdev_lock(dev->ieee80211_ptr);
8236         ret = cfg80211_disconnect(rdev, dev, reason, true);
8237         wdev_unlock(dev->ieee80211_ptr);
8238         return ret;
8239 }
8240
8241 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
8242 {
8243         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8244         struct net *net;
8245         int err;
8246
8247         if (info->attrs[NL80211_ATTR_PID]) {
8248                 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
8249
8250                 net = get_net_ns_by_pid(pid);
8251         } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
8252                 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
8253
8254                 net = get_net_ns_by_fd(fd);
8255         } else {
8256                 return -EINVAL;
8257         }
8258
8259         if (IS_ERR(net))
8260                 return PTR_ERR(net);
8261
8262         err = 0;
8263
8264         /* check if anything to do */
8265         if (!net_eq(wiphy_net(&rdev->wiphy), net))
8266                 err = cfg80211_switch_netns(rdev, net);
8267
8268         put_net(net);
8269         return err;
8270 }
8271
8272 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
8273 {
8274         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8275         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
8276                         struct cfg80211_pmksa *pmksa) = NULL;
8277         struct net_device *dev = info->user_ptr[1];
8278         struct cfg80211_pmksa pmksa;
8279
8280         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
8281
8282         if (!info->attrs[NL80211_ATTR_MAC])
8283                 return -EINVAL;
8284
8285         if (!info->attrs[NL80211_ATTR_PMKID])
8286                 return -EINVAL;
8287
8288         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
8289         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8290
8291         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8292             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8293                 return -EOPNOTSUPP;
8294
8295         switch (info->genlhdr->cmd) {
8296         case NL80211_CMD_SET_PMKSA:
8297                 rdev_ops = rdev->ops->set_pmksa;
8298                 break;
8299         case NL80211_CMD_DEL_PMKSA:
8300                 rdev_ops = rdev->ops->del_pmksa;
8301                 break;
8302         default:
8303                 WARN_ON(1);
8304                 break;
8305         }
8306
8307         if (!rdev_ops)
8308                 return -EOPNOTSUPP;
8309
8310         return rdev_ops(&rdev->wiphy, dev, &pmksa);
8311 }
8312
8313 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
8314 {
8315         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8316         struct net_device *dev = info->user_ptr[1];
8317
8318         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8319             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8320                 return -EOPNOTSUPP;
8321
8322         if (!rdev->ops->flush_pmksa)
8323                 return -EOPNOTSUPP;
8324
8325         return rdev_flush_pmksa(rdev, dev);
8326 }
8327
8328 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
8329 {
8330         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8331         struct net_device *dev = info->user_ptr[1];
8332         u8 action_code, dialog_token;
8333         u32 peer_capability = 0;
8334         u16 status_code;
8335         u8 *peer;
8336         bool initiator;
8337
8338         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
8339             !rdev->ops->tdls_mgmt)
8340                 return -EOPNOTSUPP;
8341
8342         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
8343             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
8344             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
8345             !info->attrs[NL80211_ATTR_IE] ||
8346             !info->attrs[NL80211_ATTR_MAC])
8347                 return -EINVAL;
8348
8349         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
8350         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
8351         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
8352         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
8353         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
8354         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
8355                 peer_capability =
8356                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
8357
8358         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
8359                               dialog_token, status_code, peer_capability,
8360                               initiator,
8361                               nla_data(info->attrs[NL80211_ATTR_IE]),
8362                               nla_len(info->attrs[NL80211_ATTR_IE]));
8363 }
8364
8365 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
8366 {
8367         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8368         struct net_device *dev = info->user_ptr[1];
8369         enum nl80211_tdls_operation operation;
8370         u8 *peer;
8371
8372         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
8373             !rdev->ops->tdls_oper)
8374                 return -EOPNOTSUPP;
8375
8376         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
8377             !info->attrs[NL80211_ATTR_MAC])
8378                 return -EINVAL;
8379
8380         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
8381         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
8382
8383         return rdev_tdls_oper(rdev, dev, peer, operation);
8384 }
8385
8386 static int nl80211_remain_on_channel(struct sk_buff *skb,
8387                                      struct genl_info *info)
8388 {
8389         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8390         struct wireless_dev *wdev = info->user_ptr[1];
8391         struct cfg80211_chan_def chandef;
8392         struct sk_buff *msg;
8393         void *hdr;
8394         u64 cookie;
8395         u32 duration;
8396         int err;
8397
8398         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
8399             !info->attrs[NL80211_ATTR_DURATION])
8400                 return -EINVAL;
8401
8402         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
8403
8404         if (!rdev->ops->remain_on_channel ||
8405             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
8406                 return -EOPNOTSUPP;
8407
8408         /*
8409          * We should be on that channel for at least a minimum amount of
8410          * time (10ms) but no longer than the driver supports.
8411          */
8412         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
8413             duration > rdev->wiphy.max_remain_on_channel_duration)
8414                 return -EINVAL;
8415
8416         err = nl80211_parse_chandef(rdev, info, &chandef);
8417         if (err)
8418                 return err;
8419
8420         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8421         if (!msg)
8422                 return -ENOMEM;
8423
8424         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8425                              NL80211_CMD_REMAIN_ON_CHANNEL);
8426         if (!hdr) {
8427                 err = -ENOBUFS;
8428                 goto free_msg;
8429         }
8430
8431         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
8432                                      duration, &cookie);
8433
8434         if (err)
8435                 goto free_msg;
8436
8437         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
8438                               NL80211_ATTR_PAD))
8439                 goto nla_put_failure;
8440
8441         genlmsg_end(msg, hdr);
8442
8443         return genlmsg_reply(msg, info);
8444
8445  nla_put_failure:
8446         err = -ENOBUFS;
8447  free_msg:
8448         nlmsg_free(msg);
8449         return err;
8450 }
8451
8452 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
8453                                             struct genl_info *info)
8454 {
8455         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8456         struct wireless_dev *wdev = info->user_ptr[1];
8457         u64 cookie;
8458
8459         if (!info->attrs[NL80211_ATTR_COOKIE])
8460                 return -EINVAL;
8461
8462         if (!rdev->ops->cancel_remain_on_channel)
8463                 return -EOPNOTSUPP;
8464
8465         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
8466
8467         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
8468 }
8469
8470 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
8471                            u8 *rates, u8 rates_len)
8472 {
8473         u8 i;
8474         u32 mask = 0;
8475
8476         for (i = 0; i < rates_len; i++) {
8477                 int rate = (rates[i] & 0x7f) * 5;
8478                 int ridx;
8479                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
8480                         struct ieee80211_rate *srate =
8481                                 &sband->bitrates[ridx];
8482                         if (rate == srate->bitrate) {
8483                                 mask |= 1 << ridx;
8484                                 break;
8485                         }
8486                 }
8487                 if (ridx == sband->n_bitrates)
8488                         return 0; /* rate not found */
8489         }
8490
8491         return mask;
8492 }
8493
8494 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
8495                                u8 *rates, u8 rates_len,
8496                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
8497 {
8498         u8 i;
8499
8500         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
8501
8502         for (i = 0; i < rates_len; i++) {
8503                 int ridx, rbit;
8504
8505                 ridx = rates[i] / 8;
8506                 rbit = BIT(rates[i] % 8);
8507
8508                 /* check validity */
8509                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
8510                         return false;
8511
8512                 /* check availability */
8513                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
8514                         mcs[ridx] |= rbit;
8515                 else
8516                         return false;
8517         }
8518
8519         return true;
8520 }
8521
8522 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
8523 {
8524         u16 mcs_mask = 0;
8525
8526         switch (vht_mcs_map) {
8527         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
8528                 break;
8529         case IEEE80211_VHT_MCS_SUPPORT_0_7:
8530                 mcs_mask = 0x00FF;
8531                 break;
8532         case IEEE80211_VHT_MCS_SUPPORT_0_8:
8533                 mcs_mask = 0x01FF;
8534                 break;
8535         case IEEE80211_VHT_MCS_SUPPORT_0_9:
8536                 mcs_mask = 0x03FF;
8537                 break;
8538         default:
8539                 break;
8540         }
8541
8542         return mcs_mask;
8543 }
8544
8545 static void vht_build_mcs_mask(u16 vht_mcs_map,
8546                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
8547 {
8548         u8 nss;
8549
8550         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
8551                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
8552                 vht_mcs_map >>= 2;
8553         }
8554 }
8555
8556 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
8557                              struct nl80211_txrate_vht *txrate,
8558                              u16 mcs[NL80211_VHT_NSS_MAX])
8559 {
8560         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
8561         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
8562         u8 i;
8563
8564         if (!sband->vht_cap.vht_supported)
8565                 return false;
8566
8567         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
8568
8569         /* Build vht_mcs_mask from VHT capabilities */
8570         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
8571
8572         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
8573                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
8574                         mcs[i] = txrate->mcs[i];
8575                 else
8576                         return false;
8577         }
8578
8579         return true;
8580 }
8581
8582 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
8583         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
8584                                     .len = NL80211_MAX_SUPP_RATES },
8585         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
8586                                 .len = NL80211_MAX_SUPP_HT_RATES },
8587         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
8588         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
8589 };
8590
8591 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
8592                                        struct genl_info *info)
8593 {
8594         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
8595         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8596         struct cfg80211_bitrate_mask mask;
8597         int rem, i;
8598         struct net_device *dev = info->user_ptr[1];
8599         struct nlattr *tx_rates;
8600         struct ieee80211_supported_band *sband;
8601         u16 vht_tx_mcs_map;
8602
8603         if (!rdev->ops->set_bitrate_mask)
8604                 return -EOPNOTSUPP;
8605
8606         memset(&mask, 0, sizeof(mask));
8607         /* Default to all rates enabled */
8608         for (i = 0; i < NUM_NL80211_BANDS; i++) {
8609                 sband = rdev->wiphy.bands[i];
8610
8611                 if (!sband)
8612                         continue;
8613
8614                 mask.control[i].legacy = (1 << sband->n_bitrates) - 1;
8615                 memcpy(mask.control[i].ht_mcs,
8616                        sband->ht_cap.mcs.rx_mask,
8617                        sizeof(mask.control[i].ht_mcs));
8618
8619                 if (!sband->vht_cap.vht_supported)
8620                         continue;
8621
8622                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
8623                 vht_build_mcs_mask(vht_tx_mcs_map, mask.control[i].vht_mcs);
8624         }
8625
8626         /* if no rates are given set it back to the defaults */
8627         if (!info->attrs[NL80211_ATTR_TX_RATES])
8628                 goto out;
8629
8630         /*
8631          * The nested attribute uses enum nl80211_band as the index. This maps
8632          * directly to the enum nl80211_band values used in cfg80211.
8633          */
8634         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
8635         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
8636                 enum nl80211_band band = nla_type(tx_rates);
8637                 int err;
8638
8639                 if (band < 0 || band >= NUM_NL80211_BANDS)
8640                         return -EINVAL;
8641                 sband = rdev->wiphy.bands[band];
8642                 if (sband == NULL)
8643                         return -EINVAL;
8644                 err = nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
8645                                 nla_len(tx_rates), nl80211_txattr_policy);
8646                 if (err)
8647                         return err;
8648                 if (tb[NL80211_TXRATE_LEGACY]) {
8649                         mask.control[band].legacy = rateset_to_mask(
8650                                 sband,
8651                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
8652                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
8653                         if ((mask.control[band].legacy == 0) &&
8654                             nla_len(tb[NL80211_TXRATE_LEGACY]))
8655                                 return -EINVAL;
8656                 }
8657                 if (tb[NL80211_TXRATE_HT]) {
8658                         if (!ht_rateset_to_mask(
8659                                         sband,
8660                                         nla_data(tb[NL80211_TXRATE_HT]),
8661                                         nla_len(tb[NL80211_TXRATE_HT]),
8662                                         mask.control[band].ht_mcs))
8663                                 return -EINVAL;
8664                 }
8665                 if (tb[NL80211_TXRATE_VHT]) {
8666                         if (!vht_set_mcs_mask(
8667                                         sband,
8668                                         nla_data(tb[NL80211_TXRATE_VHT]),
8669                                         mask.control[band].vht_mcs))
8670                                 return -EINVAL;
8671                 }
8672                 if (tb[NL80211_TXRATE_GI]) {
8673                         mask.control[band].gi =
8674                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
8675                         if (mask.control[band].gi > NL80211_TXRATE_FORCE_LGI)
8676                                 return -EINVAL;
8677                 }
8678
8679                 if (mask.control[band].legacy == 0) {
8680                         /* don't allow empty legacy rates if HT or VHT
8681                          * are not even supported.
8682                          */
8683                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
8684                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
8685                                 return -EINVAL;
8686
8687                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
8688                                 if (mask.control[band].ht_mcs[i])
8689                                         goto out;
8690
8691                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
8692                                 if (mask.control[band].vht_mcs[i])
8693                                         goto out;
8694
8695                         /* legacy and mcs rates may not be both empty */
8696                         return -EINVAL;
8697                 }
8698         }
8699
8700 out:
8701         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
8702 }
8703
8704 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
8705 {
8706         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8707         struct wireless_dev *wdev = info->user_ptr[1];
8708         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
8709
8710         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
8711                 return -EINVAL;
8712
8713         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
8714                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
8715
8716         switch (wdev->iftype) {
8717         case NL80211_IFTYPE_STATION:
8718         case NL80211_IFTYPE_ADHOC:
8719         case NL80211_IFTYPE_P2P_CLIENT:
8720         case NL80211_IFTYPE_AP:
8721         case NL80211_IFTYPE_AP_VLAN:
8722         case NL80211_IFTYPE_MESH_POINT:
8723         case NL80211_IFTYPE_P2P_GO:
8724         case NL80211_IFTYPE_P2P_DEVICE:
8725                 break;
8726         default:
8727                 return -EOPNOTSUPP;
8728         }
8729
8730         /* not much point in registering if we can't reply */
8731         if (!rdev->ops->mgmt_tx)
8732                 return -EOPNOTSUPP;
8733
8734         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
8735                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
8736                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
8737 }
8738
8739 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
8740 {
8741         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8742         struct wireless_dev *wdev = info->user_ptr[1];
8743         struct cfg80211_chan_def chandef;
8744         int err;
8745         void *hdr = NULL;
8746         u64 cookie;
8747         struct sk_buff *msg = NULL;
8748         struct cfg80211_mgmt_tx_params params = {
8749                 .dont_wait_for_ack =
8750                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
8751         };
8752
8753         if (!info->attrs[NL80211_ATTR_FRAME])
8754                 return -EINVAL;
8755
8756         if (!rdev->ops->mgmt_tx)
8757                 return -EOPNOTSUPP;
8758
8759         switch (wdev->iftype) {
8760         case NL80211_IFTYPE_P2P_DEVICE:
8761                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
8762                         return -EINVAL;
8763         case NL80211_IFTYPE_STATION:
8764         case NL80211_IFTYPE_ADHOC:
8765         case NL80211_IFTYPE_P2P_CLIENT:
8766         case NL80211_IFTYPE_AP:
8767         case NL80211_IFTYPE_AP_VLAN:
8768         case NL80211_IFTYPE_MESH_POINT:
8769         case NL80211_IFTYPE_P2P_GO:
8770                 break;
8771         default:
8772                 return -EOPNOTSUPP;
8773         }
8774
8775         if (info->attrs[NL80211_ATTR_DURATION]) {
8776                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
8777                         return -EINVAL;
8778                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
8779
8780                 /*
8781                  * We should wait on the channel for at least a minimum amount
8782                  * of time (10ms) but no longer than the driver supports.
