net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include <net/inet_connection_sock.h>
  23 #include "core.h"
  24 #include "nl80211.h"
  25 #include "reg.h"
  26 #include "rdev-ops.h"
  27
  28 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  29                                    struct genl_info *info,
  30                                    struct cfg80211_crypto_settings *settings,
  31                                    int cipher_limit);
  32
  33 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
  34                             struct genl_info *info);
  35 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
  36                               struct genl_info *info);
  37
  38 /* the netlink family */
  39 static struct genl_family nl80211_fam = {
  40         .id = GENL_ID_GENERATE,         /* don't bother with a hardcoded ID */
  41         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
  42         .hdrsize = 0,                   /* no private header */
  43         .version = 1,                   /* no particular meaning now */
  44         .maxattr = NL80211_ATTR_MAX,
  45         .netnsok = true,
  46         .pre_doit = nl80211_pre_doit,
  47         .post_doit = nl80211_post_doit,
  48 };
  49
  50 /* multicast groups */
  51 enum nl80211_multicast_groups {
  52         NL80211_MCGRP_CONFIG,
  53         NL80211_MCGRP_SCAN,
  54         NL80211_MCGRP_REGULATORY,
  55         NL80211_MCGRP_MLME,
  56         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  57 };
  58
  59 static const struct genl_multicast_group nl80211_mcgrps[] = {
  60         [NL80211_MCGRP_CONFIG] = { .name = "config", },
  61         [NL80211_MCGRP_SCAN] = { .name = "scan", },
  62         [NL80211_MCGRP_REGULATORY] = { .name = "regulatory", },
  63         [NL80211_MCGRP_MLME] = { .name = "mlme", },
  64 #ifdef CONFIG_NL80211_TESTMODE
  65         [NL80211_MCGRP_TESTMODE] = { .name = "testmode", }
  66 #endif
  67 };
  68
  69 /* returns ERR_PTR values */
  70 static struct wireless_dev *
  71 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  72 {
  73         struct cfg80211_registered_device *rdev;
  74         struct wireless_dev *result = NULL;
  75         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  76         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  77         u64 wdev_id;
  78         int wiphy_idx = -1;
  79         int ifidx = -1;
  80
  81         ASSERT_RTNL();
  82
  83         if (!have_ifidx && !have_wdev_id)
  84                 return ERR_PTR(-EINVAL);
  85
  86         if (have_ifidx)
  87                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  88         if (have_wdev_id) {
  89                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  90                 wiphy_idx = wdev_id >> 32;
  91         }
  92
  93         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  94                 struct wireless_dev *wdev;
  95
  96                 if (wiphy_net(&rdev->wiphy) != netns)
  97                         continue;
  98
  99                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
 100                         continue;
 101
 102                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
 103                         if (have_ifidx && wdev->netdev &&
 104                             wdev->netdev->ifindex == ifidx) {
 105                                 result = wdev;
 106                                 break;
 107                         }
 108                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 109                                 result = wdev;
 110                                 break;
 111                         }
 112                 }
 113
 114                 if (result)
 115                         break;
 116         }
 117
 118         if (result)
 119                 return result;
 120         return ERR_PTR(-ENODEV);
 121 }
 122
 123 static struct cfg80211_registered_device *
 124 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 125 {
 126         struct cfg80211_registered_device *rdev = NULL, *tmp;
 127         struct net_device *netdev;
 128
 129         ASSERT_RTNL();
 130
 131         if (!attrs[NL80211_ATTR_WIPHY] &&
 132             !attrs[NL80211_ATTR_IFINDEX] &&
 133             !attrs[NL80211_ATTR_WDEV])
 134                 return ERR_PTR(-EINVAL);
 135
 136         if (attrs[NL80211_ATTR_WIPHY])
 137                 rdev = cfg80211_rdev_by_wiphy_idx(
 138                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 139
 140         if (attrs[NL80211_ATTR_WDEV]) {
 141                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 142                 struct wireless_dev *wdev;
 143                 bool found = false;
 144
 145                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 146                 if (tmp) {
 147                         /* make sure wdev exists */
 148                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 149                                 if (wdev->identifier != (u32)wdev_id)
 150                                         continue;
 151                                 found = true;
 152                                 break;
 153                         }
 154
 155                         if (!found)
 156                                 tmp = NULL;
 157
 158                         if (rdev && tmp != rdev)
 159                                 return ERR_PTR(-EINVAL);
 160                         rdev = tmp;
 161                 }
 162         }
 163
 164         if (attrs[NL80211_ATTR_IFINDEX]) {
 165                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 166                 netdev = dev_get_by_index(netns, ifindex);
 167                 if (netdev) {
 168                         if (netdev->ieee80211_ptr)
 169                                 tmp = wiphy_to_dev(
 170                                                 netdev->ieee80211_ptr->wiphy);
 171                         else
 172                                 tmp = NULL;
 173
 174                         dev_put(netdev);
 175
 176                         /* not wireless device -- return error */
 177                         if (!tmp)
 178                                 return ERR_PTR(-EINVAL);
 179
 180                         /* mismatch -- return error */
 181                         if (rdev && tmp != rdev)
 182                                 return ERR_PTR(-EINVAL);
 183
 184                         rdev = tmp;
 185                 }
 186         }
 187
 188         if (!rdev)
 189                 return ERR_PTR(-ENODEV);
 190
 191         if (netns != wiphy_net(&rdev->wiphy))
 192                 return ERR_PTR(-ENODEV);
 193
 194         return rdev;
 195 }
 196
 197 /*
 198  * This function returns a pointer to the driver
 199  * that the genl_info item that is passed refers to.
 200  *
 201  * The result of this can be a PTR_ERR and hence must
 202  * be checked with IS_ERR() for errors.