8783                  */
8784                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
8785                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
8786                         return -EINVAL;
8787
8788         }
8789
8790         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
8791
8792         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
8793                 return -EINVAL;
8794
8795         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
8796
8797         /* get the channel if any has been specified, otherwise pass NULL to
8798          * the driver. The latter will use the current one
8799          */
8800         chandef.chan = NULL;
8801         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8802                 err = nl80211_parse_chandef(rdev, info, &chandef);
8803                 if (err)
8804                         return err;
8805         }
8806
8807         if (!chandef.chan && params.offchan)
8808                 return -EINVAL;
8809
8810         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
8811         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
8812
8813         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
8814                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
8815                 int i;
8816
8817                 if (len % sizeof(u16))
8818                         return -EINVAL;
8819
8820                 params.n_csa_offsets = len / sizeof(u16);
8821                 params.csa_offsets =
8822                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
8823
8824                 /* check that all the offsets fit the frame */
8825                 for (i = 0; i < params.n_csa_offsets; i++) {
8826                         if (params.csa_offsets[i] >= params.len)
8827                                 return -EINVAL;
8828                 }
8829         }
8830
8831         if (!params.dont_wait_for_ack) {
8832                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8833                 if (!msg)
8834                         return -ENOMEM;
8835
8836                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8837                                      NL80211_CMD_FRAME);
8838                 if (!hdr) {
8839                         err = -ENOBUFS;
8840                         goto free_msg;
8841                 }
8842         }
8843
8844         params.chan = chandef.chan;
8845         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
8846         if (err)
8847                 goto free_msg;
8848
8849         if (msg) {
8850                 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
8851                                       NL80211_ATTR_PAD))
8852                         goto nla_put_failure;
8853
8854                 genlmsg_end(msg, hdr);
8855                 return genlmsg_reply(msg, info);
8856         }
8857
8858         return 0;
8859
8860  nla_put_failure:
8861         err = -ENOBUFS;
8862  free_msg:
8863         nlmsg_free(msg);
8864         return err;
8865 }
8866
8867 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
8868 {
8869         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8870         struct wireless_dev *wdev = info->user_ptr[1];
8871         u64 cookie;
8872
8873         if (!info->attrs[NL80211_ATTR_COOKIE])
8874                 return -EINVAL;
8875
8876         if (!rdev->ops->mgmt_tx_cancel_wait)
8877                 return -EOPNOTSUPP;
8878
8879         switch (wdev->iftype) {
8880         case NL80211_IFTYPE_STATION:
8881         case NL80211_IFTYPE_ADHOC:
8882         case NL80211_IFTYPE_P2P_CLIENT:
8883         case NL80211_IFTYPE_AP:
8884         case NL80211_IFTYPE_AP_VLAN:
8885         case NL80211_IFTYPE_P2P_GO:
8886         case NL80211_IFTYPE_P2P_DEVICE:
8887                 break;
8888         default:
8889                 return -EOPNOTSUPP;
8890         }
8891
8892         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
8893
8894         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
8895 }
8896
8897 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
8898 {
8899         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8900         struct wireless_dev *wdev;
8901         struct net_device *dev = info->user_ptr[1];
8902         u8 ps_state;
8903         bool state;
8904         int err;
8905
8906         if (!info->attrs[NL80211_ATTR_PS_STATE])
8907                 return -EINVAL;
8908
8909         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
8910
8911         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
8912                 return -EINVAL;
8913
8914         wdev = dev->ieee80211_ptr;
8915
8916         if (!rdev->ops->set_power_mgmt)
8917                 return -EOPNOTSUPP;
8918
8919         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
8920
8921         if (state == wdev->ps)
8922                 return 0;
8923
8924         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
8925         if (!err)
8926                 wdev->ps = state;
8927         return err;
8928 }
8929
8930 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
8931 {
8932         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8933         enum nl80211_ps_state ps_state;
8934         struct wireless_dev *wdev;
8935         struct net_device *dev = info->user_ptr[1];
8936         struct sk_buff *msg;
8937         void *hdr;
8938         int err;
8939
8940         wdev = dev->ieee80211_ptr;
8941
8942         if (!rdev->ops->set_power_mgmt)
8943                 return -EOPNOTSUPP;
8944
8945         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8946         if (!msg)
8947                 return -ENOMEM;
8948
8949         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8950                              NL80211_CMD_GET_POWER_SAVE);
8951         if (!hdr) {
8952                 err = -ENOBUFS;
8953                 goto free_msg;
8954         }
8955
8956         if (wdev->ps)
8957                 ps_state = NL80211_PS_ENABLED;
8958         else
8959                 ps_state = NL80211_PS_DISABLED;
8960
8961         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
8962                 goto nla_put_failure;
8963
8964         genlmsg_end(msg, hdr);
8965         return genlmsg_reply(msg, info);
8966
8967  nla_put_failure:
8968         err = -ENOBUFS;
8969  free_msg:
8970         nlmsg_free(msg);
8971         return err;
8972 }
8973
8974 static const struct nla_policy
8975 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
8976         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
8977         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
8978         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
8979         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
8980         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
8981         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
8982 };
8983
8984 static int nl80211_set_cqm_txe(struct genl_info *info,
8985                                u32 rate, u32 pkts, u32 intvl)
8986 {
8987         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8988         struct net_device *dev = info->user_ptr[1];
8989         struct wireless_dev *wdev = dev->ieee80211_ptr;
8990
8991         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
8992                 return -EINVAL;
8993
8994         if (!rdev->ops->set_cqm_txe_config)
8995                 return -EOPNOTSUPP;
8996
8997         if (wdev->iftype != NL80211_IFTYPE_STATION &&
8998             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
8999                 return -EOPNOTSUPP;
9000
9001         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
9002 }
9003
9004 static int nl80211_set_cqm_rssi(struct genl_info *info,
9005                                 s32 threshold, u32 hysteresis)
9006 {
9007         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9008         struct net_device *dev = info->user_ptr[1];
9009         struct wireless_dev *wdev = dev->ieee80211_ptr;
9010
9011         if (threshold > 0)
9012                 return -EINVAL;
9013
9014         /* disabling - hysteresis should also be zero then */
9015         if (threshold == 0)
9016                 hysteresis = 0;
9017
9018         if (!rdev->ops->set_cqm_rssi_config)
9019                 return -EOPNOTSUPP;
9020
9021         if (wdev->iftype != NL80211_IFTYPE_STATION &&
9022             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
9023                 return -EOPNOTSUPP;
9024
9025         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
9026 }
9027
9028 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
9029 {
9030         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
9031         struct nlattr *cqm;
9032         int err;
9033
9034         cqm = info->attrs[NL80211_ATTR_CQM];
9035         if (!cqm)
9036                 return -EINVAL;
9037
9038         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
9039                                nl80211_attr_cqm_policy);
9040         if (err)
9041                 return err;
9042
9043         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
9044             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
9045                 s32 threshold = nla_get_s32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
9046                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
9047
9048                 return nl80211_set_cqm_rssi(info, threshold, hysteresis);
9049         }
9050
9051         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
9052             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
9053             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
9054                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
9055                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
9056                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
9057
9058                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
9059         }
9060
9061         return -EINVAL;
9062 }
9063
9064 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
9065 {
9066         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9067         struct net_device *dev = info->user_ptr[1];
9068         struct ocb_setup setup = {};
9069         int err;
9070
9071         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
9072         if (err)
9073                 return err;
9074
9075         return cfg80211_join_ocb(rdev, dev, &setup);
9076 }
9077
9078 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
9079 {
9080         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9081         struct net_device *dev = info->user_ptr[1];
9082
9083         return cfg80211_leave_ocb(rdev, dev);
9084 }
9085
9086 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
9087 {
9088         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9089         struct net_device *dev = info->user_ptr[1];
9090         struct mesh_config cfg;
9091         struct mesh_setup setup;
9092         int err;
9093
9094         /* start with default */
9095         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
9096         memcpy(&setup, &default_mesh_setup, sizeof(setup));
9097
9098         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
9099                 /* and parse parameters if given */
9100                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
9101                 if (err)
9102                         return err;
9103         }
9104
9105         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
9106             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
9107                 return -EINVAL;
9108
9109         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
9110         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
9111
9112         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
9113             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
9114                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
9115                         return -EINVAL;
9116
9117         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
9118                 setup.beacon_interval =
9119                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
9120                 if (setup.beacon_interval < 10 ||
9121                     setup.beacon_interval > 10000)
9122                         return -EINVAL;
9123         }
9124
9125         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
9126                 setup.dtim_period =
9127                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
9128                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
9129                         return -EINVAL;
9130         }
9131
9132         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
9133                 /* parse additional setup parameters if given */
9134                 err = nl80211_parse_mesh_setup(info, &setup);
9135                 if (err)
9136                         return err;
9137         }
9138
9139         if (setup.user_mpm)
9140                 cfg.auto_open_plinks = false;
9141
9142         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9143                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
9144                 if (err)
9145                         return err;
9146         } else {
9147                 /* cfg80211_join_mesh() will sort it out */
9148                 setup.chandef.chan = NULL;
9149         }
9150
9151         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
9152                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9153                 int n_rates =
9154                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9155                 struct ieee80211_supported_band *sband;
9156
9157                 if (!setup.chandef.chan)
9158                         return -EINVAL;
9159
9160                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
9161
9162                 err = ieee80211_get_ratemask(sband, rates, n_rates,
9163                                              &setup.basic_rates);
9164                 if (err)
9165                         return err;
9166         }
9167
9168         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
9169 }
9170
9171 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
9172 {
9173         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9174         struct net_device *dev = info->user_ptr[1];
9175
9176         return cfg80211_leave_mesh(rdev, dev);
9177 }
9178
9179 #ifdef CONFIG_PM
9180 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
9181                                         struct cfg80211_registered_device *rdev)
9182 {
9183         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
9184         struct nlattr *nl_pats, *nl_pat;
9185         int i, pat_len;
9186
9187         if (!wowlan->n_patterns)
9188                 return 0;
9189
9190         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
9191         if (!nl_pats)
9192                 return -ENOBUFS;
9193
9194         for (i = 0; i < wowlan->n_patterns; i++) {
9195                 nl_pat = nla_nest_start(msg, i + 1);
9196                 if (!nl_pat)
9197                         return -ENOBUFS;
9198                 pat_len = wowlan->patterns[i].pattern_len;
9199                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
9200                             wowlan->patterns[i].mask) ||
9201                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
9202                             wowlan->patterns[i].pattern) ||
9203                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
9204                                 wowlan->patterns[i].pkt_offset))
9205                         return -ENOBUFS;
9206                 nla_nest_end(msg, nl_pat);
9207         }
9208         nla_nest_end(msg, nl_pats);
9209
9210         return 0;
9211 }
9212
9213 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
9214                                    struct cfg80211_wowlan_tcp *tcp)
9215 {
9216         struct nlattr *nl_tcp;
9217
9218         if (!tcp)
9219                 return 0;
9220
9221         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
9222         if (!nl_tcp)
9223                 return -ENOBUFS;
9224
9225         if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
9226             nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
9227             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
9228             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
9229             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
9230             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
9231                     tcp->payload_len, tcp->payload) ||
9232             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
9233                         tcp->data_interval) ||
9234             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
9235                     tcp->wake_len, tcp->wake_data) ||
9236             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
9237                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
9238                 return -ENOBUFS;
9239
9240         if (tcp->payload_seq.len &&
9241             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
9242                     sizeof(tcp->payload_seq), &tcp->payload_seq))
9243                 return -ENOBUFS;
9244
9245         if (tcp->payload_tok.len &&
9246             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
9247                     sizeof(tcp->payload_tok) + tcp->tokens_size,
9248                     &tcp->payload_tok))
9249                 return -ENOBUFS;
9250
9251         nla_nest_end(msg, nl_tcp);
9252
9253         return 0;
9254 }
9255
9256 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
9257                                   struct cfg80211_sched_scan_request *req)
9258 {
9259         struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
9260         int i;
9261
9262         if (!req)
9263                 return 0;
9264
9265         nd = nla_nest_start(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
9266         if (!nd)
9267                 return -ENOBUFS;
9268
9269         if (req->n_scan_plans == 1 &&
9270             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
9271                         req->scan_plans[0].interval * 1000))
9272                 return -ENOBUFS;
9273
9274         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
9275                 return -ENOBUFS;
9276
9277         freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
9278         if (!freqs)
9279                 return -ENOBUFS;
9280
9281         for (i = 0; i < req->n_channels; i++)
9282                 nla_put_u32(msg, i, req->channels[i]->center_freq);
9283
9284         nla_nest_end(msg, freqs);
9285
9286         if (req->n_match_sets) {
9287                 matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
9288                 for (i = 0; i < req->n_match_sets; i++) {
9289                         match = nla_nest_start(msg, i);
9290                         nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
9291                                 req->match_sets[i].ssid.ssid_len,
9292                                 req->match_sets[i].ssid.ssid);
9293                         nla_nest_end(msg, match);
9294                 }
9295                 nla_nest_end(msg, matches);
9296         }
9297
9298         scan_plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
9299         if (!scan_plans)
9300                 return -ENOBUFS;
9301
9302         for (i = 0; i < req->n_scan_plans; i++) {
9303                 scan_plan = nla_nest_start(msg, i + 1);
9304                 if (!scan_plan ||
9305                     nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
9306                                 req->scan_plans[i].interval) ||
9307                     (req->scan_plans[i].iterations &&
9308                      nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
9309                                  req->scan_plans[i].iterations)))
9310                         return -ENOBUFS;
9311                 nla_nest_end(msg, scan_plan);
9312         }
9313         nla_nest_end(msg, scan_plans);
9314
9315         nla_nest_end(msg, nd);
9316
9317         return 0;
9318 }
9319
9320 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
9321 {
9322         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9323         struct sk_buff *msg;
9324         void *hdr;
9325         u32 size = NLMSG_DEFAULT_SIZE;
9326
9327         if (!rdev->wiphy.wowlan)
9328                 return -EOPNOTSUPP;
9329
9330         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
9331                 /* adjust size to have room for all the data */
9332                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
9333                         rdev->wiphy.wowlan_config->tcp->payload_len +
9334                         rdev->wiphy.wowlan_config->tcp->wake_len +
9335                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
9336         }
9337
9338         msg = nlmsg_new(size, GFP_KERNEL);
9339         if (!msg)
9340                 return -ENOMEM;
9341
9342         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9343                              NL80211_CMD_GET_WOWLAN);
9344         if (!hdr)
9345                 goto nla_put_failure;
9346
9347         if (rdev->wiphy.wowlan_config) {
9348                 struct nlattr *nl_wowlan;
9349
9350                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
9351                 if (!nl_wowlan)
9352                         goto nla_put_failure;
9353
9354                 if ((rdev->wiphy.wowlan_config->any &&
9355                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
9356                     (rdev->wiphy.wowlan_config->disconnect &&
9357                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
9358                     (rdev->wiphy.wowlan_config->magic_pkt &&
9359                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
9360                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
9361                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
9362                     (rdev->wiphy.wowlan_config->eap_identity_req &&
9363                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
9364                     (rdev->wiphy.wowlan_config->four_way_handshake &&
9365                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
9366                     (rdev->wiphy.wowlan_config->rfkill_release &&
9367                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
9368                         goto nla_put_failure;
9369
9370                 if (nl80211_send_wowlan_patterns(msg, rdev))
9371                         goto nla_put_failure;
9372
9373                 if (nl80211_send_wowlan_tcp(msg,
9374                                             rdev->wiphy.wowlan_config->tcp))
9375                         goto nla_put_failure;
9376
9377                 if (nl80211_send_wowlan_nd(
9378                             msg,
9379                             rdev->wiphy.wowlan_config->nd_config))
9380                         goto nla_put_failure;
9381
9382                 nla_nest_end(msg, nl_wowlan);
9383         }
9384
9385         genlmsg_end(msg, hdr);
9386         return genlmsg_reply(msg, info);
9387
9388 nla_put_failure:
9389         nlmsg_free(msg);
9390         return -ENOBUFS;
9391 }
9392
9393 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
9394                                     struct nlattr *attr,
9395                                     struct cfg80211_wowlan *trig)
9396 {
9397         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
9398         struct cfg80211_wowlan_tcp *cfg;
9399         struct nl80211_wowlan_tcp_data_token *tok = NULL;
9400         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
9401         u32 size;
9402         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
9403         int err, port;
9404
9405         if (!rdev->wiphy.wowlan->tcp)
9406                 return -EINVAL;
9407
9408         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
9409                         nla_data(attr), nla_len(attr),
9410                         nl80211_wowlan_tcp_policy);
9411         if (err)
9412                 return err;
9413
9414         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
9415             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
9416             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
9417             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
9418             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
9419             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
9420             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
9421             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
9422                 return -EINVAL;
9423
9424         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
9425         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
9426                 return -EINVAL;
9427
9428         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
9429                         rdev->wiphy.wowlan->tcp->data_interval_max ||
9430             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
9431                 return -EINVAL;
9432
9433         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
9434         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
9435                 return -EINVAL;
9436
9437         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
9438         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
9439                 return -EINVAL;
9440
9441         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
9442                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
9443
9444                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
9445                 tokens_size = tokln - sizeof(*tok);
9446
9447                 if (!tok->len || tokens_size % tok->len)
9448                         return -EINVAL;
9449                 if (!rdev->wiphy.wowlan->tcp->tok)
9450                         return -EINVAL;
9451                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
9452                         return -EINVAL;
9453                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
9454                         return -EINVAL;
9455                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
9456                         return -EINVAL;
9457                 if (tok->offset + tok->len > data_size)
9458                         return -EINVAL;
9459         }
9460
9461         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
9462                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
9463                 if (!rdev->wiphy.wowlan->tcp->seq)
9464                         return -EINVAL;
9465                 if (seq->len == 0 || seq->len > 4)
9466                         return -EINVAL;
9467                 if (seq->len + seq->offset > data_size)
9468                         return -EINVAL;
9469         }
9470
9471         size = sizeof(*cfg);
9472         size += data_size;
9473         size += wake_size + wake_mask_size;
9474         size += tokens_size;
9475
9476         cfg = kzalloc(size, GFP_KERNEL);
9477         if (!cfg)
9478                 return -ENOMEM;
9479         cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
9480         cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
9481         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
9482                ETH_ALEN);
9483         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
9484                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
9485         else
9486                 port = 0;
9487 #ifdef CONFIG_INET
9488         /* allocate a socket and port for it and use it */
9489         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
9490                             IPPROTO_TCP, &cfg->sock, 1);
9491         if (err) {
9492                 kfree(cfg);
9493                 return err;
9494         }
9495         if (inet_csk_get_port(cfg->sock->sk, port)) {
9496                 sock_release(cfg->sock);
9497                 kfree(cfg);
9498                 return -EADDRINUSE;
9499         }
9500         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
9501 #else
9502         if (!port) {
9503                 kfree(cfg);
9504                 return -EINVAL;
9505         }
9506         cfg->src_port = port;
9507 #endif
9508
9509         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
9510         cfg->payload_len = data_size;
9511         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
9512         memcpy((void *)cfg->payload,
9513                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
9514                data_size);
9515         if (seq)
9516                 cfg->payload_seq = *seq;
9517         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
9518         cfg->wake_len = wake_size;
9519         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
9520         memcpy((void *)cfg->wake_data,
9521                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
9522                wake_size);
9523         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
9524                          data_size + wake_size;
9525         memcpy((void *)cfg->wake_mask,
9526                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
9527                wake_mask_size);
9528         if (tok) {
9529                 cfg->tokens_size = tokens_size;
9530                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
9531         }
9532
9533         trig->tcp = cfg;
9534
9535         return 0;
9536 }
9537
9538 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
9539                                    const struct wiphy_wowlan_support *wowlan,
9540                                    struct nlattr *attr,
9541                                    struct cfg80211_wowlan *trig)
9542 {
9543         struct nlattr **tb;
9544         int err;
9545
9546         tb = kzalloc(NUM_NL80211_ATTR * sizeof(*tb), GFP_KERNEL);
9547         if (!tb)
9548                 return -ENOMEM;
9549
9550         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
9551                 err = -EOPNOTSUPP;
9552                 goto out;
9553         }
9554
9555         err = nla_parse(tb, NL80211_ATTR_MAX,
9556                         nla_data(attr), nla_len(attr),
9557                         nl80211_policy);
9558         if (err)
9559                 goto out;
9560
9561         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb);
9562         err = PTR_ERR_OR_ZERO(trig->nd_config);
9563         if (err)
9564                 trig->nd_config = NULL;
9565
9566 out:
9567         kfree(tb);
9568         return err;
9569 }
9570
9571 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
9572 {
9573         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9574         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
9575         struct cfg80211_wowlan new_triggers = {};
9576         struct cfg80211_wowlan *ntrig;
9577         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
9578         int err, i;
9579         bool prev_enabled = rdev->wiphy.wowlan_config;
9580         bool regular = false;
9581
9582         if (!wowlan)
9583                 return -EOPNOTSUPP;
9584
9585         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
9586                 cfg80211_rdev_free_wowlan(rdev);
9587                 rdev->wiphy.wowlan_config = NULL;
9588                 goto set_wakeup;
9589         }
9590
9591         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
9592                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
9593                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
9594                         nl80211_wowlan_policy);
9595         if (err)
9596                 return err;
9597
9598         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
9599                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
9600                         return -EINVAL;
9601                 new_triggers.any = true;
9602         }
9603
9604         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
9605                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
9606                         return -EINVAL;
9607                 new_triggers.disconnect = true;
9608                 regular = true;
9609         }
9610
9611         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
9612                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
9613                         return -EINVAL;
9614                 new_triggers.magic_pkt = true;
9615                 regular = true;
9616         }
9617
9618         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
9619                 return -EINVAL;
9620
9621         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
9622                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
9623                         return -EINVAL;
9624                 new_triggers.gtk_rekey_failure = true;
9625                 regular = true;
9626         }
9627
9628         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
9629                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
9630                         return -EINVAL;
9631                 new_triggers.eap_identity_req = true;
9632                 regular = true;
9633         }
9634
9635         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
9636                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
9637                         return -EINVAL;
9638                 new_triggers.four_way_handshake = true;
9639                 regular = true;
9640         }
9641
9642         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
9643                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
9644                         return -EINVAL;
9645                 new_triggers.rfkill_release = true;
9646                 regular = true;
9647         }
9648
9649         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
9650                 struct nlattr *pat;
9651                 int n_patterns = 0;
9652                 int rem, pat_len, mask_len, pkt_offset;
9653                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
9654
9655                 regular = true;
9656
9657                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
9658                                     rem)
9659                         n_patterns++;
9660                 if (n_patterns > wowlan->n_patterns)
9661                         return -EINVAL;
9662
9663                 new_triggers.patterns = kcalloc(n_patterns,
9664                                                 sizeof(new_triggers.patterns[0]),
9665                                                 GFP_KERNEL);
9666                 if (!new_triggers.patterns)
9667                         return -ENOMEM;
9668
9669                 new_triggers.n_patterns = n_patterns;
9670                 i = 0;
9671
9672                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
9673                                     rem) {
9674                         u8 *mask_pat;
9675
9676                         nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
9677                                   nla_len(pat), NULL);
9678                         err = -EINVAL;
9679                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
9680                             !pat_tb[NL80211_PKTPAT_PATTERN])
9681                                 goto error;
9682                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
9683                         mask_len = DIV_ROUND_UP(pat_len, 8);
9684                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
9685                                 goto error;
9686                         if (pat_len > wowlan->pattern_max_len ||
9687                             pat_len < wowlan->pattern_min_len)
9688                                 goto error;
9689
9690                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
9691                                 pkt_offset = 0;
9692                         else
9693                                 pkt_offset = nla_get_u32(
9694                                         pat_tb[NL80211_PKTPAT_OFFSET]);
9695                         if (pkt_offset > wowlan->max_pkt_offset)
9696                                 goto error;
9697                         new_triggers.patterns[i].pkt_offset = pkt_offset;
9698
9699                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
9700                         if (!mask_pat) {
9701                                 err = -ENOMEM;
9702                                 goto error;
9703                         }
9704                         new_triggers.patterns[i].mask = mask_pat;
9705                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
9706                                mask_len);
9707                         mask_pat += mask_len;
9708                         new_triggers.patterns[i].pattern = mask_pat;
9709                         new_triggers.patterns[i].pattern_len = pat_len;
9710                         memcpy(mask_pat,
9711                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
9712                                pat_len);
9713                         i++;
9714                 }
9715         }
9716
9717         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
9718                 regular = true;
9719                 err = nl80211_parse_wowlan_tcp(
9720                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
9721                         &new_triggers);
9722                 if (err)
9723                         goto error;
9724         }
9725
9726         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
9727                 regular = true;
9728                 err = nl80211_parse_wowlan_nd(
9729                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
9730                         &new_triggers);
9731                 if (err)
9732                         goto error;
9733         }
9734
9735         /* The 'any' trigger means the device continues operating more or less
9736          * as in its normal operation mode and wakes up the host on most of the
9737          * normal interrupts (like packet RX, ...)