 203  */
 204 static struct cfg80211_registered_device *
 205 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 206 {
 207         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 208 }
 209
 210 /* policy for the attributes */
 211 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
 212         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 213         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 214                                       .len = 20-1 },
 215         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 216
 217         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 218         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 219         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 220         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 221         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 222
 223         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 224         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 225         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 226         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 227         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 228
 229         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 230         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 231         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 232
 233         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 234         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 235
 236         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 237         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 238                                     .len = WLAN_MAX_KEY_LEN },
 239         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 240         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 241         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 242         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 243         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 244
 245         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 246         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 247         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 248                                        .len = IEEE80211_MAX_DATA_LEN },
 249         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 250                                        .len = IEEE80211_MAX_DATA_LEN },
 251         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 252         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 253         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 254         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 255                                                .len = NL80211_MAX_SUPP_RATES },
 256         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 257         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 258         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 259         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 260                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 261         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 262
 263         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 264         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 265
 266         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 267         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 268         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 269         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 270                                            .len = NL80211_MAX_SUPP_RATES },
 271         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 272
 273         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 274         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 275
 276         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 277
 278         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 279         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 280                               .len = IEEE80211_MAX_DATA_LEN },
 281         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 282         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 283
 284         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 285                                 .len = IEEE80211_MAX_SSID_LEN },
 286         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 287         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 288         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 289         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 290         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 291         [NL80211_ATTR_STA_FLAGS2] = {
 292                 .len = sizeof(struct nl80211_sta_flag_update),
 293         },
 294         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 295         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 296         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 297         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 298         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 299         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 300         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 301         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 302         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 303                                  .len = WLAN_PMKID_LEN },
 304         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 305         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 306         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 307         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 308                                  .len = IEEE80211_MAX_DATA_LEN },
 309         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 310         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 311         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 312         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 313         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 314         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 315         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 316         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 317         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 318         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 319         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 320         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 321         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 322         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 323         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 324         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 325         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 326         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 327         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 328         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 329                                          .len = IEEE80211_MAX_DATA_LEN },
 330         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 331                                          .len = IEEE80211_MAX_DATA_LEN },
 332         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 333         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 334         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 335         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 336         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 337         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 338         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 339         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 340         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 341         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 342                                       .len = IEEE80211_MAX_DATA_LEN },
 343         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 344         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 345         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 346                 .len = NL80211_HT_CAPABILITY_LEN
 347         },
 348         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 349         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 350         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 351         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 352         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 353         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 354         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 355         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 356         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 357         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 358         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 359         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 360         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 361         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 362         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 363         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 364         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 365                 .len = NL80211_VHT_CAPABILITY_LEN,
 366         },
 367         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 368         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 369                                   .len = IEEE80211_MAX_DATA_LEN },
 370         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 371         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 372         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 373         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 374         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_U16 },
 375         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_U16 },
 376         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 377         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 378         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 379 };
 380
 381 /* policy for the key attributes */
 382 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 383         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 384         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 385         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 386         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 387         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 388         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 389         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 390         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 391 };
 392
 393 /* policy for the key default flags */
 394 static const struct nla_policy
 395 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 396         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 397         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 398 };
 399
 400 /* policy for WoWLAN attributes */
 401 static const struct nla_policy
 402 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 403         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 404         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 405         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 406         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 407         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 408         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 409         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 410         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 411         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 412 };
 413
 414 static const struct nla_policy
 415 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 416         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 417         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 418         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 419         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 420         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 421         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 422         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 423                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 424         },
 425         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 426                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 427         },
 428         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 429         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 430         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 431 };
 432
 433 /* policy for coalesce rule attributes */
 434 static const struct nla_policy
 435 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 436         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 437         [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
 438         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 439 };
 440
 441 /* policy for GTK rekey offload attributes */
 442 static const struct nla_policy
 443 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 444         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 445         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 446         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 447 };
 448
 449 static const struct nla_policy
 450 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 451         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 452                                                  .len = IEEE80211_MAX_SSID_LEN },
 453         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 454 };
 455
 456 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 457                                      struct netlink_callback *cb,
 458                                      struct cfg80211_registered_device **rdev,
 459                                      struct wireless_dev **wdev)
 460 {
 461         int err;
 462
 463         rtnl_lock();
 464
 465         if (!cb->args[0]) {
 466                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 467                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
 468                                   nl80211_policy);
 469                 if (err)
 470                         goto out_unlock;
 471
 472                 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
 473                                                    nl80211_fam.attrbuf);
 474                 if (IS_ERR(*wdev)) {
 475                         err = PTR_ERR(*wdev);
 476                         goto out_unlock;
 477                 }
 478                 *rdev = wiphy_to_dev((*wdev)->wiphy);
 479                 /* 0 is the first index - add 1 to parse only once */
 480                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 481                 cb->args[1] = (*wdev)->identifier;
 482         } else {
 483                 /* subtract the 1 again here */
 484                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 485                 struct wireless_dev *tmp;
 486
 487                 if (!wiphy) {
 488                         err = -ENODEV;
 489                         goto out_unlock;
 490                 }
 491                 *rdev = wiphy_to_dev(wiphy);
 492                 *wdev = NULL;
 493
 494                 list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
 495                         if (tmp->identifier == cb->args[1]) {
 496                                 *wdev = tmp;
 497                                 break;
 498                         }
 499                 }
 500
 501                 if (!*wdev) {
 502                         err = -ENODEV;
 503                         goto out_unlock;
 504                 }
 505         }
 506
 507         return 0;
 508  out_unlock:
 509         rtnl_unlock();
 510         return err;
 511 }
 512
 513 static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
 514 {
 515         rtnl_unlock();
 516 }
 517
 518 /* IE validation */
 519 static bool is_valid_ie_attr(const struct nlattr *attr)
 520 {
 521         const u8 *pos;
 522         int len;
 523
 524         if (!attr)
 525                 return true;
 526
 527         pos = nla_data(attr);
 528         len = nla_len(attr);
 529
 530         while (len) {
 531                 u8 elemlen;
 532
 533                 if (len < 2)
 534                         return false;
 535                 len -= 2;
 536
 537                 elemlen = pos[1];
 538                 if (elemlen > len)
 539                         return false;
 540
 541                 len -= elemlen;
 542                 pos += 2 + elemlen;
 543         }
 544
 545         return true;
 546 }
 547
 548 /* message building helper */
 549 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 550                                    int flags, u8 cmd)
 551 {
 552         /* since there is no private header just add the generic one */
 553         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 554 }
 555
 556 static int nl80211_msg_put_channel(struct sk_buff *msg,
 557                                    struct ieee80211_channel *chan,
 558                                    bool large)
 559 {
 560         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 561                         chan->center_freq))
 562                 goto nla_put_failure;
 563
 564         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 565             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 566                 goto nla_put_failure;
 567         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 568                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 569                         goto nla_put_failure;
 570                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 571                         goto nla_put_failure;
 572         }
 573         if (chan->flags & IEEE80211_CHAN_RADAR) {
 574                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 575                         goto nla_put_failure;
 576                 if (large) {
 577                         u32 time;
 578
 579                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 580
 581                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 582                                         chan->dfs_state))
 583                                 goto nla_put_failure;
 584                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 585                                         time))
 586                                 goto nla_put_failure;
 587                 }
 588         }
 589
 590         if (large) {
 591                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 592                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 593                         goto nla_put_failure;
 594                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 595                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 596                         goto nla_put_failure;
 597                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 598                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 599                         goto nla_put_failure;
 600                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 601                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 602                         goto nla_put_failure;
 603         }
 604
 605         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 606                         DBM_TO_MBM(chan->max_power)))
 607                 goto nla_put_failure;
 608
 609         return 0;
 610
 611  nla_put_failure:
 612         return -ENOBUFS;
 613 }
 614
 615 /* netlink command implementations */
 616
 617 struct key_parse {
 618         struct key_params p;
 619         int idx;
 620         int type;
 621         bool def, defmgmt;
 622         bool def_uni, def_multi;
 623 };
 624
 625 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 626 {
 627         struct nlattr *tb[NL80211_KEY_MAX + 1];
 628         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 629                                    nl80211_key_policy);
 630         if (err)
 631                 return err;
 632
 633         k->def = !!tb[NL80211_KEY_DEFAULT];
 634         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 635
 636         if (k->def) {
 637                 k->def_uni = true;
 638                 k->def_multi = true;
 639         }
 640         if (k->defmgmt)
 641                 k->def_multi = true;
 642
 643         if (tb[NL80211_KEY_IDX])
 644                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 645
 646         if (tb[NL80211_KEY_DATA]) {
 647                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 648                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 649         }
 650
 651         if (tb[NL80211_KEY_SEQ]) {
 652                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 653                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 654         }
 655
 656         if (tb[NL80211_KEY_CIPHER])
 657                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 658
 659         if (tb[NL80211_KEY_TYPE]) {
 660                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 661                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 662                         return -EINVAL;
 663         }
 664
 665         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 666                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 667                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 668                                        tb[NL80211_KEY_DEFAULT_TYPES],
 669                                        nl80211_key_default_policy);
 670                 if (err)
 671                         return err;
 672
 673                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 674                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 675         }
 676
 677         return 0;
 678 }
 679
 680 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 681 {
 682         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 683                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 684                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 685         }
 686
 687         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 688                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 689                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 690         }
 691
 692         if (info->attrs[NL80211_ATTR_KEY_IDX])
 693                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 694
 695         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 696                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 697
 698         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 699         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 700
 701         if (k->def) {
 702                 k->def_uni = true;
 703                 k->def_multi = true;
 704         }
 705         if (k->defmgmt)
 706                 k->def_multi = true;
 707
 708         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 709                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 710                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 711                         return -EINVAL;
 712         }
 713
 714         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 715                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 716                 int err = nla_parse_nested(