9738          * It therefore makes little sense to combine with the more constrained
9739          * wakeup trigger modes.
9740          */
9741         if (new_triggers.any && regular) {
9742                 err = -EINVAL;
9743                 goto error;
9744         }
9745
9746         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
9747         if (!ntrig) {
9748                 err = -ENOMEM;
9749                 goto error;
9750         }
9751         cfg80211_rdev_free_wowlan(rdev);
9752         rdev->wiphy.wowlan_config = ntrig;
9753
9754  set_wakeup:
9755         if (rdev->ops->set_wakeup &&
9756             prev_enabled != !!rdev->wiphy.wowlan_config)
9757                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
9758
9759         return 0;
9760  error:
9761         for (i = 0; i < new_triggers.n_patterns; i++)
9762                 kfree(new_triggers.patterns[i].mask);
9763         kfree(new_triggers.patterns);
9764         if (new_triggers.tcp && new_triggers.tcp->sock)
9765                 sock_release(new_triggers.tcp->sock);
9766         kfree(new_triggers.tcp);
9767         kfree(new_triggers.nd_config);
9768         return err;
9769 }
9770 #endif
9771
9772 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
9773                                        struct cfg80211_registered_device *rdev)
9774 {
9775         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
9776         int i, j, pat_len;
9777         struct cfg80211_coalesce_rules *rule;
9778
9779         if (!rdev->coalesce->n_rules)
9780                 return 0;
9781
9782         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
9783         if (!nl_rules)
9784                 return -ENOBUFS;
9785
9786         for (i = 0; i < rdev->coalesce->n_rules; i++) {
9787                 nl_rule = nla_nest_start(msg, i + 1);
9788                 if (!nl_rule)
9789                         return -ENOBUFS;
9790
9791                 rule = &rdev->coalesce->rules[i];
9792                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
9793                                 rule->delay))
9794                         return -ENOBUFS;
9795
9796                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
9797                                 rule->condition))
9798                         return -ENOBUFS;
9799
9800                 nl_pats = nla_nest_start(msg,
9801                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
9802                 if (!nl_pats)
9803                         return -ENOBUFS;
9804
9805                 for (j = 0; j < rule->n_patterns; j++) {
9806                         nl_pat = nla_nest_start(msg, j + 1);
9807                         if (!nl_pat)
9808                                 return -ENOBUFS;
9809                         pat_len = rule->patterns[j].pattern_len;
9810                         if (nla_put(msg, NL80211_PKTPAT_MASK,
9811                                     DIV_ROUND_UP(pat_len, 8),
9812                                     rule->patterns[j].mask) ||
9813                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
9814                                     rule->patterns[j].pattern) ||
9815                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
9816                                         rule->patterns[j].pkt_offset))
9817                                 return -ENOBUFS;
9818                         nla_nest_end(msg, nl_pat);
9819                 }
9820                 nla_nest_end(msg, nl_pats);
9821                 nla_nest_end(msg, nl_rule);
9822         }
9823         nla_nest_end(msg, nl_rules);
9824
9825         return 0;
9826 }
9827
9828 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
9829 {
9830         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9831         struct sk_buff *msg;
9832         void *hdr;
9833
9834         if (!rdev->wiphy.coalesce)
9835                 return -EOPNOTSUPP;
9836
9837         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9838         if (!msg)
9839                 return -ENOMEM;
9840
9841         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9842                              NL80211_CMD_GET_COALESCE);
9843         if (!hdr)
9844                 goto nla_put_failure;
9845
9846         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
9847                 goto nla_put_failure;
9848
9849         genlmsg_end(msg, hdr);
9850         return genlmsg_reply(msg, info);
9851
9852 nla_put_failure:
9853         nlmsg_free(msg);
9854         return -ENOBUFS;
9855 }
9856
9857 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
9858 {
9859         struct cfg80211_coalesce *coalesce = rdev->coalesce;
9860         int i, j;
9861         struct cfg80211_coalesce_rules *rule;
9862
9863         if (!coalesce)
9864                 return;
9865
9866         for (i = 0; i < coalesce->n_rules; i++) {
9867                 rule = &coalesce->rules[i];
9868                 for (j = 0; j < rule->n_patterns; j++)
9869                         kfree(rule->patterns[j].mask);
9870                 kfree(rule->patterns);
9871         }
9872         kfree(coalesce->rules);
9873         kfree(coalesce);
9874         rdev->coalesce = NULL;
9875 }
9876
9877 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
9878                                        struct nlattr *rule,
9879                                        struct cfg80211_coalesce_rules *new_rule)
9880 {
9881         int err, i;
9882         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
9883         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
9884         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
9885         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
9886
9887         err = nla_parse(tb, NL80211_ATTR_COALESCE_RULE_MAX, nla_data(rule),
9888                         nla_len(rule), nl80211_coalesce_policy);
9889         if (err)
9890                 return err;
9891
9892         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
9893                 new_rule->delay =
9894                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
9895         if (new_rule->delay > coalesce->max_delay)
9896                 return -EINVAL;
9897
9898         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
9899                 new_rule->condition =
9900                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
9901         if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
9902             new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
9903                 return -EINVAL;
9904
9905         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
9906                 return -EINVAL;
9907
9908         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
9909                             rem)
9910                 n_patterns++;
9911         if (n_patterns > coalesce->n_patterns)
9912                 return -EINVAL;
9913
9914         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
9915                                      GFP_KERNEL);
9916         if (!new_rule->patterns)
9917                 return -ENOMEM;
9918
9919         new_rule->n_patterns = n_patterns;
9920         i = 0;
9921
9922         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
9923                             rem) {
9924                 u8 *mask_pat;
9925
9926                 nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
9927                           nla_len(pat), NULL);
9928                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
9929                     !pat_tb[NL80211_PKTPAT_PATTERN])
9930                         return -EINVAL;
9931                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
9932                 mask_len = DIV_ROUND_UP(pat_len, 8);
9933                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
9934                         return -EINVAL;
9935                 if (pat_len > coalesce->pattern_max_len ||
9936                     pat_len < coalesce->pattern_min_len)
9937                         return -EINVAL;
9938
9939                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
9940                         pkt_offset = 0;
9941                 else
9942                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
9943                 if (pkt_offset > coalesce->max_pkt_offset)
9944                         return -EINVAL;
9945                 new_rule->patterns[i].pkt_offset = pkt_offset;
9946
9947                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
9948                 if (!mask_pat)
9949                         return -ENOMEM;
9950
9951                 new_rule->patterns[i].mask = mask_pat;
9952                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
9953                        mask_len);
9954
9955                 mask_pat += mask_len;
9956                 new_rule->patterns[i].pattern = mask_pat;
9957                 new_rule->patterns[i].pattern_len = pat_len;
9958                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
9959                        pat_len);
9960                 i++;
9961         }
9962
9963         return 0;
9964 }
9965
9966 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
9967 {
9968         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9969         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
9970         struct cfg80211_coalesce new_coalesce = {};
9971         struct cfg80211_coalesce *n_coalesce;
9972         int err, rem_rule, n_rules = 0, i, j;
9973         struct nlattr *rule;
9974         struct cfg80211_coalesce_rules *tmp_rule;
9975
9976         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
9977                 return -EOPNOTSUPP;
9978
9979         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
9980                 cfg80211_rdev_free_coalesce(rdev);
9981                 rdev_set_coalesce(rdev, NULL);
9982                 return 0;
9983         }
9984
9985         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
9986                             rem_rule)
9987                 n_rules++;
9988         if (n_rules > coalesce->n_rules)
9989                 return -EINVAL;
9990
9991         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
9992                                      GFP_KERNEL);
9993         if (!new_coalesce.rules)
9994                 return -ENOMEM;
9995
9996         new_coalesce.n_rules = n_rules;
9997         i = 0;
9998
9999         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
10000                             rem_rule) {
10001                 err = nl80211_parse_coalesce_rule(rdev, rule,
10002                                                   &new_coalesce.rules[i]);
10003                 if (err)
10004                         goto error;
10005
10006                 i++;
10007         }
10008
10009         err = rdev_set_coalesce(rdev, &new_coalesce);
10010         if (err)
10011                 goto error;
10012
10013         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
10014         if (!n_coalesce) {
10015                 err = -ENOMEM;
10016                 goto error;
10017         }
10018         cfg80211_rdev_free_coalesce(rdev);
10019         rdev->coalesce = n_coalesce;
10020
10021         return 0;
10022 error:
10023         for (i = 0; i < new_coalesce.n_rules; i++) {
10024                 tmp_rule = &new_coalesce.rules[i];
10025                 for (j = 0; j < tmp_rule->n_patterns; j++)
10026                         kfree(tmp_rule->patterns[j].mask);
10027                 kfree(tmp_rule->patterns);
10028         }
10029         kfree(new_coalesce.rules);
10030
10031         return err;
10032 }
10033
10034 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
10035 {
10036         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10037         struct net_device *dev = info->user_ptr[1];
10038         struct wireless_dev *wdev = dev->ieee80211_ptr;
10039         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
10040         struct cfg80211_gtk_rekey_data rekey_data;
10041         int err;
10042
10043         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
10044                 return -EINVAL;
10045
10046         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
10047                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
10048                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
10049                         nl80211_rekey_policy);
10050         if (err)
10051                 return err;
10052
10053         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
10054                 return -ERANGE;
10055         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
10056                 return -ERANGE;
10057         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
10058                 return -ERANGE;
10059
10060         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
10061         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
10062         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
10063
10064         wdev_lock(wdev);
10065         if (!wdev->current_bss) {
10066                 err = -ENOTCONN;
10067                 goto out;
10068         }
10069
10070         if (!rdev->ops->set_rekey_data) {
10071                 err = -EOPNOTSUPP;
10072                 goto out;
10073         }
10074
10075         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
10076  out:
10077         wdev_unlock(wdev);
10078         return err;
10079 }
10080
10081 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
10082                                              struct genl_info *info)
10083 {
10084         struct net_device *dev = info->user_ptr[1];
10085         struct wireless_dev *wdev = dev->ieee80211_ptr;
10086
10087         if (wdev->iftype != NL80211_IFTYPE_AP &&
10088             wdev->iftype != NL80211_IFTYPE_P2P_GO)
10089                 return -EINVAL;
10090
10091         if (wdev->ap_unexpected_nlportid)
10092                 return -EBUSY;
10093
10094         wdev->ap_unexpected_nlportid = info->snd_portid;
10095         return 0;
10096 }
10097
10098 static int nl80211_probe_client(struct sk_buff *skb,
10099                                 struct genl_info *info)
10100 {
10101         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10102         struct net_device *dev = info->user_ptr[1];
10103         struct wireless_dev *wdev = dev->ieee80211_ptr;
10104         struct sk_buff *msg;
10105         void *hdr;
10106         const u8 *addr;
10107         u64 cookie;
10108         int err;
10109
10110         if (wdev->iftype != NL80211_IFTYPE_AP &&
10111             wdev->iftype != NL80211_IFTYPE_P2P_GO)
10112                 return -EOPNOTSUPP;
10113
10114         if (!info->attrs[NL80211_ATTR_MAC])
10115                 return -EINVAL;
10116
10117         if (!rdev->ops->probe_client)
10118                 return -EOPNOTSUPP;
10119
10120         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10121         if (!msg)
10122                 return -ENOMEM;
10123
10124         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10125                              NL80211_CMD_PROBE_CLIENT);
10126         if (!hdr) {
10127                 err = -ENOBUFS;
10128                 goto free_msg;
10129         }
10130
10131         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
10132
10133         err = rdev_probe_client(rdev, dev, addr, &cookie);
10134         if (err)
10135                 goto free_msg;
10136
10137         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
10138                               NL80211_ATTR_PAD))
10139                 goto nla_put_failure;
10140
10141         genlmsg_end(msg, hdr);
10142
10143         return genlmsg_reply(msg, info);
10144
10145  nla_put_failure:
10146         err = -ENOBUFS;
10147  free_msg:
10148         nlmsg_free(msg);
10149         return err;
10150 }
10151
10152 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
10153 {
10154         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10155         struct cfg80211_beacon_registration *reg, *nreg;
10156         int rv;
10157
10158         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
10159                 return -EOPNOTSUPP;
10160
10161         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
10162         if (!nreg)
10163                 return -ENOMEM;
10164
10165         /* First, check if already registered. */
10166         spin_lock_bh(&rdev->beacon_registrations_lock);
10167         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
10168                 if (reg->nlportid == info->snd_portid) {
10169                         rv = -EALREADY;
10170                         goto out_err;
10171                 }
10172         }
10173         /* Add it to the list */
10174         nreg->nlportid = info->snd_portid;
10175         list_add(&nreg->list, &rdev->beacon_registrations);
10176
10177         spin_unlock_bh(&rdev->beacon_registrations_lock);
10178
10179         return 0;
10180 out_err:
10181         spin_unlock_bh(&rdev->beacon_registrations_lock);
10182         kfree(nreg);
10183         return rv;
10184 }
10185
10186 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
10187 {
10188         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10189         struct wireless_dev *wdev = info->user_ptr[1];
10190         int err;
10191
10192         if (!rdev->ops->start_p2p_device)
10193                 return -EOPNOTSUPP;
10194
10195         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
10196                 return -EOPNOTSUPP;
10197
10198         if (wdev->p2p_started)
10199                 return 0;
10200
10201         if (rfkill_blocked(rdev->rfkill))
10202                 return -ERFKILL;
10203
10204         err = rdev_start_p2p_device(rdev, wdev);
10205         if (err)
10206                 return err;
10207
10208         wdev->p2p_started = true;
10209         rdev->opencount++;
10210
10211         return 0;
10212 }
10213
10214 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
10215 {
10216         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10217         struct wireless_dev *wdev = info->user_ptr[1];
10218
10219         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
10220                 return -EOPNOTSUPP;
10221
10222         if (!rdev->ops->stop_p2p_device)
10223                 return -EOPNOTSUPP;
10224
10225         cfg80211_stop_p2p_device(rdev, wdev);
10226
10227         return 0;
10228 }
10229
10230 static int nl80211_get_protocol_features(struct sk_buff *skb,
10231                                          struct genl_info *info)
10232 {
10233         void *hdr;
10234         struct sk_buff *msg;
10235
10236         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10237         if (!msg)
10238                 return -ENOMEM;
10239
10240         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10241                              NL80211_CMD_GET_PROTOCOL_FEATURES);
10242         if (!hdr)
10243                 goto nla_put_failure;
10244
10245         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
10246                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
10247                 goto nla_put_failure;
10248
10249         genlmsg_end(msg, hdr);
10250         return genlmsg_reply(msg, info);
10251
10252  nla_put_failure:
10253         kfree_skb(msg);
10254         return -ENOBUFS;
10255 }
10256
10257 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
10258 {
10259         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10260         struct cfg80211_update_ft_ies_params ft_params;
10261         struct net_device *dev = info->user_ptr[1];
10262
10263         if (!rdev->ops->update_ft_ies)
10264                 return -EOPNOTSUPP;
10265
10266         if (!info->attrs[NL80211_ATTR_MDID] ||
10267             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
10268                 return -EINVAL;
10269
10270         memset(&ft_params, 0, sizeof(ft_params));
10271         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
10272         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10273         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10274
10275         return rdev_update_ft_ies(rdev, dev, &ft_params);
10276 }
10277
10278 static int nl80211_crit_protocol_start(struct sk_buff *skb,
10279                                        struct genl_info *info)
10280 {
10281         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10282         struct wireless_dev *wdev = info->user_ptr[1];
10283         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
10284         u16 duration;
10285         int ret;
10286
10287         if (!rdev->ops->crit_proto_start)
10288                 return -EOPNOTSUPP;
10289
10290         if (WARN_ON(!rdev->ops->crit_proto_stop))
10291                 return -EINVAL;
10292
10293         if (rdev->crit_proto_nlportid)
10294                 return -EBUSY;
10295
10296         /* determine protocol if provided */
10297         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
10298                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
10299
10300         if (proto >= NUM_NL80211_CRIT_PROTO)
10301                 return -EINVAL;
10302
10303         /* timeout must be provided */
10304         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
10305                 return -EINVAL;
10306
10307         duration =
10308                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
10309
10310         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
10311                 return -ERANGE;
10312
10313         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
10314         if (!ret)
10315                 rdev->crit_proto_nlportid = info->snd_portid;
10316
10317         return ret;
10318 }
10319
10320 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
10321                                       struct genl_info *info)
10322 {
10323         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10324         struct wireless_dev *wdev = info->user_ptr[1];
10325
10326         if (!rdev->ops->crit_proto_stop)
10327                 return -EOPNOTSUPP;
10328
10329         if (rdev->crit_proto_nlportid) {
10330                 rdev->crit_proto_nlportid = 0;
10331                 rdev_crit_proto_stop(rdev, wdev);
10332         }
10333         return 0;
10334 }
10335
10336 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
10337 {
10338         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10339         struct wireless_dev *wdev =
10340                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
10341         int i, err;
10342         u32 vid, subcmd;
10343
10344         if (!rdev->wiphy.vendor_commands)
10345                 return -EOPNOTSUPP;
10346
10347         if (IS_ERR(wdev)) {
10348                 err = PTR_ERR(wdev);
10349                 if (err != -EINVAL)
10350                         return err;
10351                 wdev = NULL;
10352         } else if (wdev->wiphy != &rdev->wiphy) {
10353                 return -EINVAL;
10354         }
10355
10356         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
10357             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
10358                 return -EINVAL;
10359
10360         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
10361         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
10362         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
10363                 const struct wiphy_vendor_command *vcmd;
10364                 void *data = NULL;
10365                 int len = 0;
10366
10367                 vcmd = &rdev->wiphy.vendor_commands[i];
10368
10369                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
10370                         continue;
10371
10372                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
10373                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