 717                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 718                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 719                                 nl80211_key_default_policy);
 720                 if (err)
 721                         return err;
 722
 723                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 724                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 725         }
 726
 727         return 0;
 728 }
 729
 730 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 731 {
 732         int err;
 733
 734         memset(k, 0, sizeof(*k));
 735         k->idx = -1;
 736         k->type = -1;
 737
 738         if (info->attrs[NL80211_ATTR_KEY])
 739                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 740         else
 741                 err = nl80211_parse_key_old(info, k);
 742
 743         if (err)
 744                 return err;
 745
 746         if (k->def && k->defmgmt)
 747                 return -EINVAL;
 748
 749         if (k->defmgmt) {
 750                 if (k->def_uni || !k->def_multi)
 751                         return -EINVAL;
 752         }
 753
 754         if (k->idx != -1) {
 755                 if (k->defmgmt) {
 756                         if (k->idx < 4 || k->idx > 5)
 757                                 return -EINVAL;
 758                 } else if (k->def) {
 759                         if (k->idx < 0 || k->idx > 3)
 760                                 return -EINVAL;
 761                 } else {
 762                         if (k->idx < 0 || k->idx > 5)
 763                                 return -EINVAL;
 764                 }
 765         }
 766
 767         return 0;
 768 }
 769
 770 static struct cfg80211_cached_keys *
 771 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 772                        struct nlattr *keys, bool *no_ht)
 773 {
 774         struct key_parse parse;
 775         struct nlattr *key;
 776         struct cfg80211_cached_keys *result;
 777         int rem, err, def = 0;
 778
 779         result = kzalloc(sizeof(*result), GFP_KERNEL);
 780         if (!result)
 781                 return ERR_PTR(-ENOMEM);
 782
 783         result->def = -1;
 784         result->defmgmt = -1;
 785
 786         nla_for_each_nested(key, keys, rem) {
 787                 memset(&parse, 0, sizeof(parse));
 788                 parse.idx = -1;
 789
 790                 err = nl80211_parse_key_new(key, &parse);
 791                 if (err)
 792                         goto error;
 793                 err = -EINVAL;
 794                 if (!parse.p.key)
 795                         goto error;
 796                 if (parse.idx < 0 || parse.idx > 4)
 797                         goto error;
 798                 if (parse.def) {
 799                         if (def)
 800                                 goto error;
 801                         def = 1;
 802                         result->def = parse.idx;
 803                         if (!parse.def_uni || !parse.def_multi)
 804                                 goto error;
 805                 } else if (parse.defmgmt)
 806                         goto error;
 807                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 808                                                      parse.idx, false, NULL);
 809                 if (err)
 810                         goto error;
 811                 result->params[parse.idx].cipher = parse.p.cipher;
 812                 result->params[parse.idx].key_len = parse.p.key_len;
 813                 result->params[parse.idx].key = result->data[parse.idx];
 814                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 815
 816                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 817                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 818                         if (no_ht)
 819                                 *no_ht = true;
 820                 }
 821         }
 822
 823         return result;
 824  error:
 825         kfree(result);
 826         return ERR_PTR(err);
 827 }
 828
 829 static int nl80211_key_allowed(struct wireless_dev *wdev)
 830 {
 831         ASSERT_WDEV_LOCK(wdev);
 832
 833         switch (wdev->iftype) {
 834         case NL80211_IFTYPE_AP:
 835         case NL80211_IFTYPE_AP_VLAN:
 836         case NL80211_IFTYPE_P2P_GO:
 837         case NL80211_IFTYPE_MESH_POINT:
 838                 break;
 839         case NL80211_IFTYPE_ADHOC:
 840         case NL80211_IFTYPE_STATION:
 841         case NL80211_IFTYPE_P2P_CLIENT:
 842                 if (!wdev->current_bss)
 843                         return -ENOLINK;
 844                 break;
 845         default:
 846                 return -EINVAL;
 847         }
 848
 849         return 0;
 850 }
 851
 852 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 853 {
 854         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 855         int i;
 856
 857         if (!nl_modes)
 858                 goto nla_put_failure;
 859
 860         i = 0;
 861         while (ifmodes) {
 862                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 863                         goto nla_put_failure;
 864                 ifmodes >>= 1;
 865                 i++;
 866         }
 867
 868         nla_nest_end(msg, nl_modes);
 869         return 0;
 870
 871 nla_put_failure:
 872         return -ENOBUFS;
 873 }
 874
 875 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 876                                           struct sk_buff *msg,
 877                                           bool large)
 878 {
 879         struct nlattr *nl_combis;
 880         int i, j;
 881
 882         nl_combis = nla_nest_start(msg,
 883                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 884         if (!nl_combis)
 885                 goto nla_put_failure;
 886
 887         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 888                 const struct ieee80211_iface_combination *c;
 889                 struct nlattr *nl_combi, *nl_limits;
 890
 891                 c = &wiphy->iface_combinations[i];
 892
 893                 nl_combi = nla_nest_start(msg, i + 1);
 894                 if (!nl_combi)
 895                         goto nla_put_failure;
 896
 897                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 898                 if (!nl_limits)
 899                         goto nla_put_failure;
 900
 901                 for (j = 0; j < c->n_limits; j++) {
 902                         struct nlattr *nl_limit;
 903
 904                         nl_limit = nla_nest_start(msg, j + 1);
 905                         if (!nl_limit)
 906                                 goto nla_put_failure;
 907                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 908                                         c->limits[j].max))
 909                                 goto nla_put_failure;
 910                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 911                                                 c->limits[j].types))
 912                                 goto nla_put_failure;
 913                         nla_nest_end(msg, nl_limit);
 914                 }
 915
 916                 nla_nest_end(msg, nl_limits);
 917
 918                 if (c->beacon_int_infra_match &&
 919                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 920                         goto nla_put_failure;
 921                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 922                                 c->num_different_channels) ||
 923                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 924                                 c->max_interfaces))
 925                         goto nla_put_failure;
 926                 if (large &&
 927                     nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
 928                                 c->radar_detect_widths))
 929                         goto nla_put_failure;
 930
 931                 nla_nest_end(msg, nl_combi);
 932         }
 933
 934         nla_nest_end(msg, nl_combis);
 935
 936         return 0;
 937 nla_put_failure:
 938         return -ENOBUFS;
 939 }
 940
 941 #ifdef CONFIG_PM
 942 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
 943                                         struct sk_buff *msg)
 944 {
 945         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
 946         struct nlattr *nl_tcp;
 947
 948         if (!tcp)
 949                 return 0;
 950
 951         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
 952         if (!nl_tcp)
 953                 return -ENOBUFS;
 954
 955         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 956                         tcp->data_payload_max))
 957                 return -ENOBUFS;
 958
 959         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 960                         tcp->data_payload_max))
 961                 return -ENOBUFS;
 962
 963         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
 964                 return -ENOBUFS;
 965
 966         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
 967                                 sizeof(*tcp->tok), tcp->tok))
 968                 return -ENOBUFS;
 969
 970         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
 971                         tcp->data_interval_max))
 972                 return -ENOBUFS;
 973
 974         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
 975                         tcp->wake_payload_max))
 976                 return -ENOBUFS;
 977
 978         nla_nest_end(msg, nl_tcp);
 979         return 0;
 980 }
 981
 982 static int nl80211_send_wowlan(struct sk_buff *msg,
 983                                struct cfg80211_registered_device *dev,
 984                                bool large)
 985 {
 986         struct nlattr *nl_wowlan;
 987
 988         if (!dev->wiphy.wowlan)
 989                 return 0;
 990
 991         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
 992         if (!nl_wowlan)
 993                 return -ENOBUFS;
 994
 995         if (((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
 996              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
 997             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
 998              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
 999             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1000              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1001             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1002              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1003             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1004              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1005             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1006              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1007             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1008              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1009             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1010              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1011                 return -ENOBUFS;
1012
1013         if (dev->wiphy.wowlan->n_patterns) {
1014                 struct nl80211_pattern_support pat = {
1015                         .max_patterns = dev->wiphy.wowlan->n_patterns,
1016                         .min_pattern_len = dev->wiphy.wowlan->pattern_min_len,
1017                         .max_pattern_len = dev->wiphy.wowlan->pattern_max_len,
1018                         .max_pkt_offset = dev->wiphy.wowlan->max_pkt_offset,
1019                 };
1020
1021                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1022                             sizeof(pat), &pat))
1023                         return -ENOBUFS;
1024         }
1025
1026         if (large && nl80211_send_wowlan_tcp_caps(dev, msg))
1027                 return -ENOBUFS;
1028
1029         nla_nest_end(msg, nl_wowlan);
1030
1031         return 0;
1032 }
1033 #endif
1034
1035 static int nl80211_send_coalesce(struct sk_buff *msg,
1036                                  struct cfg80211_registered_device *dev)
1037 {