10374                         if (!wdev)
10375                                 return -EINVAL;
10376                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
10377                             !wdev->netdev)
10378                                 return -EINVAL;
10379
10380                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
10381                                 if (wdev->netdev &&
10382                                     !netif_running(wdev->netdev))
10383                                         return -ENETDOWN;
10384                                 if (!wdev->netdev && !wdev->p2p_started)
10385                                         return -ENETDOWN;
10386                         }
10387
10388                         if (!vcmd->doit)
10389                                 return -EOPNOTSUPP;
10390                 } else {
10391                         wdev = NULL;
10392                 }
10393
10394                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
10395                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
10396                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
10397                 }
10398
10399                 rdev->cur_cmd_info = info;
10400                 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
10401                                                           data, len);
10402                 rdev->cur_cmd_info = NULL;
10403                 return err;
10404         }
10405
10406         return -EOPNOTSUPP;
10407 }
10408
10409 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
10410                                        struct netlink_callback *cb,
10411                                        struct cfg80211_registered_device **rdev,
10412                                        struct wireless_dev **wdev)
10413 {
10414         u32 vid, subcmd;
10415         unsigned int i;
10416         int vcmd_idx = -1;
10417         int err;
10418         void *data = NULL;
10419         unsigned int data_len = 0;
10420
10421         rtnl_lock();
10422
10423         if (cb->args[0]) {
10424                 /* subtract the 1 again here */
10425                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
10426                 struct wireless_dev *tmp;
10427
10428                 if (!wiphy) {
10429                         err = -ENODEV;
10430                         goto out_unlock;
10431                 }
10432                 *rdev = wiphy_to_rdev(wiphy);
10433                 *wdev = NULL;
10434
10435                 if (cb->args[1]) {
10436                         list_for_each_entry(tmp, &wiphy->wdev_list, list) {
10437                                 if (tmp->identifier == cb->args[1] - 1) {
10438                                         *wdev = tmp;
10439                                         break;
10440                                 }
10441                         }
10442                 }
10443
10444                 /* keep rtnl locked in successful case */
10445                 return 0;
10446         }
10447
10448         err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
10449                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
10450                           nl80211_policy);
10451         if (err)
10452                 goto out_unlock;
10453
10454         if (!nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_ID] ||
10455             !nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
10456                 err = -EINVAL;
10457                 goto out_unlock;
10458         }
10459
10460         *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
10461                                            nl80211_fam.attrbuf);
10462         if (IS_ERR(*wdev))
10463                 *wdev = NULL;
10464
10465         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
10466                                            nl80211_fam.attrbuf);
10467         if (IS_ERR(*rdev)) {
10468                 err = PTR_ERR(*rdev);
10469                 goto out_unlock;
10470         }
10471
10472         vid = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_ID]);
10473         subcmd = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
10474
10475         for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
10476                 const struct wiphy_vendor_command *vcmd;
10477
10478                 vcmd = &(*rdev)->wiphy.vendor_commands[i];
10479
10480                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
10481                         continue;
10482
10483                 if (!vcmd->dumpit) {
10484                         err = -EOPNOTSUPP;
10485                         goto out_unlock;
10486                 }
10487
10488                 vcmd_idx = i;
10489                 break;
10490         }
10491
10492         if (vcmd_idx < 0) {
10493                 err = -EOPNOTSUPP;
10494                 goto out_unlock;
10495         }
10496
10497         if (nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_DATA]) {
10498                 data = nla_data(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_DATA]);
10499                 data_len = nla_len(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_DATA]);
10500         }
10501
10502         /* 0 is the first index - add 1 to parse only once */
10503         cb->args[0] = (*rdev)->wiphy_idx + 1;
10504         /* add 1 to know if it was NULL */
10505         cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
10506         cb->args[2] = vcmd_idx;
10507         cb->args[3] = (unsigned long)data;
10508         cb->args[4] = data_len;
10509
10510         /* keep rtnl locked in successful case */
10511         return 0;
10512  out_unlock:
10513         rtnl_unlock();
10514         return err;
10515 }
10516
10517 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
10518                                    struct netlink_callback *cb)
10519 {
10520         struct cfg80211_registered_device *rdev;
10521         struct wireless_dev *wdev;
10522         unsigned int vcmd_idx;
10523         const struct wiphy_vendor_command *vcmd;
10524         void *data;
10525         int data_len;
10526         int err;
10527         struct nlattr *vendor_data;
10528
10529         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
10530         if (err)
10531                 return err;
10532
10533         vcmd_idx = cb->args[2];
10534         data = (void *)cb->args[3];
10535         data_len = cb->args[4];
10536         vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
10537
10538         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
10539                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
10540                 if (!wdev)
10541                         return -EINVAL;
10542                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
10543                     !wdev->netdev)
10544                         return -EINVAL;
10545
10546                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
10547                         if (wdev->netdev &&
10548                             !netif_running(wdev->netdev))
10549                                 return -ENETDOWN;
10550                         if (!wdev->netdev && !wdev->p2p_started)
10551                                 return -ENETDOWN;
10552                 }
10553         }
10554
10555         while (1) {
10556                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
10557                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
10558                                            NL80211_CMD_VENDOR);
10559                 if (!hdr)
10560                         break;
10561
10562                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10563                     (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
10564                                                wdev_id(wdev),
10565                                                NL80211_ATTR_PAD))) {
10566                         genlmsg_cancel(skb, hdr);
10567                         break;
10568                 }
10569
10570                 vendor_data = nla_nest_start(skb, NL80211_ATTR_VENDOR_DATA);
10571                 if (!vendor_data) {
10572                         genlmsg_cancel(skb, hdr);
10573                         break;
10574                 }
10575
10576                 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
10577                                    (unsigned long *)&cb->args[5]);
10578                 nla_nest_end(skb, vendor_data);
10579
10580                 if (err == -ENOBUFS || err == -ENOENT) {
10581                         genlmsg_cancel(skb, hdr);
10582                         break;
10583                 } else if (err) {
10584                         genlmsg_cancel(skb, hdr);
10585                         goto out;
10586                 }
10587
10588                 genlmsg_end(skb, hdr);
10589         }
10590
10591         err = skb->len;
10592  out:
10593         rtnl_unlock();
10594         return err;
10595 }
10596
10597 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
10598                                            enum nl80211_commands cmd,
10599                                            enum nl80211_attrs attr,
10600                                            int approxlen)
10601 {
10602         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10603
10604         if (WARN_ON(!rdev->cur_cmd_info))
10605                 return NULL;
10606
10607         return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
10608                                            rdev->cur_cmd_info->snd_portid,
10609                                            rdev->cur_cmd_info->snd_seq,
10610                                            cmd, attr, NULL, GFP_KERNEL);
10611 }
10612 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
10613
10614 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
10615 {
10616         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
10617         void *hdr = ((void **)skb->cb)[1];
10618         struct nlattr *data = ((void **)skb->cb)[2];
10619
10620         /* clear CB data for netlink core to own from now on */
10621         memset(skb->cb, 0, sizeof(skb->cb));
10622
10623         if (WARN_ON(!rdev->cur_cmd_info)) {
10624                 kfree_skb(skb);
10625                 return -EINVAL;
10626         }
10627
10628         nla_nest_end(skb, data);
10629         genlmsg_end(skb, hdr);
10630         return genlmsg_reply(skb, rdev->cur_cmd_info);
10631 }
10632 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
10633
10634
10635 static int nl80211_set_qos_map(struct sk_buff *skb,
10636                                struct genl_info *info)
10637 {
10638         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10639         struct cfg80211_qos_map *qos_map = NULL;
10640         struct net_device *dev = info->user_ptr[1];
10641         u8 *pos, len, num_des, des_len, des;
10642         int ret;
10643
10644         if (!rdev->ops->set_qos_map)
10645                 return -EOPNOTSUPP;
10646
10647         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
10648                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
10649                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
10650
10651                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
10652                     len > IEEE80211_QOS_MAP_LEN_MAX)
10653                         return -EINVAL;
10654
10655                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
10656                 if (!qos_map)
10657                         return -ENOMEM;
10658
10659                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
10660                 if (num_des) {
10661                         des_len = num_des *
10662                                 sizeof(struct cfg80211_dscp_exception);
10663                         memcpy(qos_map->dscp_exception, pos, des_len);
10664                         qos_map->num_des = num_des;
10665                         for (des = 0; des < num_des; des++) {
10666                                 if (qos_map->dscp_exception[des].up > 7) {
10667                                         kfree(qos_map);
10668                                         return -EINVAL;
10669                                 }
10670                         }
10671                         pos += des_len;
10672                 }
10673                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
10674         }
10675
10676         wdev_lock(dev->ieee80211_ptr);
10677         ret = nl80211_key_allowed(dev->ieee80211_ptr);
10678         if (!ret)
10679                 ret = rdev_set_qos_map(rdev, dev, qos_map);
10680         wdev_unlock(dev->ieee80211_ptr);
10681
10682         kfree(qos_map);
10683         return ret;
10684 }
10685
10686 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
10687 {
10688         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10689         struct net_device *dev = info->user_ptr[1];
10690         struct wireless_dev *wdev = dev->ieee80211_ptr;
10691         const u8 *peer;
10692         u8 tsid, up;
10693         u16 admitted_time = 0;
10694         int err;
10695
10696         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
10697                 return -EOPNOTSUPP;
10698
10699         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
10700             !info->attrs[NL80211_ATTR_USER_PRIO])
10701                 return -EINVAL;
10702
10703         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
10704         if (tsid >= IEEE80211_NUM_TIDS)
10705                 return -EINVAL;
10706
10707         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
10708         if (up >= IEEE80211_NUM_UPS)
10709                 return -EINVAL;
10710
10711         /* WMM uses TIDs 0-7 even for TSPEC */
10712         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
10713                 /* TODO: handle 802.11 TSPEC/admission control
10714                  * need more attributes for that (e.g. BA session requirement);
10715                  * change the WMM adminssion test above to allow both then
10716                  */
10717                 return -EINVAL;
10718         }
10719
10720         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
10721
10722         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
10723                 admitted_time =
10724                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
10725                 if (!admitted_time)
10726                         return -EINVAL;
10727         }
10728
10729         wdev_lock(wdev);
10730         switch (wdev->iftype) {
10731         case NL80211_IFTYPE_STATION:
10732         case NL80211_IFTYPE_P2P_CLIENT:
10733                 if (wdev->current_bss)
10734                         break;
10735                 err = -ENOTCONN;
10736                 goto out;
10737         default:
10738                 err = -EOPNOTSUPP;
10739                 goto out;
10740         }
10741
10742         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
10743
10744  out:
10745         wdev_unlock(wdev);
10746         return err;
10747 }
10748
10749 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
10750 {
10751         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10752         struct net_device *dev = info->user_ptr[1];
10753         struct wireless_dev *wdev = dev->ieee80211_ptr;
10754         const u8 *peer;
10755         u8 tsid;
10756         int err;
10757
10758         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
10759                 return -EINVAL;
10760
10761         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
10762         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
10763
10764         wdev_lock(wdev);
10765         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
10766         wdev_unlock(wdev);
10767
10768         return err;
10769 }
10770
10771 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
10772                                        struct genl_info *info)
10773 {
10774         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10775         struct net_device *dev = info->user_ptr[1];
10776         struct wireless_dev *wdev = dev->ieee80211_ptr;
10777         struct cfg80211_chan_def chandef = {};
10778         const u8 *addr;
10779         u8 oper_class;
10780         int err;
10781
10782         if (!rdev->ops->tdls_channel_switch ||
10783             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
10784                 return -EOPNOTSUPP;
10785
10786         switch (dev->ieee80211_ptr->iftype) {
10787         case NL80211_IFTYPE_STATION:
10788         case NL80211_IFTYPE_P2P_CLIENT:
10789                 break;
10790         default:
10791                 return -EOPNOTSUPP;
10792         }
10793
10794         if (!info->attrs[NL80211_ATTR_MAC] ||
10795             !info->attrs[NL80211_ATTR_OPER_CLASS])
10796                 return -EINVAL;
10797
10798         err = nl80211_parse_chandef(rdev, info, &chandef);
10799         if (err)
10800                 return err;
10801
10802         /*
10803          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
10804          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
10805          * specification is not defined for them.
10806          */
10807         if (chandef.chan->band == NL80211_BAND_2GHZ &&
10808             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
10809             chandef.width != NL80211_CHAN_WIDTH_20)
10810                 return -EINVAL;
10811
10812         /* we will be active on the TDLS link */
10813         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
10814                                            wdev->iftype))
10815                 return -EINVAL;
10816
10817         /* don't allow switching to DFS channels */
10818         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
10819                 return -EINVAL;
10820
10821         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
10822         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
10823
10824         wdev_lock(wdev);
10825         err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
10826         wdev_unlock(wdev);
10827
10828         return err;
10829 }
10830
10831 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
10832                                               struct genl_info *info)
10833 {
10834         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10835         struct net_device *dev = info->user_ptr[1];
10836         struct wireless_dev *wdev = dev->ieee80211_ptr;
10837         const u8 *addr;
10838
10839         if (!rdev->ops->tdls_channel_switch ||
10840             !rdev->ops->tdls_cancel_channel_switch ||
10841             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
10842                 return -EOPNOTSUPP;
10843
10844         switch (dev->ieee80211_ptr->iftype) {
10845         case NL80211_IFTYPE_STATION:
10846         case NL80211_IFTYPE_P2P_CLIENT:
10847                 break;
10848         default:
10849                 return -EOPNOTSUPP;
10850         }
10851
10852         if (!info->attrs[NL80211_ATTR_MAC])
10853                 return -EINVAL;
10854
10855         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
10856
10857         wdev_lock(wdev);
10858         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
10859         wdev_unlock(wdev);
10860
10861         return 0;
10862 }
10863
10864 #define NL80211_FLAG_NEED_WIPHY         0x01
10865 #define NL80211_FLAG_NEED_NETDEV        0x02
10866 #define NL80211_FLAG_NEED_RTNL          0x04
10867 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
10868 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
10869                                          NL80211_FLAG_CHECK_NETDEV_UP)
10870 #define NL80211_FLAG_NEED_WDEV          0x10
10871 /* If a netdev is associated, it must be UP, P2P must be started */
10872 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
10873                                          NL80211_FLAG_CHECK_NETDEV_UP)
10874 #define NL80211_FLAG_CLEAR_SKB          0x20
10875
10876 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
10877                             struct genl_info *info)
10878 {
10879         struct cfg80211_registered_device *rdev;
10880         struct wireless_dev *wdev;
10881         struct net_device *dev;
10882         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
10883
10884         if (rtnl)
10885                 rtnl_lock();
10886
10887         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
10888                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
10889                 if (IS_ERR(rdev)) {
10890                         if (rtnl)
10891                                 rtnl_unlock();
10892                         return PTR_ERR(rdev);
10893                 }
10894                 info->user_ptr[0] = rdev;
10895         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
10896                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
10897                 ASSERT_RTNL();
10898
10899                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
10900                                                   info->attrs);
10901                 if (IS_ERR(wdev)) {
10902                         if (rtnl)
10903                                 rtnl_unlock();
10904                         return PTR_ERR(wdev);
10905                 }
10906
10907                 dev = wdev->netdev;
10908                 rdev = wiphy_to_rdev(wdev->wiphy);
10909
10910                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
10911                         if (!dev) {
10912                                 if (rtnl)
10913                                         rtnl_unlock();
10914                                 return -EINVAL;
10915                         }
10916
10917                         info->user_ptr[1] = dev;
10918                 } else {
10919                         info->user_ptr[1] = wdev;
10920                 }
10921
10922                 if (dev) {
10923                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
10924                             !netif_running(dev)) {
10925                                 if (rtnl)
10926                                         rtnl_unlock();
10927                                 return -ENETDOWN;
10928                         }
10929
10930                         dev_hold(dev);
10931                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
10932                         if (!wdev->p2p_started) {
10933                                 if (rtnl)
10934                                         rtnl_unlock();
10935                                 return -ENETDOWN;
10936                         }
10937                 }
10938
10939                 info->user_ptr[0] = rdev;
10940         }
10941
10942         return 0;
10943 }
10944
10945 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
10946                               struct genl_info *info)
10947 {
10948         if (info->user_ptr[1]) {
10949                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
10950                         struct wireless_dev *wdev = info->user_ptr[1];
10951
10952                         if (wdev->netdev)
10953                                 dev_put(wdev->netdev);
10954                 } else {
10955                         dev_put(info->user_ptr[1]);
10956                 }
10957         }
10958
10959         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
10960                 rtnl_unlock();
10961
10962         /* If needed, clear the netlink message payload from the SKB
10963          * as it might contain key data that shouldn't stick around on
10964          * the heap after the SKB is freed. The netlink message header
10965          * is still needed for further processing, so leave it intact.
10966          */
10967         if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
10968                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
10969
10970                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
10971         }
10972 }
10973
10974 static const struct genl_ops nl80211_ops[] = {
10975         {
10976                 .cmd = NL80211_CMD_GET_WIPHY,
10977                 .doit = nl80211_get_wiphy,
10978                 .dumpit = nl80211_dump_wiphy,
10979                 .done = nl80211_dump_wiphy_done,
10980                 .policy = nl80211_policy,
10981                 /* can be retrieved by unprivileged users */
10982                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10983                                   NL80211_FLAG_NEED_RTNL,
10984         },
10985         {
10986                 .cmd = NL80211_CMD_SET_WIPHY,
10987                 .doit = nl80211_set_wiphy,
10988                 .policy = nl80211_policy,
10989                 .flags = GENL_UNS_ADMIN_PERM,
10990                 .internal_flags = NL80211_FLAG_NEED_RTNL,
10991         },
10992         {
10993                 .cmd = NL80211_CMD_GET_INTERFACE,
10994                 .doit = nl80211_get_interface,
10995                 .dumpit = nl80211_dump_interface,
10996                 .policy = nl80211_policy,
10997                 /* can be retrieved by unprivileged users */
10998                 .internal_flags = NL80211_FLAG_NEED_WDEV |
10999                                   NL80211_FLAG_NEED_RTNL,
11000         },
11001         {
11002                 .cmd = NL80211_CMD_SET_INTERFACE,
11003                 .doit = nl80211_set_interface,
11004                 .policy = nl80211_policy,
11005                 .flags = GENL_UNS_ADMIN_PERM,
11006                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11007                                   NL80211_FLAG_NEED_RTNL,
11008         },
11009         {
11010                 .cmd = NL80211_CMD_NEW_INTERFACE,
11011                 .doit = nl80211_new_interface,
11012                 .policy = nl80211_policy,
11013                 .flags = GENL_UNS_ADMIN_PERM,
11014                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11015                                   NL80211_FLAG_NEED_RTNL,
11016         },
11017         {
11018                 .cmd = NL80211_CMD_DEL_INTERFACE,
11019                 .doit = nl80211_del_interface,
11020                 .policy = nl80211_policy,
11021                 .flags = GENL_UNS_ADMIN_PERM,
11022                 .internal_flags = NL80211_FLAG_NEED_WDEV |
11023                                   NL80211_FLAG_NEED_RTNL,
11024         },
11025         {
11026                 .cmd = NL80211_CMD_GET_KEY,
11027                 .doit = nl80211_get_key,
11028                 .policy = nl80211_policy,
11029                 .flags = GENL_UNS_ADMIN_PERM,
11030                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11031                                   NL80211_FLAG_NEED_RTNL,
11032         },
11033         {
11034                 .cmd = NL80211_CMD_SET_KEY,
11035                 .doit = nl80211_set_key,
11036                 .policy = nl80211_policy,
11037                 .flags = GENL_UNS_ADMIN_PERM,
11038                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11039                                   NL80211_FLAG_NEED_RTNL |
11040                                   NL80211_FLAG_CLEAR_SKB,
11041         },
11042         {
11043                 .cmd = NL80211_CMD_NEW_KEY,
11044                 .doit = nl80211_new_key,
11045                 .policy = nl80211_policy,
11046                 .flags = GENL_UNS_ADMIN_PERM,
11047                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11048                                   NL80211_FLAG_NEED_RTNL |
11049                                   NL80211_FLAG_CLEAR_SKB,
11050         },
11051         {
11052                 .cmd = NL80211_CMD_DEL_KEY,
11053                 .doit = nl80211_del_key,
11054                 .policy = nl80211_policy,
11055                 .flags = GENL_UNS_ADMIN_PERM,
11056                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11057                                   NL80211_FLAG_NEED_RTNL,
11058         },
11059         {
11060                 .cmd = NL80211_CMD_SET_BEACON,
11061                 .policy = nl80211_policy,
11062                 .flags = GENL_UNS_ADMIN_PERM,
11063                 .doit = nl80211_set_beacon,
11064                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11065                                   NL80211_FLAG_NEED_RTNL,
11066         },
11067         {
11068                 .cmd = NL80211_CMD_START_AP,
11069                 .policy = nl80211_policy,
11070                 .flags = GENL_UNS_ADMIN_PERM,
11071                 .doit = nl80211_start_ap,
11072                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11073                                   NL80211_FLAG_NEED_RTNL,
11074         },
11075         {
11076                 .cmd = NL80211_CMD_STOP_AP,
11077                 .policy = nl80211_policy,
11078                 .flags = GENL_UNS_ADMIN_PERM,
11079                 .doit = nl80211_stop_ap,
11080                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11081                                   NL80211_FLAG_NEED_RTNL,
11082         },
11083         {
11084                 .cmd = NL80211_CMD_GET_STATION,
11085                 .doit = nl80211_get_station,
11086                 .dumpit = nl80211_dump_station,
11087                 .policy = nl80211_policy,
11088                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11089                                   NL80211_FLAG_NEED_RTNL,
11090         },
11091         {
11092                 .cmd = NL80211_CMD_SET_STATION,
11093                 .doit = nl80211_set_station,
11094                 .policy = nl80211_policy,
11095                 .flags = GENL_UNS_ADMIN_PERM,
11096                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11097                                   NL80211_FLAG_NEED_RTNL,
11098         },
11099         {
11100                 .cmd = NL80211_CMD_NEW_STATION,
11101                 .doit = nl80211_new_station,
11102                 .policy = nl80211_policy,
11103                 .flags = GENL_UNS_ADMIN_PERM,
11104                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11105                                   NL80211_FLAG_NEED_RTNL,
11106         },
11107         {
11108                 .cmd = NL80211_CMD_DEL_STATION,
11109                 .doit = nl80211_del_station,
11110                 .policy = nl80211_policy,
11111                 .flags = GENL_UNS_ADMIN_PERM,
11112                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11113                                   NL80211_FLAG_NEED_RTNL,
11114         },
11115         {
11116                 .cmd = NL80211_CMD_GET_MPATH,
11117                 .doit = nl80211_get_mpath,
11118                 .dumpit = nl80211_dump_mpath,
11119                 .policy = nl80211_policy,
11120                 .flags = GENL_UNS_ADMIN_PERM,
11121                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11122                                   NL80211_FLAG_NEED_RTNL,
11123         },
11124         {
11125                 .cmd = NL80211_CMD_GET_MPP,
11126                 .doit = nl80211_get_mpp,
11127                 .dumpit = nl80211_dump_mpp,
11128                 .policy = nl80211_policy,
11129                 .flags = GENL_UNS_ADMIN_PERM,
11130                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11131                                   NL80211_FLAG_NEED_RTNL,
11132         },
11133         {
11134                 .cmd = NL80211_CMD_SET_MPATH,
11135                 .doit = nl80211_set_mpath,
11136                 .policy = nl80211_policy,
11137                 .flags = GENL_UNS_ADMIN_PERM,
11138                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11139                                   NL80211_FLAG_NEED_RTNL,
11140         },
11141         {
11142                 .cmd = NL80211_CMD_NEW_MPATH,
11143                 .doit = nl80211_new_mpath,
11144                 .policy = nl80211_policy,
11145                 .flags = GENL_UNS_ADMIN_PERM,
11146                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11147                                   NL80211_FLAG_NEED_RTNL,
11148         },
11149         {
11150                 .cmd = NL80211_CMD_DEL_MPATH,
11151                 .doit = nl80211_del_mpath,
11152                 .policy = nl80211_policy,
11153                 .flags = GENL_UNS_ADMIN_PERM,
11154                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11155                                   NL80211_FLAG_NEED_RTNL,
11156         },
11157         {
11158                 .cmd = NL80211_CMD_SET_BSS,
11159                 .doit = nl80211_set_bss,
11160                 .policy = nl80211_policy,
11161                 .flags = GENL_UNS_ADMIN_PERM,
11162                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11163                                   NL80211_FLAG_NEED_RTNL,
11164         },
11165         {
11166                 .cmd = NL80211_CMD_GET_REG,
11167                 .doit = nl80211_get_reg_do,
11168                 .dumpit = nl80211_get_reg_dump,
11169                 .policy = nl80211_policy,
11170                 .internal_flags = NL80211_FLAG_NEED_RTNL,
11171                 /* can be retrieved by unprivileged users */
11172         },
11173 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
11174         {
11175                 .cmd = NL80211_CMD_SET_REG,
11176                 .doit = nl80211_set_reg,
11177                 .policy = nl80211_policy,
11178                 .flags = GENL_ADMIN_PERM,
11179                 .internal_flags = NL80211_FLAG_NEED_RTNL,
11180         },
11181 #endif
11182         {
11183                 .cmd = NL80211_CMD_REQ_SET_REG,
11184                 .doit = nl80211_req_set_reg,
11185                 .policy = nl80211_policy,
11186                 .flags = GENL_ADMIN_PERM,
11187         },
11188         {
11189                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
11190                 .doit = nl80211_get_mesh_config,
11191                 .policy = nl80211_policy,
11192                 /* can be retrieved by unprivileged users */
11193                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11194                                   NL80211_FLAG_NEED_RTNL,
11195         },
11196         {
11197                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
11198                 .doit = nl80211_update_mesh_config,
11199                 .policy = nl80211_policy,
11200                 .flags = GENL_UNS_ADMIN_PERM,
11201                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11202                                   NL80211_FLAG_NEED_RTNL,
11203         },
11204         {
11205                 .cmd = NL80211_CMD_TRIGGER_SCAN,
11206                 .doit = nl80211_trigger_scan,
11207                 .policy = nl80211_policy,
11208                 .flags = GENL_UNS_ADMIN_PERM,
11209                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11210                                   NL80211_FLAG_NEED_RTNL,
11211         },
11212         {
11213                 .cmd = NL80211_CMD_ABORT_SCAN,
11214                 .doit = nl80211_abort_scan,
11215                 .policy = nl80211_policy,
11216                 .flags = GENL_UNS_ADMIN_PERM,
11217                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11218                                   NL80211_FLAG_NEED_RTNL,
11219         },
11220         {
11221                 .cmd = NL80211_CMD_GET_SCAN,
11222                 .policy = nl80211_policy,
11223                 .dumpit = nl80211_dump_scan,
11224         },
11225         {
11226                 .cmd = NL80211_CMD_START_SCHED_SCAN,
11227                 .doit = nl80211_start_sched_scan,
11228                 .policy = nl80211_policy,
11229                 .flags = GENL_UNS_ADMIN_PERM,
11230                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11231                                   NL80211_FLAG_NEED_RTNL,
11232         },
11233         {
11234                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
11235                 .doit = nl80211_stop_sched_scan,
11236                 .policy = nl80211_policy,
11237                 .flags = GENL_UNS_ADMIN_PERM,
11238                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11239                                   NL80211_FLAG_NEED_RTNL,
11240         },
11241         {
11242                 .cmd = NL80211_CMD_AUTHENTICATE,
11243                 .doit = nl80211_authenticate,
11244                 .policy = nl80211_policy,
11245                 .flags = GENL_UNS_ADMIN_PERM,
11246                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11247                                   NL80211_FLAG_NEED_RTNL |
11248                                   NL80211_FLAG_CLEAR_SKB,
11249         },
11250         {
11251                 .cmd = NL80211_CMD_ASSOCIATE,
11252                 .doit = nl80211_associate,
11253                 .policy = nl80211_policy,
11254                 .flags = GENL_UNS_ADMIN_PERM,
11255                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11256                                   NL80211_FLAG_NEED_RTNL,
11257         },
11258         {
11259                 .cmd = NL80211_CMD_DEAUTHENTICATE,
11260                 .doit = nl80211_deauthenticate,
11261                 .policy = nl80211_policy,
11262                 .flags = GENL_UNS_ADMIN_PERM,
11263                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11264                                   NL80211_FLAG_NEED_RTNL,
11265         },
11266         {
11267                 .cmd = NL80211_CMD_DISASSOCIATE,
11268                 .doit = nl80211_disassociate,
11269                 .policy = nl80211_policy,
11270                 .flags = GENL_UNS_ADMIN_PERM,
11271                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11272                                   NL80211_FLAG_NEED_RTNL,
11273         },
11274         {
11275                 .cmd = NL80211_CMD_JOIN_IBSS,
11276                 .doit = nl80211_join_ibss,
11277                 .policy = nl80211_policy,
11278                 .flags = GENL_UNS_ADMIN_PERM,
11279                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11280                                   NL80211_FLAG_NEED_RTNL,
11281         },
11282         {
11283                 .cmd = NL80211_CMD_LEAVE_IBSS,
11284                 .doit = nl80211_leave_ibss,
11285                 .policy = nl80211_policy,
11286                 .flags = GENL_UNS_ADMIN_PERM,
11287                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11288                                   NL80211_FLAG_NEED_RTNL,
11289         },
11290 #ifdef CONFIG_NL80211_TESTMODE
11291         {
11292                 .cmd = NL80211_CMD_TESTMODE,
11293                 .doit = nl80211_testmode_do,
11294                 .dumpit = nl80211_testmode_dump,
11295                 .policy = nl80211_policy,
11296                 .flags = GENL_UNS_ADMIN_PERM,
11297                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11298                                   NL80211_FLAG_NEED_RTNL,
11299         },
11300 #endif
11301         {
11302                 .cmd = NL80211_CMD_CONNECT,
11303                 .doit = nl80211_connect,
11304                 .policy = nl80211_policy,
11305                 .flags = GENL_UNS_ADMIN_PERM,
11306                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11307                                   NL80211_FLAG_NEED_RTNL,
11308         },
11309         {
11310                 .cmd = NL80211_CMD_DISCONNECT,
11311                 .doit = nl80211_disconnect,
11312                 .policy = nl80211_policy,
11313                 .flags = GENL_UNS_ADMIN_PERM,
11314                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11315                                   NL80211_FLAG_NEED_RTNL,
11316         },
11317         {
11318                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
11319                 .doit = nl80211_wiphy_netns,
11320                 .policy = nl80211_policy,
11321                 .flags = GENL_UNS_ADMIN_PERM,
11322                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11323                                   NL80211_FLAG_NEED_RTNL,
11324         },
11325         {
11326                 .cmd = NL80211_CMD_GET_SURVEY,
11327                 .policy = nl80211_policy,
11328                 .dumpit = nl80211_dump_survey,
11329         },
11330         {
11331                 .cmd = NL80211_CMD_SET_PMKSA,
11332                 .doit = nl80211_setdel_pmksa,
11333                 .policy = nl80211_policy,
11334                 .flags = GENL_UNS_ADMIN_PERM,
11335                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11336                                   NL80211_FLAG_NEED_RTNL,
11337         },
11338         {
11339                 .cmd = NL80211_CMD_DEL_PMKSA,
11340                 .doit = nl80211_setdel_pmksa,
11341                 .policy = nl80211_policy,
11342                 .flags = GENL_UNS_ADMIN_PERM,
11343                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11344                                   NL80211_FLAG_NEED_RTNL,
11345         },
11346         {
11347                 .cmd = NL80211_CMD_FLUSH_PMKSA,
11348                 .doit = nl80211_flush_pmksa,
11349                 .policy = nl80211_policy,
11350                 .flags = GENL_UNS_ADMIN_PERM,
11351                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11352                                   NL80211_FLAG_NEED_RTNL,
11353         },
11354         {
11355                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
11356                 .doit = nl80211_remain_on_channel,
11357                 .policy = nl80211_policy,
11358                 .flags = GENL_UNS_ADMIN_PERM,
11359                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11360                                   NL80211_FLAG_NEED_RTNL,
11361         },
11362         {
11363                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
11364                 .doit = nl80211_cancel_remain_on_channel,
11365                 .policy = nl80211_policy,
11366                 .flags = GENL_UNS_ADMIN_PERM,
11367                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11368                                   NL80211_FLAG_NEED_RTNL,
11369         },
11370         {
11371                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
11372                 .doit = nl80211_set_tx_bitrate_mask,
11373                 .policy = nl80211_policy,
11374                 .flags = GENL_UNS_ADMIN_PERM,
11375                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11376                                   NL80211_FLAG_NEED_RTNL,
11377         },
11378         {
11379                 .cmd = NL80211_CMD_REGISTER_FRAME,
11380                 .doit = nl80211_register_mgmt,
11381                 .policy = nl80211_policy,
11382                 .flags = GENL_UNS_ADMIN_PERM,
11383                 .internal_flags = NL80211_FLAG_NEED_WDEV |
11384                                   NL80211_FLAG_NEED_RTNL,
11385         },
11386         {
11387                 .cmd = NL80211_CMD_FRAME,
11388                 .doit = nl80211_tx_mgmt,
11389                 .policy = nl80211_policy,
11390                 .flags = GENL_UNS_ADMIN_PERM,
11391                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11392                                   NL80211_FLAG_NEED_RTNL,
11393         },
11394         {
11395                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
11396                 .doit = nl80211_tx_mgmt_cancel_wait,
11397                 .policy = nl80211_policy,
11398                 .flags = GENL_UNS_ADMIN_PERM,
11399                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11400                                   NL80211_FLAG_NEED_RTNL,
11401         },
11402         {
11403                 .cmd = NL80211_CMD_SET_POWER_SAVE,
11404                 .doit = nl80211_set_power_save,
11405                 .policy = nl80211_policy,
11406                 .flags = GENL_UNS_ADMIN_PERM,
11407                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11408                                   NL80211_FLAG_NEED_RTNL,
11409         },
11410         {
11411                 .cmd = NL80211_CMD_GET_POWER_SAVE,
11412                 .doit = nl80211_get_power_save,
11413                 .policy = nl80211_policy,
11414                 /* can be retrieved by unprivileged users */
11415                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11416                                   NL80211_FLAG_NEED_RTNL,
11417         },
11418         {
11419                 .cmd = NL80211_CMD_SET_CQM,
11420                 .doit = nl80211_set_cqm,
11421                 .policy = nl80211_policy,
11422                 .flags = GENL_UNS_ADMIN_PERM,
11423                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11424                                   NL80211_FLAG_NEED_RTNL,
11425         },
11426         {
11427                 .cmd = NL80211_CMD_SET_CHANNEL,
11428                 .doit = nl80211_set_channel,
11429                 .policy = nl80211_policy,
11430                 .flags = GENL_UNS_ADMIN_PERM,
11431                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11432                                   NL80211_FLAG_NEED_RTNL,
11433         },
11434         {
11435                 .cmd = NL80211_CMD_SET_WDS_PEER,