1038         struct nl80211_coalesce_rule_support rule;
1039
1040         if (!dev->wiphy.coalesce)
1041                 return 0;
1042
1043         rule.max_rules = dev->wiphy.coalesce->n_rules;
1044         rule.max_delay = dev->wiphy.coalesce->max_delay;
1045         rule.pat.max_patterns = dev->wiphy.coalesce->n_patterns;
1046         rule.pat.min_pattern_len = dev->wiphy.coalesce->pattern_min_len;
1047         rule.pat.max_pattern_len = dev->wiphy.coalesce->pattern_max_len;
1048         rule.pat.max_pkt_offset = dev->wiphy.coalesce->max_pkt_offset;
1049
1050         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1051                 return -ENOBUFS;
1052
1053         return 0;
1054 }
1055
1056 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1057                                       struct ieee80211_supported_band *sband)
1058 {
1059         struct nlattr *nl_rates, *nl_rate;
1060         struct ieee80211_rate *rate;
1061         int i;
1062
1063         /* add HT info */
1064         if (sband->ht_cap.ht_supported &&
1065             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1066                      sizeof(sband->ht_cap.mcs),
1067                      &sband->ht_cap.mcs) ||
1068              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1069                          sband->ht_cap.cap) ||
1070              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1071                         sband->ht_cap.ampdu_factor) ||
1072              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1073                         sband->ht_cap.ampdu_density)))
1074                 return -ENOBUFS;
1075
1076         /* add VHT info */
1077         if (sband->vht_cap.vht_supported &&
1078             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1079                      sizeof(sband->vht_cap.vht_mcs),
1080                      &sband->vht_cap.vht_mcs) ||
1081              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1082                          sband->vht_cap.cap)))
1083                 return -ENOBUFS;
1084
1085         /* add bitrates */
1086         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1087         if (!nl_rates)
1088                 return -ENOBUFS;
1089
1090         for (i = 0; i < sband->n_bitrates; i++) {
1091                 nl_rate = nla_nest_start(msg, i);
1092                 if (!nl_rate)
1093                         return -ENOBUFS;
1094
1095                 rate = &sband->bitrates[i];
1096                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1097                                 rate->bitrate))
1098                         return -ENOBUFS;
1099                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1100                     nla_put_flag(msg,
1101                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1102                         return -ENOBUFS;
1103
1104                 nla_nest_end(msg, nl_rate);
1105         }
1106
1107         nla_nest_end(msg, nl_rates);
1108
1109         return 0;
1110 }
1111
1112 static int
1113 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1114                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1115 {
1116         u16 stypes;
1117         struct nlattr *nl_ftypes, *nl_ifs;
1118         enum nl80211_iftype ift;
1119         int i;
1120
1121         if (!mgmt_stypes)
1122                 return 0;
1123
1124         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1125         if (!nl_ifs)
1126                 return -ENOBUFS;
1127
1128         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1129                 nl_ftypes = nla_nest_start(msg, ift);
1130                 if (!nl_ftypes)
1131                         return -ENOBUFS;
1132                 i = 0;
1133                 stypes = mgmt_stypes[ift].tx;
1134                 while (stypes) {
1135                         if ((stypes & 1) &&
1136                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1137                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1138                                 return -ENOBUFS;
1139                         stypes >>= 1;
1140                         i++;
1141                 }
1142                 nla_nest_end(msg, nl_ftypes);
1143         }
1144
1145         nla_nest_end(msg, nl_ifs);
1146
1147         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1148         if (!nl_ifs)
1149                 return -ENOBUFS;
1150
1151         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1152                 nl_ftypes = nla_nest_start(msg, ift);
1153                 if (!nl_ftypes)
1154                         return -ENOBUFS;
1155                 i = 0;
1156                 stypes = mgmt_stypes[ift].rx;
1157                 while (stypes) {
1158                         if ((stypes & 1) &&
1159                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1160                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1161                                 return -ENOBUFS;
1162                         stypes >>= 1;
1163                         i++;
1164                 }
1165                 nla_nest_end(msg, nl_ftypes);
1166         }
1167         nla_nest_end(msg, nl_ifs);
1168
1169         return 0;
1170 }
1171
1172 struct nl80211_dump_wiphy_state {
1173         s64 filter_wiphy;
1174         long start;
1175         long split_start, band_start, chan_start;
1176         bool split;
1177 };
1178
1179 static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
1180                               struct sk_buff *msg, u32 portid, u32 seq,
1181                               int flags, struct nl80211_dump_wiphy_state *state)
1182 {
1183         void *hdr;
1184         struct nlattr *nl_bands, *nl_band;
1185         struct nlattr *nl_freqs, *nl_freq;
1186         struct nlattr *nl_cmds;
1187         enum ieee80211_band band;
1188         struct ieee80211_channel *chan;
1189         int i;
1190         const struct ieee80211_txrx_stypes *mgmt_stypes =
1191                                 dev->wiphy.mgmt_stypes;
1192         u32 features;
1193
1194         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
1195         if (!hdr)
1196                 return -ENOBUFS;
1197
1198         if (WARN_ON(!state))
1199                 return -EINVAL;
1200
1201         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
1202             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1203                            wiphy_name(&dev->wiphy)) ||
1204             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1205                         cfg80211_rdev_list_generation))
1206                 goto nla_put_failure;
1207
1208         switch (state->split_start) {
1209         case 0:
1210                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1211                                dev->wiphy.retry_short) ||
1212                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1213                                dev->wiphy.retry_long) ||
1214                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1215                                 dev->wiphy.frag_threshold) ||
1216                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1217                                 dev->wiphy.rts_threshold) ||
1218                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1219                                dev->wiphy.coverage_class) ||
1220                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1221                                dev->wiphy.max_scan_ssids) ||
1222                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1223                                dev->wiphy.max_sched_scan_ssids) ||
1224                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1225                                 dev->wiphy.max_scan_ie_len) ||
1226                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1227                                 dev->wiphy.max_sched_scan_ie_len) ||
1228                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1229                                dev->wiphy.max_match_sets))
1230                         goto nla_put_failure;
1231
1232                 if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1233                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1234                         goto nla_put_failure;
1235                 if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1236                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1237                         goto nla_put_failure;
1238                 if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1239                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1240                         goto nla_put_failure;
1241                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1242                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1243                         goto nla_put_failure;
1244                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1245                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1246                         goto nla_put_failure;
1247                 if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1248                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1249                         goto nla_put_failure;
1250                 state->split_start++;
1251                 if (state->split)
1252                         break;
1253         case 1:
1254                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1255                             sizeof(u32) * dev->wiphy.n_cipher_suites,
1256                             dev->wiphy.cipher_suites))
1257                         goto nla_put_failure;
1258
1259                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1260                                dev->wiphy.max_num_pmkids))
1261                         goto nla_put_failure;
1262
1263                 if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1264                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1265                         goto nla_put_failure;
1266
1267                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1268                                 dev->wiphy.available_antennas_tx) ||
1269                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1270                                 dev->wiphy.available_antennas_rx))
1271                         goto nla_put_failure;
1272
1273                 if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1274                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1275                                 dev->wiphy.probe_resp_offload))
1276                         goto nla_put_failure;
1277
1278                 if ((dev->wiphy.available_antennas_tx ||
1279                      dev->wiphy.available_antennas_rx) &&
1280                     dev->ops->get_antenna) {
1281                         u32 tx_ant = 0, rx_ant = 0;
1282                         int res;
1283                         res = rdev_get_antenna(dev, &tx_ant, &rx_ant);
1284                         if (!res) {
1285                                 if (nla_put_u32(msg,
1286                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1287                                                 tx_ant) ||
1288                                     nla_put_u32(msg,
1289                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1290                                                 rx_ant))
1291                                         goto nla_put_failure;
1292                         }
1293                 }
1294
1295                 state->split_start++;
1296                 if (state->split)
1297                         break;
1298         case 2:
1299                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1300                                         dev->wiphy.interface_modes))
1301                                 goto nla_put_failure;
1302                 state->split_start++;
1303                 if (state->split)
1304                         break;
1305         case 3:
1306                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1307                 if (!nl_bands)
1308                         goto nla_put_failure;
1309
1310                 for (band = state->band_start;
1311                      band < IEEE80211_NUM_BANDS; band++) {
1312                         struct ieee80211_supported_band *sband;
1313
1314                         sband = dev->wiphy.bands[band];
1315
1316                         if (!sband)
1317                                 continue;
1318
1319                         nl_band = nla_nest_start(msg, band);
1320                         if (!nl_band)
1321                                 goto nla_put_failure;
1322
1323                         switch (state->chan_start) {
1324                         case 0:
1325                                 if (nl80211_send_band_rateinfo(msg, sband))
1326                                         goto nla_put_failure;
1327                                 state->chan_start++;
1328                                 if (state->split)
1329                                         break;
1330                         default:
1331                                 /* add frequencies */
1332                                 nl_freqs = nla_nest_start(
1333                                         msg, NL80211_BAND_ATTR_FREQS);
1334                                 if (!nl_freqs)
1335                                         goto nla_put_failure;
1336
1337                                 for (i = state->chan_start - 1;
1338                                      i < sband->n_channels;
1339                                      i++) {
1340                                         nl_freq = nla_nest_start(msg, i);
1341                                         if (!nl_freq)
1342                                                 goto nla_put_failure;
1343
1344                                         chan = &sband->channels[i];
1345
1346                                         if (nl80211_msg_put_channel(
1347                                                         msg, chan,
1348                                                         state->split))
1349                                                 goto nla_put_failure;
1350
1351                                         nla_nest_end(msg, nl_freq);
1352                                         if (state->split)
1353                                                 break;
1354                                 }
1355                                 if (i < sband->n_channels)
1356                                         state->chan_start = i + 2;
1357                                 else
1358                                         state->chan_start = 0;
1359                                 nla_nest_end(msg, nl_freqs);
1360                         }
1361
1362                         nla_nest_end(msg, nl_band);
1363
1364                         if (state->split) {
1365                                 /* start again here */
1366                                 if (state->chan_start)
1367                                         band--;
1368                                 break;
1369                         }
1370                 }
1371                 nla_nest_end(msg, nl_bands);
1372
1373                 if (band < IEEE80211_NUM_BANDS)
1374                         state->band_start = band + 1;
1375                 else
1376                         state->band_start = 0;
1377
1378                 /* if bands & channels are done, continue outside */
1379                 if (state->band_start == 0 && state->chan_start == 0)
1380                         state->split_start++;
1381                 if (state->split)
1382                         break;
1383         case 4:
1384                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1385                 if (!nl_cmds)
1386                         goto nla_put_failure;
1387
1388                 i = 0;
1389 #define CMD(op, n)                                                      \
1390                  do {                                                   \
1391                         if (dev->ops->op) {                             \
1392                                 i++;                                    \
1393                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1394                                         goto nla_put_failure;           \
1395                         }                                               \
1396                 } while (0)
1397
1398                 CMD(add_virtual_intf, NEW_INTERFACE);
1399                 CMD(change_virtual_intf, SET_INTERFACE);
1400                 CMD(add_key, NEW_KEY);
1401                 CMD(start_ap, START_AP);
1402                 CMD(add_station, NEW_STATION);
1403                 CMD(add_mpath, NEW_MPATH);
1404                 CMD(update_mesh_config, SET_MESH_CONFIG);
1405                 CMD(change_bss, SET_BSS);
1406                 CMD(auth, AUTHENTICATE);
1407                 CMD(assoc, ASSOCIATE);
1408                 CMD(deauth, DEAUTHENTICATE);
1409                 CMD(disassoc, DISASSOCIATE);
1410                 CMD(join_ibss, JOIN_IBSS);
1411                 CMD(join_mesh, JOIN_MESH);
1412                 CMD(set_pmksa, SET_PMKSA);
1413                 CMD(del_pmksa, DEL_PMKSA);
1414                 CMD(flush_pmksa, FLUSH_PMKSA);
1415                 if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1416                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1417                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1418                 CMD(mgmt_tx, FRAME);
1419                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1420                 if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1421                         i++;
1422                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1423                                 goto nla_put_failure;
1424                 }
1425                 if (dev->ops->set_monitor_channel || dev->ops->start_ap ||
1426                     dev->ops->join_mesh) {
1427                         i++;
1428                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1429                                 goto nla_put_failure;
1430                 }
1431                 CMD(set_wds_peer, SET_WDS_PEER);
1432                 if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1433                         CMD(tdls_mgmt, TDLS_MGMT);
1434                         CMD(tdls_oper, TDLS_OPER);
1435                 }
1436                 if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1437                         CMD(sched_scan_start, START_SCHED_SCAN);
1438                 CMD(probe_client, PROBE_CLIENT);
1439                 CMD(set_noack_map, SET_NOACK_MAP);
1440                 if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1441                         i++;
1442                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1443                                 goto nla_put_failure;
1444                 }
1445                 CMD(start_p2p_device, START_P2P_DEVICE);
1446                 CMD(set_mcast_rate, SET_MCAST_RATE);
1447                 if (state->split) {
1448                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1449                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1450                         if (dev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1451                                 CMD(channel_switch, CHANNEL_SWITCH);
1452                 }
1453
1454 #ifdef CONFIG_NL80211_TESTMODE
1455                 CMD(testmode_cmd, TESTMODE);
1456 #endif
1457
1458 #undef CMD
1459
1460                 if (dev->ops->connect || dev->ops->auth) {
1461                         i++;
1462                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1463                                 goto nla_put_failure;
1464                 }
1465
1466                 if (dev->ops->disconnect || dev->ops->deauth) {
1467                         i++;
1468                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1469                                 goto nla_put_failure;
1470                 }
1471
1472                 nla_nest_end(msg, nl_cmds);
1473                 state->split_start++;
1474                 if (state->split)
1475                         break;
1476         case 5:
1477                 if (dev->ops->remain_on_channel &&
1478                     (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1479                     nla_put_u32(msg,
1480                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1481                                 dev->wiphy.max_remain_on_channel_duration))
1482                         goto nla_put_failure;
1483
1484                 if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1485                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1486                         goto nla_put_failure;
1487
1488                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1489                         goto nla_put_failure;
1490                 state->split_start++;
1491                 if (state->split)
1492                         break;
1493         case 6:
1494 #ifdef CONFIG_PM
1495                 if (nl80211_send_wowlan(msg, dev, state->split))
1496                         goto nla_put_failure;
1497                 state->split_start++;
1498                 if (state->split)
1499                         break;
1500 #else
1501                 state->split_start++;
1502 #endif
1503         case 7:
1504                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1505                                         dev->wiphy.software_iftypes))
1506                         goto nla_put_failure;
1507
1508                 if (nl80211_put_iface_combinations(&dev->wiphy, msg,
1509                                                    state->split))
1510                         goto nla_put_failure;
1511
1512                 state->split_start++;
1513                 if (state->split)
1514                         break;
1515         case 8:
1516                 if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1517                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1518                                 dev->wiphy.ap_sme_capa))
1519                         goto nla_put_failure;
1520
1521                 features = dev->wiphy.features;
1522                 /*
1523                  * We can only add the per-channel limit information if the
1524                  * dump is split, otherwise it makes it too big. Therefore
1525                  * only advertise it in that case.
1526                  */
1527                 if (state->split)
1528                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1529                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1530                         goto nla_put_failure;
1531
1532                 if (dev->wiphy.ht_capa_mod_mask &&
1533                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1534                             sizeof(*dev->wiphy.ht_capa_mod_mask),
1535                             dev->wiphy.ht_capa_mod_mask))
1536                         goto nla_put_failure;
1537
1538                 if (dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1539                     dev->wiphy.max_acl_mac_addrs &&
1540                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1541                                 dev->wiphy.max_acl_mac_addrs))
1542                         goto nla_put_failure;
1543
1544                 /*
1545                  * Any information below this point is only available to
1546                  * applications that can deal with it being split. This
1547                  * helps ensure that newly added capabilities don't break
1548                  * older tools by overrunning their buffers.
1549                  *
1550                  * We still increment split_start so that in the split
1551                  * case we'll continue with more data in the next round,
1552                  * but break unconditionally so unsplit data stops here.