11436                 .doit = nl80211_set_wds_peer,
11437                 .policy = nl80211_policy,
11438                 .flags = GENL_UNS_ADMIN_PERM,
11439                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11440                                   NL80211_FLAG_NEED_RTNL,
11441         },
11442         {
11443                 .cmd = NL80211_CMD_JOIN_MESH,
11444                 .doit = nl80211_join_mesh,
11445                 .policy = nl80211_policy,
11446                 .flags = GENL_UNS_ADMIN_PERM,
11447                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11448                                   NL80211_FLAG_NEED_RTNL,
11449         },
11450         {
11451                 .cmd = NL80211_CMD_LEAVE_MESH,
11452                 .doit = nl80211_leave_mesh,
11453                 .policy = nl80211_policy,
11454                 .flags = GENL_UNS_ADMIN_PERM,
11455                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11456                                   NL80211_FLAG_NEED_RTNL,
11457         },
11458         {
11459                 .cmd = NL80211_CMD_JOIN_OCB,
11460                 .doit = nl80211_join_ocb,
11461                 .policy = nl80211_policy,
11462                 .flags = GENL_UNS_ADMIN_PERM,
11463                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11464                                   NL80211_FLAG_NEED_RTNL,
11465         },
11466         {
11467                 .cmd = NL80211_CMD_LEAVE_OCB,
11468                 .doit = nl80211_leave_ocb,
11469                 .policy = nl80211_policy,
11470                 .flags = GENL_UNS_ADMIN_PERM,
11471                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11472                                   NL80211_FLAG_NEED_RTNL,
11473         },
11474 #ifdef CONFIG_PM
11475         {
11476                 .cmd = NL80211_CMD_GET_WOWLAN,
11477                 .doit = nl80211_get_wowlan,
11478                 .policy = nl80211_policy,
11479                 /* can be retrieved by unprivileged users */
11480                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11481                                   NL80211_FLAG_NEED_RTNL,
11482         },
11483         {
11484                 .cmd = NL80211_CMD_SET_WOWLAN,
11485                 .doit = nl80211_set_wowlan,
11486                 .policy = nl80211_policy,
11487                 .flags = GENL_UNS_ADMIN_PERM,
11488                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11489                                   NL80211_FLAG_NEED_RTNL,
11490         },
11491 #endif
11492         {
11493                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
11494                 .doit = nl80211_set_rekey_data,
11495                 .policy = nl80211_policy,
11496                 .flags = GENL_UNS_ADMIN_PERM,
11497                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11498                                   NL80211_FLAG_NEED_RTNL |
11499                                   NL80211_FLAG_CLEAR_SKB,
11500         },
11501         {
11502                 .cmd = NL80211_CMD_TDLS_MGMT,
11503                 .doit = nl80211_tdls_mgmt,
11504                 .policy = nl80211_policy,
11505                 .flags = GENL_UNS_ADMIN_PERM,
11506                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11507                                   NL80211_FLAG_NEED_RTNL,
11508         },
11509         {
11510                 .cmd = NL80211_CMD_TDLS_OPER,
11511                 .doit = nl80211_tdls_oper,
11512                 .policy = nl80211_policy,
11513                 .flags = GENL_UNS_ADMIN_PERM,
11514                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11515                                   NL80211_FLAG_NEED_RTNL,
11516         },
11517         {
11518                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
11519                 .doit = nl80211_register_unexpected_frame,
11520                 .policy = nl80211_policy,
11521                 .flags = GENL_UNS_ADMIN_PERM,
11522                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11523                                   NL80211_FLAG_NEED_RTNL,
11524         },
11525         {
11526                 .cmd = NL80211_CMD_PROBE_CLIENT,
11527                 .doit = nl80211_probe_client,
11528                 .policy = nl80211_policy,
11529                 .flags = GENL_UNS_ADMIN_PERM,
11530                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11531                                   NL80211_FLAG_NEED_RTNL,
11532         },
11533         {
11534                 .cmd = NL80211_CMD_REGISTER_BEACONS,
11535                 .doit = nl80211_register_beacons,
11536                 .policy = nl80211_policy,
11537                 .flags = GENL_UNS_ADMIN_PERM,
11538                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11539                                   NL80211_FLAG_NEED_RTNL,
11540         },
11541         {
11542                 .cmd = NL80211_CMD_SET_NOACK_MAP,
11543                 .doit = nl80211_set_noack_map,
11544                 .policy = nl80211_policy,
11545                 .flags = GENL_UNS_ADMIN_PERM,
11546                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11547                                   NL80211_FLAG_NEED_RTNL,
11548         },
11549         {
11550                 .cmd = NL80211_CMD_START_P2P_DEVICE,
11551                 .doit = nl80211_start_p2p_device,
11552                 .policy = nl80211_policy,
11553                 .flags = GENL_UNS_ADMIN_PERM,
11554                 .internal_flags = NL80211_FLAG_NEED_WDEV |
11555                                   NL80211_FLAG_NEED_RTNL,
11556         },
11557         {
11558                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
11559                 .doit = nl80211_stop_p2p_device,
11560                 .policy = nl80211_policy,
11561                 .flags = GENL_UNS_ADMIN_PERM,
11562                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11563                                   NL80211_FLAG_NEED_RTNL,
11564         },
11565         {
11566                 .cmd = NL80211_CMD_SET_MCAST_RATE,
11567                 .doit = nl80211_set_mcast_rate,
11568                 .policy = nl80211_policy,
11569                 .flags = GENL_UNS_ADMIN_PERM,
11570                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11571                                   NL80211_FLAG_NEED_RTNL,
11572         },
11573         {
11574                 .cmd = NL80211_CMD_SET_MAC_ACL,
11575                 .doit = nl80211_set_mac_acl,
11576                 .policy = nl80211_policy,
11577                 .flags = GENL_UNS_ADMIN_PERM,
11578                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11579                                   NL80211_FLAG_NEED_RTNL,
11580         },
11581         {
11582                 .cmd = NL80211_CMD_RADAR_DETECT,
11583                 .doit = nl80211_start_radar_detection,
11584                 .policy = nl80211_policy,
11585                 .flags = GENL_UNS_ADMIN_PERM,
11586                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11587                                   NL80211_FLAG_NEED_RTNL,
11588         },
11589         {
11590                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
11591                 .doit = nl80211_get_protocol_features,
11592                 .policy = nl80211_policy,
11593         },
11594         {
11595                 .cmd = NL80211_CMD_UPDATE_FT_IES,
11596                 .doit = nl80211_update_ft_ies,
11597                 .policy = nl80211_policy,
11598                 .flags = GENL_UNS_ADMIN_PERM,
11599                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11600                                   NL80211_FLAG_NEED_RTNL,
11601         },
11602         {
11603                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
11604                 .doit = nl80211_crit_protocol_start,
11605                 .policy = nl80211_policy,
11606                 .flags = GENL_UNS_ADMIN_PERM,
11607                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11608                                   NL80211_FLAG_NEED_RTNL,
11609         },
11610         {
11611                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
11612                 .doit = nl80211_crit_protocol_stop,
11613                 .policy = nl80211_policy,
11614                 .flags = GENL_UNS_ADMIN_PERM,
11615                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11616                                   NL80211_FLAG_NEED_RTNL,
11617         },
11618         {
11619                 .cmd = NL80211_CMD_GET_COALESCE,
11620                 .doit = nl80211_get_coalesce,
11621                 .policy = nl80211_policy,
11622                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11623                                   NL80211_FLAG_NEED_RTNL,
11624         },
11625         {
11626                 .cmd = NL80211_CMD_SET_COALESCE,
11627                 .doit = nl80211_set_coalesce,
11628                 .policy = nl80211_policy,
11629                 .flags = GENL_UNS_ADMIN_PERM,
11630                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11631                                   NL80211_FLAG_NEED_RTNL,
11632         },
11633         {
11634                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
11635                 .doit = nl80211_channel_switch,
11636                 .policy = nl80211_policy,
11637                 .flags = GENL_UNS_ADMIN_PERM,
11638                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11639                                   NL80211_FLAG_NEED_RTNL,
11640         },
11641         {
11642                 .cmd = NL80211_CMD_VENDOR,
11643                 .doit = nl80211_vendor_cmd,
11644                 .dumpit = nl80211_vendor_cmd_dump,
11645                 .policy = nl80211_policy,
11646                 .flags = GENL_UNS_ADMIN_PERM,
11647                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11648                                   NL80211_FLAG_NEED_RTNL,
11649         },
11650         {
11651                 .cmd = NL80211_CMD_SET_QOS_MAP,
11652                 .doit = nl80211_set_qos_map,
11653                 .policy = nl80211_policy,
11654                 .flags = GENL_UNS_ADMIN_PERM,
11655                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11656                                   NL80211_FLAG_NEED_RTNL,
11657         },
11658         {
11659                 .cmd = NL80211_CMD_ADD_TX_TS,
11660                 .doit = nl80211_add_tx_ts,
11661                 .policy = nl80211_policy,
11662                 .flags = GENL_UNS_ADMIN_PERM,
11663                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11664                                   NL80211_FLAG_NEED_RTNL,
11665         },
11666         {
11667                 .cmd = NL80211_CMD_DEL_TX_TS,
11668                 .doit = nl80211_del_tx_ts,
11669                 .policy = nl80211_policy,
11670                 .flags = GENL_UNS_ADMIN_PERM,
11671                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11672                                   NL80211_FLAG_NEED_RTNL,
11673         },
11674         {
11675                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
11676                 .doit = nl80211_tdls_channel_switch,
11677                 .policy = nl80211_policy,
11678                 .flags = GENL_UNS_ADMIN_PERM,
11679                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11680                                   NL80211_FLAG_NEED_RTNL,
11681         },
11682         {
11683                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
11684                 .doit = nl80211_tdls_cancel_channel_switch,
11685                 .policy = nl80211_policy,
11686                 .flags = GENL_UNS_ADMIN_PERM,
11687                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11688                                   NL80211_FLAG_NEED_RTNL,
11689         },
11690 };
11691
11692 /* notification functions */
11693
11694 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
11695                           enum nl80211_commands cmd)
11696 {
11697         struct sk_buff *msg;
11698         struct nl80211_dump_wiphy_state state = {};
11699
11700         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
11701                 cmd != NL80211_CMD_DEL_WIPHY);
11702
11703         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11704         if (!msg)
11705                 return;
11706
11707         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
11708                 nlmsg_free(msg);
11709                 return;
11710         }
11711
11712         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11713                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
11714 }
11715
11716 static int nl80211_add_scan_req(struct sk_buff *msg,
11717                                 struct cfg80211_registered_device *rdev)
11718 {
11719         struct cfg80211_scan_request *req = rdev->scan_req;
11720         struct nlattr *nest;
11721         int i;
11722
11723         if (WARN_ON(!req))
11724                 return 0;
11725
11726         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
11727         if (!nest)
11728                 goto nla_put_failure;
11729         for (i = 0; i < req->n_ssids; i++) {
11730                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
11731                         goto nla_put_failure;
11732         }
11733         nla_nest_end(msg, nest);
11734
11735         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
11736         if (!nest)
11737                 goto nla_put_failure;
11738         for (i = 0; i < req->n_channels; i++) {
11739                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
11740                         goto nla_put_failure;
11741         }
11742         nla_nest_end(msg, nest);
11743
11744         if (req->ie &&
11745             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
11746                 goto nla_put_failure;
11747
11748         if (req->flags &&
11749             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
11750                 goto nla_put_failure;
11751
11752         return 0;
11753  nla_put_failure:
11754         return -ENOBUFS;
11755 }
11756
11757 static int nl80211_send_scan_msg(struct sk_buff *msg,
11758                                  struct cfg80211_registered_device *rdev,
11759                                  struct wireless_dev *wdev,
11760                                  u32 portid, u32 seq, int flags,
11761                                  u32 cmd)
11762 {
11763         void *hdr;
11764
11765         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
11766         if (!hdr)
11767                 return -1;
11768
11769         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11770             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11771                                          wdev->netdev->ifindex)) ||
11772             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
11773                               NL80211_ATTR_PAD))
11774                 goto nla_put_failure;
11775
11776         /* ignore errors and send incomplete event anyway */
11777         nl80211_add_scan_req(msg, rdev);
11778
11779         genlmsg_end(msg, hdr);
11780         return 0;
11781
11782  nla_put_failure:
11783         genlmsg_cancel(msg, hdr);
11784         return -EMSGSIZE;
11785 }
11786
11787 static int
11788 nl80211_send_sched_scan_msg(struct sk_buff *msg,
11789                             struct cfg80211_registered_device *rdev,
11790                             struct net_device *netdev,
11791                             u32 portid, u32 seq, int flags, u32 cmd)
11792 {
11793         void *hdr;
11794
11795         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
11796         if (!hdr)
11797                 return -1;
11798
11799         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11800             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
11801                 goto nla_put_failure;
11802
11803         genlmsg_end(msg, hdr);
11804         return 0;
11805
11806  nla_put_failure:
11807         genlmsg_cancel(msg, hdr);
11808         return -EMSGSIZE;
11809 }
11810
11811 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
11812                              struct wireless_dev *wdev)
11813 {
11814         struct sk_buff *msg;
11815
11816         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11817         if (!msg)
11818                 return;
11819
11820         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
11821                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
11822                 nlmsg_free(msg);
11823                 return;
11824         }
11825
11826         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11827                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
11828 }
11829
11830 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
11831                                        struct wireless_dev *wdev, bool aborted)
11832 {
11833         struct sk_buff *msg;
11834
11835         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11836         if (!msg)
11837                 return NULL;
11838
11839         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
11840                                   aborted ? NL80211_CMD_SCAN_ABORTED :
11841                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
11842                 nlmsg_free(msg);
11843                 return NULL;
11844         }
11845
11846         return msg;
11847 }
11848
11849 void nl80211_send_scan_result(struct cfg80211_registered_device *rdev,
11850                               struct sk_buff *msg)
11851 {
11852         if (!msg)
11853                 return;
11854
11855         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11856                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
11857 }
11858
11859 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
11860                                      struct net_device *netdev)
11861 {
11862         struct sk_buff *msg;
11863
11864         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11865         if (!msg)
11866                 return;
11867
11868         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
11869                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
11870                 nlmsg_free(msg);
11871                 return;
11872         }
11873
11874         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11875                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
11876 }
11877
11878 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
11879                              struct net_device *netdev, u32 cmd)
11880 {
11881         struct sk_buff *msg;
11882
11883         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11884         if (!msg)
11885                 return;
11886
11887         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
11888                 nlmsg_free(msg);
11889                 return;
11890         }
11891
11892         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11893                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
11894 }
11895
11896 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
11897                                           struct regulatory_request *request)
11898 {
11899         /* Userspace can always count this one always being set */
11900         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
11901                 goto nla_put_failure;
11902
11903         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
11904                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
11905                                NL80211_REGDOM_TYPE_WORLD))
11906                         goto nla_put_failure;
11907         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
11908                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
11909                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
11910                         goto nla_put_failure;
11911         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
11912                    request->intersect) {
11913                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
11914                                NL80211_REGDOM_TYPE_INTERSECTION))
11915                         goto nla_put_failure;
11916         } else {
11917                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
11918                                NL80211_REGDOM_TYPE_COUNTRY) ||
11919                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
11920                                    request->alpha2))
11921                         goto nla_put_failure;
11922         }
11923
11924         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
11925                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
11926
11927                 if (wiphy &&
11928                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
11929                         goto nla_put_failure;
11930
11931                 if (wiphy &&
11932                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
11933                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
11934                         goto nla_put_failure;
11935         }
11936
11937         return true;
11938
11939 nla_put_failure:
11940         return false;
11941 }
11942
11943 /*
11944  * This can happen on global regulatory changes or device specific settings
11945  * based on custom regulatory domains.
11946  */
11947 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
11948                                      struct regulatory_request *request)
11949 {
11950         struct sk_buff *msg;
11951         void *hdr;
11952
11953         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11954         if (!msg)
11955                 return;
11956
11957         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
11958         if (!hdr) {
11959                 nlmsg_free(msg);
11960                 return;
11961         }
11962
11963         if (nl80211_reg_change_event_fill(msg, request) == false)
11964                 goto nla_put_failure;
11965
11966         genlmsg_end(msg, hdr);
11967
11968         rcu_read_lock();
11969         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
11970                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
11971         rcu_read_unlock();
11972
11973         return;
11974
11975 nla_put_failure:
11976         genlmsg_cancel(msg, hdr);
11977         nlmsg_free(msg);
11978 }
11979
11980 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
11981                                     struct net_device *netdev,
11982                                     const u8 *buf, size_t len,
11983                                     enum nl80211_commands cmd, gfp_t gfp,
11984                                     int uapsd_queues)
11985 {
11986         struct sk_buff *msg;
11987         void *hdr;
11988
11989         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11990         if (!msg)
11991                 return;
11992
11993         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
11994         if (!hdr) {
11995                 nlmsg_free(msg);
11996                 return;
11997         }
11998
11999         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12000             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12001             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
12002                 goto nla_put_failure;
12003
12004         if (uapsd_queues >= 0) {
12005                 struct nlattr *nla_wmm =
12006                         nla_nest_start(msg, NL80211_ATTR_STA_WME);
12007                 if (!nla_wmm)
12008                         goto nla_put_failure;
12009
12010                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
12011                                uapsd_queues))
12012                         goto nla_put_failure;
12013
12014                 nla_nest_end(msg, nla_wmm);
12015         }
12016
12017         genlmsg_end(msg, hdr);
12018
12019         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12020                                 NL80211_MCGRP_MLME, gfp);
12021         return;
12022
12023  nla_put_failure:
12024         genlmsg_cancel(msg, hdr);
12025         nlmsg_free(msg);
12026 }
12027
12028 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
12029                           struct net_device *netdev, const u8 *buf,
12030                           size_t len, gfp_t gfp)
12031 {
12032         nl80211_send_mlme_event(rdev, netdev, buf, len,
12033                                 NL80211_CMD_AUTHENTICATE, gfp, -1);
12034 }
12035
12036 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
12037                            struct net_device *netdev, const u8 *buf,
12038                            size_t len, gfp_t gfp, int uapsd_queues)
12039 {
12040         nl80211_send_mlme_event(rdev, netdev, buf, len,
12041                                 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues);
12042 }
12043
12044 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
12045                          struct net_device *netdev, const u8 *buf,
12046                          size_t len, gfp_t gfp)
12047 {
12048         nl80211_send_mlme_event(rdev, netdev, buf, len,
12049                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1);
12050 }
12051
12052 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
12053                            struct net_device *netdev, const u8 *buf,
12054                            size_t len, gfp_t gfp)
12055 {
12056         nl80211_send_mlme_event(rdev, netdev, buf, len,
12057                                 NL80211_CMD_DISASSOCIATE, gfp, -1);
12058 }
12059
12060 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
12061                                   size_t len)
12062 {
12063         struct wireless_dev *wdev = dev->ieee80211_ptr;
12064         struct wiphy *wiphy = wdev->wiphy;
12065         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12066         const struct ieee80211_mgmt *mgmt = (void *)buf;
12067         u32 cmd;
12068
12069         if (WARN_ON(len < 2))
12070                 return;
12071
12072         if (ieee80211_is_deauth(mgmt->frame_control))
12073                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
12074         else
12075                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
12076
12077         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
12078         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1);
12079 }
12080 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
12081
12082 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
12083                                       struct net_device *netdev, int cmd,
12084                                       const u8 *addr, gfp_t gfp)
12085 {
12086         struct sk_buff *msg;
12087         void *hdr;
12088
12089         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12090         if (!msg)
12091                 return;
12092
12093         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
12094         if (!hdr) {
12095                 nlmsg_free(msg);
12096                 return;
12097         }
12098
12099         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12100             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12101             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
12102             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
12103                 goto nla_put_failure;
12104
12105         genlmsg_end(msg, hdr);
12106
12107         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12108                                 NL80211_MCGRP_MLME, gfp);
12109         return;
12110
12111  nla_put_failure:
12112         genlmsg_cancel(msg, hdr);
12113         nlmsg_free(msg);
12114 }
12115
12116 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
12117                                struct net_device *netdev, const u8 *addr,
12118                                gfp_t gfp)
12119 {
12120         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
12121                                   addr, gfp);
12122 }
12123
12124 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
12125                                 struct net_device *netdev, const u8 *addr,
12126                                 gfp_t gfp)
12127 {
12128         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
12129                                   addr, gfp);
12130 }
12131
12132 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
12133                                  struct net_device *netdev, const u8 *bssid,
12134                                  const u8 *req_ie, size_t req_ie_len,
12135                                  const u8 *resp_ie, size_t resp_ie_len,
12136                                  int status, gfp_t gfp)
12137 {
12138         struct sk_buff *msg;
12139         void *hdr;
12140
12141         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12142         if (!msg)
12143                 return;
12144
12145         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
12146         if (!hdr) {
12147                 nlmsg_free(msg);
12148                 return;
12149         }
12150
12151         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12152             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12153             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
12154             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
12155                         status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
12156                         status) ||
12157             (status < 0 && nla_put_flag(msg, NL80211_ATTR_TIMED_OUT)) ||
12158             (req_ie &&
12159              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
12160             (resp_ie &&
12161              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
12162                 goto nla_put_failure;
12163
12164         genlmsg_end(msg, hdr);
12165
12166         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12167                                 NL80211_MCGRP_MLME, gfp);
12168         return;
12169
12170  nla_put_failure:
12171         genlmsg_cancel(msg, hdr);
12172         nlmsg_free(msg);
12173
12174 }
12175
12176 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
12177                          struct net_device *netdev, const u8 *bssid,
12178                          const u8 *req_ie, size_t req_ie_len,
12179                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
12180 {
12181         struct sk_buff *msg;
12182         void *hdr;
12183
12184         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12185         if (!msg)
12186                 return;
12187
12188         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
12189         if (!hdr) {
12190                 nlmsg_free(msg);
12191                 return;
12192         }
12193
12194         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12195             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12196             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
12197             (req_ie &&
12198              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
12199             (resp_ie &&
12200              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
12201                 goto nla_put_failure;
12202
12203         genlmsg_end(msg, hdr);
12204
12205         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12206                                 NL80211_MCGRP_MLME, gfp);
12207         return;
12208
12209  nla_put_failure:
12210         genlmsg_cancel(msg, hdr);
12211         nlmsg_free(msg);
12212
12213 }
12214
12215 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
12216                                struct net_device *netdev, u16 reason,
12217                                const u8 *ie, size_t ie_len, bool from_ap)
12218 {
12219         struct sk_buff *msg;
12220         void *hdr;
12221
12222         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12223         if (!msg)
12224                 return;
12225
12226         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
12227         if (!hdr) {
12228                 nlmsg_free(msg);
12229                 return;
12230         }
12231
12232         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12233             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12234             (from_ap && reason &&
12235              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
12236             (from_ap &&
12237              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
12238             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
12239                 goto nla_put_failure;
12240
12241         genlmsg_end(msg, hdr);
12242
12243         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12244                                 NL80211_MCGRP_MLME, GFP_KERNEL);
12245         return;
12246
12247  nla_put_failure:
12248         genlmsg_cancel(msg, hdr);
12249         nlmsg_free(msg);
12250
12251 }
12252
12253 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
12254                              struct net_device *netdev, const u8 *bssid,
12255                              gfp_t gfp)
12256 {
12257         struct sk_buff *msg;
12258         void *hdr;
12259
12260         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12261         if (!msg)
12262                 return;
12263
12264         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
12265         if (!hdr) {
12266                 nlmsg_free(msg);
12267                 return;
12268         }
12269
12270         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12271             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12272             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
12273                 goto nla_put_failure;
12274
12275         genlmsg_end(msg, hdr);
12276
12277         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12278                                 NL80211_MCGRP_MLME, gfp);
12279         return;
12280
12281  nla_put_failure:
12282         genlmsg_cancel(msg, hdr);
12283         nlmsg_free(msg);
12284 }
12285
12286 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
12287                                         const u8* ie, u8 ie_len, gfp_t gfp)
12288 {
12289         struct wireless_dev *wdev = dev->ieee80211_ptr;
12290         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12291         struct sk_buff *msg;
12292         void *hdr;
12293
12294         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
12295                 return;
12296
12297         trace_cfg80211_notify_new_peer_candidate(dev, addr);
12298
12299         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12300         if (!msg)
12301                 return;
12302
12303         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
12304         if (!hdr) {
12305                 nlmsg_free(msg);
12306                 return;
12307         }
12308
12309         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12310             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
12311             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
12312             (ie_len && ie &&
12313              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
12314                 goto nla_put_failure;
12315
12316         genlmsg_end(msg, hdr);
12317
12318         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12319                                 NL80211_MCGRP_MLME, gfp);
12320         return;
12321
12322  nla_put_failure:
12323         genlmsg_cancel(msg, hdr);
12324         nlmsg_free(msg);
12325 }
12326 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
12327
12328 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
12329                                  struct net_device *netdev, const u8 *addr,
12330                                  enum nl80211_key_type key_type, int key_id,
12331                                  const u8 *tsc, gfp_t gfp)
12332 {
12333         struct sk_buff *msg;
12334         void *hdr;
12335
12336         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12337         if (!msg)
12338                 return;
12339
12340         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
12341         if (!hdr) {
12342                 nlmsg_free(msg);
12343                 return;
12344         }
12345
12346         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12347             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12348             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
12349             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
12350             (key_id != -1 &&
12351              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
12352             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
12353                 goto nla_put_failure;
12354
12355         genlmsg_end(msg, hdr);
12356
12357         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12358                                 NL80211_MCGRP_MLME, gfp);
12359         return;
12360
12361  nla_put_failure:
12362         genlmsg_cancel(msg, hdr);
12363         nlmsg_free(msg);
12364 }
12365
12366 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
12367                                     struct ieee80211_channel *channel_before,
12368                                     struct ieee80211_channel *channel_after)
12369 {
12370         struct sk_buff *msg;
12371         void *hdr;
12372         struct nlattr *nl_freq;
12373
12374         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
12375         if (!msg)
12376                 return;
12377
12378         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
12379         if (!hdr) {
12380                 nlmsg_free(msg);
12381                 return;
12382         }
12383
12384         /*
12385          * Since we are applying the beacon hint to a wiphy we know its
12386          * wiphy_idx is valid
12387          */
12388         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
12389                 goto nla_put_failure;
12390
12391         /* Before */
12392         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
12393         if (!nl_freq)
12394                 goto nla_put_failure;
12395         if (nl80211_msg_put_channel(msg, channel_before, false))
12396                 goto nla_put_failure;
12397         nla_nest_end(msg, nl_freq);
12398
12399         /* After */
12400         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
12401         if (!nl_freq)
12402                 goto nla_put_failure;
12403         if (nl80211_msg_put_channel(msg, channel_after, false))
12404                 goto nla_put_failure;
12405         nla_nest_end(msg, nl_freq);
12406
12407         genlmsg_end(msg, hdr);
12408
12409         rcu_read_lock();
12410         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
12411                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
12412         rcu_read_unlock();
12413
12414         return;
12415
12416 nla_put_failure:
12417         genlmsg_cancel(msg, hdr);
12418         nlmsg_free(msg);
12419 }
12420
12421 static void nl80211_send_remain_on_chan_event(
12422         int cmd, struct cfg80211_registered_device *rdev,
12423         struct wireless_dev *wdev, u64 cookie,
12424         struct ieee80211_channel *chan,
12425         unsigned int duration, gfp_t gfp)
12426 {
12427         struct sk_buff *msg;
12428         void *hdr;
12429
12430         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12431         if (!msg)
12432                 return;
12433
12434         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
12435         if (!hdr) {
12436                 nlmsg_free(msg);
12437                 return;
12438         }
12439
12440         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12441             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12442                                          wdev->netdev->ifindex)) ||
12443             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12444                               NL80211_ATTR_PAD) ||
12445             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
12446             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
12447                         NL80211_CHAN_NO_HT) ||
12448             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12449                               NL80211_ATTR_PAD))
12450                 goto nla_put_failure;
12451
12452         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
12453             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
12454                 goto nla_put_failure;
12455
12456         genlmsg_end(msg, hdr);
12457
12458         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12459                                 NL80211_MCGRP_MLME, gfp);
12460         return;
12461
12462  nla_put_failure:
12463         genlmsg_cancel(msg, hdr);
12464         nlmsg_free(msg);
12465 }
12466
12467 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
12468                                struct ieee80211_channel *chan,
12469                                unsigned int duration, gfp_t gfp)
12470 {
12471         struct wiphy *wiphy = wdev->wiphy;
12472         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12473
12474         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
12475         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
12476                                           rdev, wdev, cookie, chan,
12477                                           duration, gfp);
12478 }
12479 EXPORT_SYMBOL(cfg80211_ready_on_channel);
12480
12481 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
12482                                         struct ieee80211_channel *chan,
12483                                         gfp_t gfp)
12484 {
12485         struct wiphy *wiphy = wdev->wiphy;
12486         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12487
12488         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
12489         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
12490                                           rdev, wdev, cookie, chan, 0, gfp);
12491 }
12492 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
12493
12494 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
12495                       struct station_info *sinfo, gfp_t gfp)
12496 {
12497         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
12498         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12499         struct sk_buff *msg;
12500
12501         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
12502
12503         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12504         if (!msg)
12505                 return;
12506
12507         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
12508                                  rdev, dev, mac_addr, sinfo) < 0) {
12509                 nlmsg_free(msg);
12510                 return;
12511         }
12512
12513         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12514                                 NL80211_MCGRP_MLME, gfp);
12515 }
12516 EXPORT_SYMBOL(cfg80211_new_sta);
12517
12518 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
12519                             struct station_info *sinfo, gfp_t gfp)
12520 {
12521         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
12522         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12523         struct sk_buff *msg;
12524         struct station_info empty_sinfo = {};
12525
12526         if (!sinfo)
12527                 sinfo = &empty_sinfo;
12528
12529         trace_cfg80211_del_sta(dev, mac_addr);
12530
12531         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12532         if (!msg)
12533                 return;
12534
12535         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
12536                                  rdev, dev, mac_addr, sinfo) < 0) {
12537                 nlmsg_free(msg);
12538                 return;
12539         }
12540
12541         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12542                                 NL80211_MCGRP_MLME, gfp);
12543 }
12544 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
12545
12546 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
12547                           enum nl80211_connect_failed_reason reason,
12548                           gfp_t gfp)
12549 {
12550         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
12551         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12552         struct sk_buff *msg;
12553         void *hdr;
12554
12555         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
12556         if (!msg)
12557                 return;
12558
12559         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
12560         if (!hdr) {
12561                 nlmsg_free(msg);
12562                 return;
12563         }
12564
12565         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
12566             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
12567             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
12568                 goto nla_put_failure;
12569
12570         genlmsg_end(msg, hdr);
12571
12572         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12573                                 NL80211_MCGRP_MLME, gfp);
12574         return;
12575
12576  nla_put_failure:
12577         genlmsg_cancel(msg, hdr);
12578         nlmsg_free(msg);
12579 }
12580 EXPORT_SYMBOL(cfg80211_conn_failed);
12581
12582 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
12583                                        const u8 *addr, gfp_t gfp)
12584 {
12585         struct wireless_dev *wdev = dev->ieee80211_ptr;
12586         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12587         struct sk_buff *msg;
12588         void *hdr;
12589         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
12590
12591         if (!nlportid)
12592                 return false;
12593
12594         msg = nlmsg_new(100, gfp);
12595         if (!msg)
12596                 return true;
12597
12598         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
12599         if (!hdr) {
12600                 nlmsg_free(msg);
12601                 return true;
12602         }
12603
12604         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12605             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
12606             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
12607                 goto nla_put_failure;
12608
12609         genlmsg_end(msg, hdr);
12610         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
12611         return true;
12612
12613  nla_put_failure:
12614         genlmsg_cancel(msg, hdr);
12615         nlmsg_free(msg);
12616         return true;
12617 }
12618
12619 bool cfg80211_rx_spurious_frame(struct net_device *dev,
12620                                 const u8 *addr, gfp_t gfp)
12621 {
12622         struct wireless_dev *wdev = dev->ieee80211_ptr;
12623         bool ret;
12624
12625         trace_cfg80211_rx_spurious_frame(dev, addr);
12626
12627         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
12628                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
12629                 trace_cfg80211_return_bool(false);
12630                 return false;
12631         }
12632         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
12633                                          addr, gfp);
12634         trace_cfg80211_return_bool(ret);
12635         return ret;
12636 }
12637 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
12638
12639 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
12640                                         const u8 *addr, gfp_t gfp)
12641 {
12642         struct wireless_dev *wdev = dev->ieee80211_ptr;
12643         bool ret;
12644
12645         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
12646
12647         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
12648                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
12649                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
12650                 trace_cfg80211_return_bool(false);
12651                 return false;
12652         }
12653         ret = __nl80211_unexpected_frame(dev,
12654                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
12655                                          addr, gfp);
12656         trace_cfg80211_return_bool(ret);
12657         return ret;
12658 }
12659 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
12660
12661 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
12662                       struct wireless_dev *wdev, u32 nlportid,
12663                       int freq, int sig_dbm,
12664                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
12665 {
12666         struct net_device *netdev = wdev->netdev;
12667         struct sk_buff *msg;
12668         void *hdr;
12669
12670         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12671         if (!msg)
12672                 return -ENOMEM;
12673
12674         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
12675         if (!hdr) {
12676                 nlmsg_free(msg);
12677                 return -ENOMEM;
12678         }
12679
12680         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12681             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12682                                         netdev->ifindex)) ||
12683             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12684                               NL80211_ATTR_PAD) ||
12685             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
12686             (sig_dbm &&
12687              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
12688             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
12689             (flags &&
12690              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
12691                 goto nla_put_failure;
12692
12693         genlmsg_end(msg, hdr);
12694
12695         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
12696
12697  nla_put_failure:
12698         genlmsg_cancel(msg, hdr);
12699         nlmsg_free(msg);
12700         return -ENOBUFS;
12701 }
12702
12703 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
12704                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
12705 {
12706         struct wiphy *wiphy = wdev->wiphy;
12707         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12708         struct net_device *netdev = wdev->netdev;
12709         struct sk_buff *msg;
12710         void *hdr;
12711
12712         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
12713
12714         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12715         if (!msg)
12716                 return;
12717
12718         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
12719         if (!hdr) {
12720                 nlmsg_free(msg);
12721                 return;
12722         }
12723
12724         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12725             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12726                                    netdev->ifindex)) ||
12727             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12728                               NL80211_ATTR_PAD) ||
12729             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
12730             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12731                               NL80211_ATTR_PAD) ||
12732             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
12733                 goto nla_put_failure;
12734
12735         genlmsg_end(msg, hdr);
12736
12737         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12738                                 NL80211_MCGRP_MLME, gfp);
12739         return;
12740
12741  nla_put_failure:
12742         genlmsg_cancel(msg, hdr);
12743         nlmsg_free(msg);
12744 }
12745 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
12746
12747 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
12748                                             const char *mac, gfp_t gfp)
12749 {
12750         struct wireless_dev *wdev = dev->ieee80211_ptr;
12751         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12752         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12753         void **cb;
12754
12755         if (!msg)
12756                 return NULL;
12757
12758         cb = (void **)msg->cb;
12759
12760         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
12761         if (!cb[0]) {
12762                 nlmsg_free(msg);
12763                 return NULL;
12764         }
12765
12766         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12767             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
12768                 goto nla_put_failure;
12769
12770         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
12771                 goto nla_put_failure;
12772
12773         cb[1] = nla_nest_start(msg, NL80211_ATTR_CQM);
12774         if (!cb[1])
12775                 goto nla_put_failure;
12776
12777         cb[2] = rdev;
12778
12779         return msg;
12780  nla_put_failure:
12781         nlmsg_free(msg);
12782         return NULL;
12783 }
12784
12785 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
12786 {
12787         void **cb = (void **)msg->cb;
12788         struct cfg80211_registered_device *rdev = cb[2];
12789
12790         nla_nest_end(msg, cb[1]);
12791         genlmsg_end(msg, cb[0]);
12792
12793         memset(msg->cb, 0, sizeof(msg->cb));
12794
12795         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12796                                 NL80211_MCGRP_MLME, gfp);
12797 }
12798
12799 void cfg80211_cqm_rssi_notify(struct net_device *dev,
12800                               enum nl80211_cqm_rssi_threshold_event rssi_event,