1553                  */
1554                 state->split_start++;
1555                 break;
1556         case 9:
1557                 if (dev->wiphy.extended_capabilities &&
1558                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1559                              dev->wiphy.extended_capabilities_len,
1560                              dev->wiphy.extended_capabilities) ||
1561                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1562                              dev->wiphy.extended_capabilities_len,
1563                              dev->wiphy.extended_capabilities_mask)))
1564                         goto nla_put_failure;
1565
1566                 if (dev->wiphy.vht_capa_mod_mask &&
1567                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1568                             sizeof(*dev->wiphy.vht_capa_mod_mask),
1569                             dev->wiphy.vht_capa_mod_mask))
1570                         goto nla_put_failure;
1571
1572                 state->split_start++;
1573                 break;
1574         case 10:
1575                 if (nl80211_send_coalesce(msg, dev))
1576                         goto nla_put_failure;
1577
1578                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1579                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1580                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1581                         goto nla_put_failure;
1582
1583                 /* done */
1584                 state->split_start = 0;
1585                 break;
1586         }
1587         return genlmsg_end(msg, hdr);
1588
1589  nla_put_failure:
1590         genlmsg_cancel(msg, hdr);
1591         return -EMSGSIZE;
1592 }
1593
1594 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1595                                     struct netlink_callback *cb,
1596                                     struct nl80211_dump_wiphy_state *state)
1597 {
1598         struct nlattr **tb = nl80211_fam.attrbuf;
1599         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1600                               tb, nl80211_fam.maxattr, nl80211_policy);
1601         /* ignore parse errors for backward compatibility */
1602         if (ret)
1603                 return 0;
1604
1605         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1606         if (tb[NL80211_ATTR_WIPHY])
1607                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1608         if (tb[NL80211_ATTR_WDEV])
1609                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1610         if (tb[NL80211_ATTR_IFINDEX]) {
1611                 struct net_device *netdev;
1612                 struct cfg80211_registered_device *rdev;
1613                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1614
1615                 netdev = dev_get_by_index(sock_net(skb->sk), ifidx);
1616                 if (!netdev)
1617                         return -ENODEV;
1618                 if (netdev->ieee80211_ptr) {
1619                         rdev = wiphy_to_dev(
1620                                 netdev->ieee80211_ptr->wiphy);
1621                         state->filter_wiphy = rdev->wiphy_idx;
1622                 }
1623                 dev_put(netdev);
1624         }
1625
1626         return 0;
1627 }
1628
1629 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1630 {
1631         int idx = 0, ret;
1632         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1633         struct cfg80211_registered_device *dev;
1634
1635         rtnl_lock();
1636         if (!state) {
1637                 state = kzalloc(sizeof(*state), GFP_KERNEL);
1638                 if (!state) {
1639                         rtnl_unlock();
1640                         return -ENOMEM;
1641                 }
1642                 state->filter_wiphy = -1;
1643                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1644                 if (ret) {
1645                         kfree(state);
1646                         rtnl_unlock();
1647                         return ret;
1648                 }
1649                 cb->args[0] = (long)state;
1650         }
1651
1652         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1653                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1654                         continue;
1655                 if (++idx <= state->start)
1656                         continue;
1657                 if (state->filter_wiphy != -1 &&
1658                     state->filter_wiphy != dev->wiphy_idx)
1659                         continue;
1660                 /* attempt to fit multiple wiphy data chunks into the skb */
1661                 do {
1662                         ret = nl80211_send_wiphy(dev, skb,
1663                                                  NETLINK_CB(cb->skb).portid,
1664                                                  cb->nlh->nlmsg_seq,
1665                                                  NLM_F_MULTI, state);
1666                         if (ret < 0) {
1667                                 /*
1668                                  * If sending the wiphy data didn't fit (ENOBUFS
1669                                  * or EMSGSIZE returned), this SKB is still
1670                                  * empty (so it's not too big because another
1671                                  * wiphy dataset is already in the skb) and
1672                                  * we've not tried to adjust the dump allocation
1673                                  * yet ... then adjust the alloc size to be
1674                                  * bigger, and return 1 but with the empty skb.
1675                                  * This results in an empty message being RX'ed
1676                                  * in userspace, but that is ignored.
1677                                  *
1678                                  * We can then retry with the larger buffer.
1679                                  */
1680                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1681                                     !skb->len &&
1682                                     cb->min_dump_alloc < 4096) {
1683                                         cb->min_dump_alloc = 4096;
1684                                         rtnl_unlock();
1685                                         return 1;
1686                                 }
1687                                 idx--;
1688                                 break;
1689                         }
1690                 } while (state->split_start > 0);
1691                 break;
1692         }
1693         rtnl_unlock();
1694
1695         state->start = idx;
1696
1697         return skb->len;
1698 }
1699
1700 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
1701 {
1702         kfree((void *)cb->args[0]);
1703         return 0;
1704 }
1705
1706 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1707 {
1708         struct sk_buff *msg;
1709         struct cfg80211_registered_device *dev = info->user_ptr[0];
1710         struct nl80211_dump_wiphy_state state = {};
1711
1712         msg = nlmsg_new(4096, GFP_KERNEL);
1713         if (!msg)
1714                 return -ENOMEM;
1715
1716         if (nl80211_send_wiphy(dev, msg, info->snd_portid, info->snd_seq, 0,
1717                                &state) < 0) {
1718                 nlmsg_free(msg);
1719                 return -ENOBUFS;
1720         }
1721
1722         return genlmsg_reply(msg, info);
1723 }
1724
1725 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1726         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1727         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1728         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1729         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1730         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1731 };
1732
1733 static int parse_txq_params(struct nlattr *tb[],
1734                             struct ieee80211_txq_params *txq_params)
1735 {
1736         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1737             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1738             !tb[NL80211_TXQ_ATTR_AIFS])
1739                 return -EINVAL;
1740
1741         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1742         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1743         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1744         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1745         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1746
1747         if (txq_params->ac >= NL80211_NUM_ACS)
1748                 return -EINVAL;
1749
1750         return 0;
1751 }
1752
1753 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1754 {
1755         /*
1756          * You can only set the channel explicitly for WDS interfaces,
1757          * all others have their channel managed via their respective
1758          * "establish a connection" command (connect, join, ...)
1759          *
1760          * For AP/GO and mesh mode, the channel can be set with the
1761          * channel userspace API, but is only stored and passed to the
1762          * low-level driver when the AP starts or the mesh is joined.
1763          * This is for backward compatibility, userspace can also give
1764          * the channel in the start-ap or join-mesh commands instead.
1765          *
1766          * Monitors are special as they are normally slaved to
1767          * whatever else is going on, so they have their own special
1768          * operation to set the monitor channel if possible.