12801                               gfp_t gfp)
12802 {
12803         struct sk_buff *msg;
12804
12805         trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
12806
12807         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
12808                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
12809                 return;
12810
12811         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
12812         if (!msg)
12813                 return;
12814
12815         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
12816                         rssi_event))
12817                 goto nla_put_failure;
12818
12819         cfg80211_send_cqm(msg, gfp);
12820
12821         return;
12822
12823  nla_put_failure:
12824         nlmsg_free(msg);
12825 }
12826 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
12827
12828 void cfg80211_cqm_txe_notify(struct net_device *dev,
12829                              const u8 *peer, u32 num_packets,
12830                              u32 rate, u32 intvl, gfp_t gfp)
12831 {
12832         struct sk_buff *msg;
12833
12834         msg = cfg80211_prepare_cqm(dev, peer, gfp);
12835         if (!msg)
12836                 return;
12837
12838         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
12839                 goto nla_put_failure;
12840
12841         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
12842                 goto nla_put_failure;
12843
12844         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
12845                 goto nla_put_failure;
12846
12847         cfg80211_send_cqm(msg, gfp);
12848         return;
12849
12850  nla_put_failure:
12851         nlmsg_free(msg);
12852 }
12853 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
12854
12855 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
12856                                  const u8 *peer, u32 num_packets, gfp_t gfp)
12857 {
12858         struct sk_buff *msg;
12859
12860         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
12861
12862         msg = cfg80211_prepare_cqm(dev, peer, gfp);
12863         if (!msg)
12864                 return;
12865
12866         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
12867                 goto nla_put_failure;
12868
12869         cfg80211_send_cqm(msg, gfp);
12870         return;
12871
12872  nla_put_failure:
12873         nlmsg_free(msg);
12874 }
12875 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
12876
12877 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
12878 {
12879         struct sk_buff *msg;
12880
12881         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
12882         if (!msg)
12883                 return;
12884
12885         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
12886                 goto nla_put_failure;
12887
12888         cfg80211_send_cqm(msg, gfp);
12889         return;
12890
12891  nla_put_failure:
12892         nlmsg_free(msg);
12893 }
12894 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
12895
12896 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
12897                                      struct net_device *netdev, const u8 *bssid,
12898                                      const u8 *replay_ctr, gfp_t gfp)
12899 {
12900         struct sk_buff *msg;
12901         struct nlattr *rekey_attr;
12902         void *hdr;
12903
12904         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12905         if (!msg)
12906                 return;
12907
12908         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
12909         if (!hdr) {
12910                 nlmsg_free(msg);
12911                 return;
12912         }
12913
12914         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12915             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12916             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
12917                 goto nla_put_failure;
12918
12919         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
12920         if (!rekey_attr)
12921                 goto nla_put_failure;
12922
12923         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
12924                     NL80211_REPLAY_CTR_LEN, replay_ctr))
12925                 goto nla_put_failure;
12926
12927         nla_nest_end(msg, rekey_attr);
12928
12929         genlmsg_end(msg, hdr);
12930
12931         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12932                                 NL80211_MCGRP_MLME, gfp);
12933         return;
12934
12935  nla_put_failure:
12936         genlmsg_cancel(msg, hdr);
12937         nlmsg_free(msg);
12938 }
12939
12940 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
12941                                const u8 *replay_ctr, gfp_t gfp)
12942 {
12943         struct wireless_dev *wdev = dev->ieee80211_ptr;
12944         struct wiphy *wiphy = wdev->wiphy;
12945         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12946
12947         trace_cfg80211_gtk_rekey_notify(dev, bssid);
12948         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
12949 }
12950 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
12951
12952 static void
12953 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
12954                                struct net_device *netdev, int index,
12955                                const u8 *bssid, bool preauth, gfp_t gfp)
12956 {
12957         struct sk_buff *msg;
12958         struct nlattr *attr;
12959         void *hdr;
12960
12961         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12962         if (!msg)
12963                 return;
12964
12965         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
12966         if (!hdr) {
12967                 nlmsg_free(msg);
12968                 return;
12969         }
12970
12971         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12972             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
12973                 goto nla_put_failure;
12974
12975         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
12976         if (!attr)
12977                 goto nla_put_failure;
12978
12979         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
12980             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
12981             (preauth &&
12982              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
12983                 goto nla_put_failure;
12984
12985         nla_nest_end(msg, attr);
12986
12987         genlmsg_end(msg, hdr);
12988
12989         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12990                                 NL80211_MCGRP_MLME, gfp);
12991         return;
12992
12993  nla_put_failure:
12994         genlmsg_cancel(msg, hdr);
12995         nlmsg_free(msg);
12996 }
12997
12998 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
12999                                      const u8 *bssid, bool preauth, gfp_t gfp)
13000 {
13001         struct wireless_dev *wdev = dev->ieee80211_ptr;
13002         struct wiphy *wiphy = wdev->wiphy;
13003         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13004
13005         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
13006         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
13007 }
13008 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
13009
13010 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
13011                                      struct net_device *netdev,
13012                                      struct cfg80211_chan_def *chandef,
13013                                      gfp_t gfp,
13014                                      enum nl80211_commands notif,
13015                                      u8 count)
13016 {
13017         struct sk_buff *msg;
13018         void *hdr;
13019
13020         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13021         if (!msg)
13022                 return;
13023
13024         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
13025         if (!hdr) {
13026                 nlmsg_free(msg);
13027                 return;
13028         }
13029
13030         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
13031                 goto nla_put_failure;
13032
13033         if (nl80211_send_chandef(msg, chandef))
13034                 goto nla_put_failure;
13035
13036         if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
13037             (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
13038                         goto nla_put_failure;
13039
13040         genlmsg_end(msg, hdr);
13041
13042         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13043                                 NL80211_MCGRP_MLME, gfp);
13044         return;
13045
13046  nla_put_failure:
13047         genlmsg_cancel(msg, hdr);
13048         nlmsg_free(msg);
13049 }
13050
13051 void cfg80211_ch_switch_notify(struct net_device *dev,
13052                                struct cfg80211_chan_def *chandef)
13053 {
13054         struct wireless_dev *wdev = dev->ieee80211_ptr;
13055         struct wiphy *wiphy = wdev->wiphy;
13056         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13057
13058         ASSERT_WDEV_LOCK(wdev);
13059
13060         trace_cfg80211_ch_switch_notify(dev, chandef);
13061
13062         wdev->chandef = *chandef;
13063         wdev->preset_chandef = *chandef;
13064         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
13065                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0);
13066 }
13067 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
13068
13069 void cfg80211_ch_switch_started_notify(struct net_device *dev,
13070                                        struct cfg80211_chan_def *chandef,
13071                                        u8 count)
13072 {
13073         struct wireless_dev *wdev = dev->ieee80211_ptr;
13074         struct wiphy *wiphy = wdev->wiphy;
13075         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13076
13077         trace_cfg80211_ch_switch_started_notify(dev, chandef);
13078
13079         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
13080                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
13081 }
13082 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
13083
13084 void
13085 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
13086                      const struct cfg80211_chan_def *chandef,
13087                      enum nl80211_radar_event event,
13088                      struct net_device *netdev, gfp_t gfp)
13089 {
13090         struct sk_buff *msg;
13091         void *hdr;
13092
13093         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13094         if (!msg)
13095                 return;
13096
13097         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
13098         if (!hdr) {
13099                 nlmsg_free(msg);
13100                 return;
13101         }
13102
13103         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
13104                 goto nla_put_failure;
13105
13106         /* NOP and radar events don't need a netdev parameter */
13107         if (netdev) {
13108                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
13109
13110                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13111                     nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13112                                       NL80211_ATTR_PAD))
13113                         goto nla_put_failure;
13114         }
13115
13116         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
13117                 goto nla_put_failure;
13118
13119         if (nl80211_send_chandef(msg, chandef))
13120                 goto nla_put_failure;
13121
13122         genlmsg_end(msg, hdr);
13123
13124         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13125                                 NL80211_MCGRP_MLME, gfp);
13126         return;
13127
13128  nla_put_failure:
13129         genlmsg_cancel(msg, hdr);
13130         nlmsg_free(msg);
13131 }
13132
13133 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
13134                            u64 cookie, bool acked, gfp_t gfp)
13135 {
13136         struct wireless_dev *wdev = dev->ieee80211_ptr;
13137         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
13138         struct sk_buff *msg;
13139         void *hdr;
13140
13141         trace_cfg80211_probe_status(dev, addr, cookie, acked);
13142
13143         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13144
13145         if (!msg)
13146                 return;
13147
13148         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
13149         if (!hdr) {
13150                 nlmsg_free(msg);
13151                 return;
13152         }
13153
13154         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13155             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
13156             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
13157             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
13158                               NL80211_ATTR_PAD) ||
13159             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
13160                 goto nla_put_failure;
13161
13162         genlmsg_end(msg, hdr);
13163
13164         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13165                                 NL80211_MCGRP_MLME, gfp);
13166         return;
13167
13168  nla_put_failure:
13169         genlmsg_cancel(msg, hdr);
13170         nlmsg_free(msg);
13171 }
13172 EXPORT_SYMBOL(cfg80211_probe_status);
13173
13174 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
13175                                  const u8 *frame, size_t len,
13176                                  int freq, int sig_dbm)
13177 {
13178         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13179         struct sk_buff *msg;
13180         void *hdr;
13181         struct cfg80211_beacon_registration *reg;
13182
13183         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
13184
13185         spin_lock_bh(&rdev->beacon_registrations_lock);
13186         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
13187                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
13188                 if (!msg) {
13189                         spin_unlock_bh(&rdev->beacon_registrations_lock);
13190                         return;
13191                 }
13192
13193                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
13194                 if (!hdr)
13195                         goto nla_put_failure;
13196
13197                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13198                     (freq &&
13199                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
13200                     (sig_dbm &&
13201                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
13202                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
13203                         goto nla_put_failure;
13204
13205                 genlmsg_end(msg, hdr);
13206
13207                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
13208         }
13209         spin_unlock_bh(&rdev->beacon_registrations_lock);
13210         return;
13211
13212  nla_put_failure:
13213         spin_unlock_bh(&rdev->beacon_registrations_lock);
13214         if (hdr)
13215                 genlmsg_cancel(msg, hdr);
13216         nlmsg_free(msg);
13217 }
13218 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
13219
13220 #ifdef CONFIG_PM
13221 static int cfg80211_net_detect_results(struct sk_buff *msg,
13222                                        struct cfg80211_wowlan_wakeup *wakeup)
13223 {
13224         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
13225         struct nlattr *nl_results, *nl_match, *nl_freqs;
13226         int i, j;
13227
13228         nl_results = nla_nest_start(
13229                 msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
13230         if (!nl_results)
13231                 return -EMSGSIZE;
13232
13233         for (i = 0; i < nd->n_matches; i++) {
13234                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
13235
13236                 nl_match = nla_nest_start(msg, i);
13237                 if (!nl_match)
13238                         break;
13239
13240                 /* The SSID attribute is optional in nl80211, but for
13241                  * simplicity reasons it's always present in the
13242                  * cfg80211 structure.  If a driver can't pass the
13243                  * SSID, that needs to be changed.  A zero length SSID
13244                  * is still a valid SSID (wildcard), so it cannot be
13245                  * used for this purpose.
13246                  */
13247                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
13248                             match->ssid.ssid)) {
13249                         nla_nest_cancel(msg, nl_match);
13250                         goto out;
13251                 }
13252
13253                 if (match->n_channels) {
13254                         nl_freqs = nla_nest_start(
13255                                 msg, NL80211_ATTR_SCAN_FREQUENCIES);
13256                         if (!nl_freqs) {
13257                                 nla_nest_cancel(msg, nl_match);
13258                                 goto out;
13259                         }
13260
13261                         for (j = 0; j < match->n_channels; j++) {
13262                                 if (nla_put_u32(msg, j, match->channels[j])) {
13263                                         nla_nest_cancel(msg, nl_freqs);
13264                                         nla_nest_cancel(msg, nl_match);
13265                                         goto out;
13266                                 }
13267                         }
13268
13269                         nla_nest_end(msg, nl_freqs);
13270                 }
13271
13272                 nla_nest_end(msg, nl_match);
13273         }
13274
13275 out:
13276         nla_nest_end(msg, nl_results);
13277         return 0;
13278 }
13279
13280 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
13281                                    struct cfg80211_wowlan_wakeup *wakeup,
13282                                    gfp_t gfp)
13283 {
13284         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
13285         struct sk_buff *msg;
13286         void *hdr;
13287         int size = 200;
13288
13289         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
13290
13291         if (wakeup)
13292                 size += wakeup->packet_present_len;
13293
13294         msg = nlmsg_new(size, gfp);
13295         if (!msg)
13296                 return;
13297
13298         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
13299         if (!hdr)
13300                 goto free_msg;
13301
13302         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13303             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13304                               NL80211_ATTR_PAD))
13305                 goto free_msg;
13306
13307         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13308                                         wdev->netdev->ifindex))
13309                 goto free_msg;
13310
13311         if (wakeup) {
13312                 struct nlattr *reasons;
13313
13314                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
13315                 if (!reasons)
13316                         goto free_msg;
13317
13318                 if (wakeup->disconnect &&
13319                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
13320                         goto free_msg;
13321                 if (wakeup->magic_pkt &&
13322                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
13323                         goto free_msg;
13324                 if (wakeup->gtk_rekey_failure &&
13325                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
13326                         goto free_msg;
13327                 if (wakeup->eap_identity_req &&
13328                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
13329                         goto free_msg;
13330                 if (wakeup->four_way_handshake &&
13331                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
13332                         goto free_msg;
13333                 if (wakeup->rfkill_release &&
13334                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
13335                         goto free_msg;
13336
13337                 if (wakeup->pattern_idx >= 0 &&
13338                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
13339                                 wakeup->pattern_idx))
13340                         goto free_msg;
13341
13342                 if (wakeup->tcp_match &&
13343                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
13344                         goto free_msg;
13345
13346                 if (wakeup->tcp_connlost &&
13347                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
13348                         goto free_msg;
13349
13350                 if (wakeup->tcp_nomoretokens &&
13351                     nla_put_flag(msg,
13352                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
13353                         goto free_msg;
13354
13355                 if (wakeup->packet) {
13356                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
13357                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
13358
13359                         if (!wakeup->packet_80211) {
13360                                 pkt_attr =
13361                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
13362                                 len_attr =
13363                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
13364                         }
13365
13366                         if (wakeup->packet_len &&
13367                             nla_put_u32(msg, len_attr, wakeup->packet_len))
13368                                 goto free_msg;
13369
13370                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
13371                                     wakeup->packet))
13372                                 goto free_msg;
13373                 }
13374
13375                 if (wakeup->net_detect &&
13376                     cfg80211_net_detect_results(msg, wakeup))
13377                                 goto free_msg;
13378
13379                 nla_nest_end(msg, reasons);
13380         }
13381
13382         genlmsg_end(msg, hdr);
13383
13384         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13385                                 NL80211_MCGRP_MLME, gfp);
13386         return;
13387
13388  free_msg:
13389         nlmsg_free(msg);
13390 }
13391 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
13392 #endif
13393
13394 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
13395                                 enum nl80211_tdls_operation oper,
13396                                 u16 reason_code, gfp_t gfp)
13397 {
13398         struct wireless_dev *wdev = dev->ieee80211_ptr;
13399         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
13400         struct sk_buff *msg;
13401         void *hdr;
13402
13403         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
13404                                          reason_code);
13405
13406         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13407         if (!msg)
13408                 return;
13409
13410         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
13411         if (!hdr) {
13412                 nlmsg_free(msg);
13413                 return;
13414         }
13415
13416         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13417             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
13418             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
13419             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
13420             (reason_code > 0 &&
13421              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
13422                 goto nla_put_failure;
13423
13424         genlmsg_end(msg, hdr);
13425
13426         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13427                                 NL80211_MCGRP_MLME, gfp);
13428         return;
13429
13430  nla_put_failure:
13431         genlmsg_cancel(msg, hdr);
13432         nlmsg_free(msg);
13433 }
13434 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
13435
13436 static int nl80211_netlink_notify(struct notifier_block * nb,
13437                                   unsigned long state,
13438                                   void *_notify)
13439 {
13440         struct netlink_notify *notify = _notify;
13441         struct cfg80211_registered_device *rdev;
13442         struct wireless_dev *wdev;
13443         struct cfg80211_beacon_registration *reg, *tmp;
13444
13445         if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
13446                 return NOTIFY_DONE;
13447
13448         rcu_read_lock();
13449
13450         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
13451                 bool schedule_destroy_work = false;
13452                 bool schedule_scan_stop = false;
13453                 struct cfg80211_sched_scan_request *sched_scan_req =
13454                         rcu_dereference(rdev->sched_scan_req);
13455
13456                 if (sched_scan_req && notify->portid &&
13457                     sched_scan_req->owner_nlportid == notify->portid)
13458                         schedule_scan_stop = true;
13459
13460                 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
13461                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
13462
13463                         if (wdev->owner_nlportid == notify->portid)
13464                                 schedule_destroy_work = true;
13465                 }
13466
13467                 spin_lock_bh(&rdev->beacon_registrations_lock);
13468                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
13469                                          list) {
13470                         if (reg->nlportid == notify->portid) {
13471                                 list_del(&reg->list);
13472                                 kfree(reg);
13473                                 break;
13474                         }
13475                 }
13476                 spin_unlock_bh(&rdev->beacon_registrations_lock);
13477
13478                 if (schedule_destroy_work) {
13479                         struct cfg80211_iface_destroy *destroy;
13480
13481                         destroy = kzalloc(sizeof(*destroy), GFP_ATOMIC);
13482                         if (destroy) {
13483                                 destroy->nlportid = notify->portid;
13484                                 spin_lock(&rdev->destroy_list_lock);
13485                                 list_add(&destroy->list, &rdev->destroy_list);
13486                                 spin_unlock(&rdev->destroy_list_lock);
13487                                 schedule_work(&rdev->destroy_work);
13488                         }
13489                 } else if (schedule_scan_stop) {
13490                         sched_scan_req->owner_nlportid = 0;
13491
13492                         if (rdev->ops->sched_scan_stop &&
13493                             rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
13494                                 schedule_work(&rdev->sched_scan_stop_wk);
13495                 }
13496         }
13497
13498         rcu_read_unlock();
13499
13500         /*
13501          * It is possible that the user space process that is controlling the
13502          * indoor setting disappeared, so notify the regulatory core.
13503          */
13504         regulatory_netlink_notify(notify->portid);
13505         return NOTIFY_OK;
13506 }
13507
13508 static struct notifier_block nl80211_netlink_notifier = {
13509         .notifier_call = nl80211_netlink_notify,
13510 };
13511
13512 void cfg80211_ft_event(struct net_device *netdev,
13513                        struct cfg80211_ft_event_params *ft_event)
13514 {
13515         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
13516         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13517         struct sk_buff *msg;
13518         void *hdr;
13519
13520         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
13521
13522         if (!ft_event->target_ap)
13523                 return;
13524
13525         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13526         if (!msg)
13527                 return;
13528
13529         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
13530         if (!hdr)
13531                 goto out;
13532
13533         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13534             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13535             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
13536                 goto out;
13537
13538         if (ft_event->ies &&
13539             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
13540                 goto out;
13541         if (ft_event->ric_ies &&
13542             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
13543                     ft_event->ric_ies))
13544                 goto out;
13545
13546         genlmsg_end(msg, hdr);
13547
13548         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13549                                 NL80211_MCGRP_MLME, GFP_KERNEL);
13550         return;
13551  out:
13552         nlmsg_free(msg);
13553 }
13554 EXPORT_SYMBOL(cfg80211_ft_event);
13555
13556 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
13557 {
13558         struct cfg80211_registered_device *rdev;
13559         struct sk_buff *msg;
13560         void *hdr;
13561         u32 nlportid;
13562
13563         rdev = wiphy_to_rdev(wdev->wiphy);
13564         if (!rdev->crit_proto_nlportid)
13565                 return;
13566
13567         nlportid = rdev->crit_proto_nlportid;
13568         rdev->crit_proto_nlportid = 0;
13569
13570         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13571         if (!msg)
13572                 return;
13573
13574         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
13575         if (!hdr)
13576                 goto nla_put_failure;
13577
13578         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13579             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13580                               NL80211_ATTR_PAD))
13581                 goto nla_put_failure;
13582
13583         genlmsg_end(msg, hdr);
13584
13585         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
13586         return;
13587
13588  nla_put_failure:
13589         if (hdr)
13590                 genlmsg_cancel(msg, hdr);
13591         nlmsg_free(msg);
13592
13593 }
13594 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
13595
13596 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
13597 {
13598         struct wiphy *wiphy = wdev->wiphy;
13599         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13600         struct sk_buff *msg;
13601         void *hdr;
13602
13603         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13604         if (!msg)
13605                 return;
13606
13607         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
13608         if (!hdr)
13609                 goto out;
13610
13611         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13612             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
13613             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13614                               NL80211_ATTR_PAD))
13615                 goto out;
13616
13617         genlmsg_end(msg, hdr);
13618
13619         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
13620                                 NL80211_MCGRP_MLME, GFP_KERNEL);
13621         return;
13622  out:
13623         nlmsg_free(msg);
13624 }
13625
13626 /* initialisation/exit functions */
13627
13628 int nl80211_init(void)
13629 {
13630         int err;
13631
13632         err = genl_register_family_with_ops_groups(&nl80211_fam, nl80211_ops,
13633                                                    nl80211_mcgrps);
13634         if (err)
13635                 return err;
13636
13637         err = netlink_register_notifier(&nl80211_netlink_notifier);
13638         if (err)
13639                 goto err_out;
13640
13641         return 0;
13642  err_out:
13643         genl_unregister_family(&nl80211_fam);
13644         return err;
13645 }
13646
13647 void nl80211_exit(void)
13648 {
13649         netlink_unregister_notifier(&nl80211_netlink_notifier);
13650         genl_unregister_family(&nl80211_fam);
13651 }