1769          */
1770         return !wdev ||
1771                 wdev->iftype == NL80211_IFTYPE_AP ||
1772                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1773                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1774                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1775 }
1776
1777 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1778                                  struct genl_info *info,
1779                                  struct cfg80211_chan_def *chandef)
1780 {
1781         u32 control_freq;
1782
1783         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1784                 return -EINVAL;
1785
1786         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1787
1788         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1789         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1790         chandef->center_freq1 = control_freq;
1791         chandef->center_freq2 = 0;
1792
1793         /* Primary channel not allowed */
1794         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1795                 return -EINVAL;
1796
1797         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1798                 enum nl80211_channel_type chantype;
1799
1800                 chantype = nla_get_u32(
1801                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1802
1803                 switch (chantype) {
1804                 case NL80211_CHAN_NO_HT:
1805                 case NL80211_CHAN_HT20:
1806                 case NL80211_CHAN_HT40PLUS:
1807                 case NL80211_CHAN_HT40MINUS:
1808                         cfg80211_chandef_create(chandef, chandef->chan,
1809                                                 chantype);
1810                         break;
1811                 default:
1812                         return -EINVAL;
1813                 }
1814         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1815                 chandef->width =
1816                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1817                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1818                         chandef->center_freq1 =
1819                                 nla_get_u32(
1820                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1821                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1822                         chandef->center_freq2 =
1823                                 nla_get_u32(
1824                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1825         }
1826
1827         if (!cfg80211_chandef_valid(chandef))
1828                 return -EINVAL;
1829
1830         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1831                                      IEEE80211_CHAN_DISABLED))
1832                 return -EINVAL;
1833
1834         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
1835              chandef->width == NL80211_CHAN_WIDTH_10) &&
1836             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
1837                 return -EINVAL;
1838
1839         return 0;
1840 }
1841
1842 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1843                                  struct wireless_dev *wdev,
1844                                  struct genl_info *info)
1845 {
1846         struct cfg80211_chan_def chandef;
1847         int result;
1848         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1849
1850         if (wdev)
1851                 iftype = wdev->iftype;
1852
1853         if (!nl80211_can_set_dev_channel(wdev))
1854                 return -EOPNOTSUPP;
1855
1856         result = nl80211_parse_chandef(rdev, info, &chandef);
1857         if (result)
1858                 return result;
1859
1860         switch (iftype) {
1861         case NL80211_IFTYPE_AP:
1862         case NL80211_IFTYPE_P2P_GO:
1863                 if (wdev->beacon_interval) {
1864                         result = -EBUSY;
1865                         break;
1866                 }
1867                 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef)) {
1868                         result = -EINVAL;
1869                         break;
1870                 }
1871                 wdev->preset_chandef = chandef;
1872                 result = 0;
1873                 break;
1874         case NL80211_IFTYPE_MESH_POINT:
1875                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
1876                 break;
1877         case NL80211_IFTYPE_MONITOR:
1878                 result = cfg80211_set_monitor_channel(rdev, &chandef);
1879                 break;
1880         default:
1881                 result = -EINVAL;
1882         }
1883
1884         return result;
1885 }
1886
1887 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1888 {
1889         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1890         struct net_device *netdev = info->user_ptr[1];
1891
1892         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1893 }
1894
1895 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1896 {
1897         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1898         struct net_device *dev = info->user_ptr[1];
1899         struct wireless_dev *wdev = dev->ieee80211_ptr;
1900         const u8 *bssid;
1901
1902         if (!info->attrs[NL80211_ATTR_MAC])
1903                 return -EINVAL;
1904
1905         if (netif_running(dev))
1906                 return -EBUSY;
1907
1908         if (!rdev->ops->set_wds_peer)
1909                 return -EOPNOTSUPP;
1910
1911         if (wdev->iftype != NL80211_IFTYPE_WDS)
1912                 return -EOPNOTSUPP;
1913
1914         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1915         return rdev_set_wds_peer(rdev, dev, bssid);
1916 }
1917
1918
1919 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1920 {
1921         struct cfg80211_registered_device *rdev;
1922         struct net_device *netdev = NULL;
1923         struct wireless_dev *wdev;
1924         int result = 0, rem_txq_params = 0;
1925         struct nlattr *nl_txq_params;
1926         u32 changed;
1927         u8 retry_short = 0, retry_long = 0;
1928         u32 frag_threshold = 0, rts_threshold = 0;
1929         u8 coverage_class = 0;
1930
1931         ASSERT_RTNL();
1932
1933         /*
1934          * Try to find the wiphy and netdev. Normally this
1935          * function shouldn't need the netdev, but this is
1936          * done for backward compatibility -- previously
1937          * setting the channel was done per wiphy, but now
1938          * it is per netdev. Previous userland like hostapd
1939          * also passed a netdev to set_wiphy, so that it is
1940          * possible to let that go to the right netdev!
1941          */
1942
1943         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1944                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1945
1946                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1947                 if (netdev && netdev->ieee80211_ptr)
1948                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1949                 else
1950                         netdev = NULL;
1951         }
1952
1953         if (!netdev) {
1954                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
1955                                                   info->attrs);
1956                 if (IS_ERR(rdev))
1957                         return PTR_ERR(rdev);
1958                 wdev = NULL;
1959                 netdev = NULL;
1960                 result = 0;
1961         } else
1962                 wdev = netdev->ieee80211_ptr;
1963
1964         /*
1965          * end workaround code, by now the rdev is available
1966          * and locked, and wdev may or may not be NULL.
1967          */
1968
1969         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1970                 result = cfg80211_dev_rename(
1971                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1972
1973         if (result)
1974                 goto bad_res;
1975
1976         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1977                 struct ieee80211_txq_params txq_params;
1978                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1979
1980                 if (!rdev->ops->set_txq_params) {
1981                         result = -EOPNOTSUPP;
1982                         goto bad_res;
1983                 }
1984
1985                 if (!netdev) {
1986                         result = -EINVAL;
1987                         goto bad_res;
1988                 }
1989
1990                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1991                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
1992                         result = -EINVAL;
1993                         goto bad_res;
1994                 }
1995
1996                 if (!netif_running(netdev)) {
1997                         result = -ENETDOWN;
1998                         goto bad_res;
1999                 }
2000
2001                 nla_for_each_nested(nl_txq_params,
2002                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2003                                     rem_txq_params) {
2004                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
2005                                   nla_data(nl_txq_params),
2006                                   nla_len(nl_txq_params),
2007                                   txq_params_policy);
2008                         result = parse_txq_params(tb, &txq_params);
2009                         if (result)
2010                                 goto bad_res;
2011
2012                         result = rdev_set_txq_params(rdev, netdev,
2013                                                      &txq_params);
2014                         if (result)
2015                                 goto bad_res;
2016                 }
2017         }
2018
2019         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2020                 result = __nl80211_set_channel(rdev,
2021                                 nl80211_can_set_dev_channel(wdev) ? wdev : NULL,
2022                                 info);
2023                 if (result)
2024                         goto bad_res;
2025         }
2026
2027         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2028                 struct wireless_dev *txp_wdev = wdev;
2029                 enum nl80211_tx_power_setting type;
2030                 int idx, mbm = 0;
2031
2032                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2033                         txp_wdev = NULL;
2034
2035                 if (!rdev->ops->set_tx_power) {
2036                         result = -EOPNOTSUPP;
2037                         goto bad_res;
2038                 }
2039
2040                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2041                 type = nla_get_u32(info->attrs[idx]);
2042
2043                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2044                     (type != NL80211_TX_POWER_AUTOMATIC)) {
2045                         result = -EINVAL;
2046                         goto bad_res;
2047                 }
2048
2049                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2050                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2051                         mbm = nla_get_u32(info->attrs[idx]);
2052                 }
2053
2054                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2055                 if (result)
2056                         goto bad_res;
2057         }
2058
2059         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2060             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2061                 u32 tx_ant, rx_ant;
2062                 if ((!rdev->wiphy.available_antennas_tx &&
2063                      !rdev->wiphy.available_antennas_rx) ||
2064                     !rdev->ops->set_antenna) {
2065                         result = -EOPNOTSUPP;
2066                         goto bad_res;
2067                 }
2068
2069                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2070                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2071
2072                 /* reject antenna configurations which don't match the
2073                  * available antenna masks, except for the "all" mask */
2074                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2075                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
2076                         result = -EINVAL;
2077                         goto bad_res;
2078                 }
2079
2080                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2081                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2082
2083                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2084                 if (result)
2085                         goto bad_res;
2086         }
2087
2088         changed = 0;
2089
2090         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2091                 retry_short = nla_get_u8(
2092                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2093                 if (retry_short == 0) {
2094                         result = -EINVAL;
2095                         goto bad_res;
2096                 }
2097                 changed |= WIPHY_PARAM_RETRY_SHORT;
2098         }
2099
2100         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2101                 retry_long = nla_get_u8(
2102                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2103                 if (retry_long == 0) {
2104                         result = -EINVAL;
2105                         goto bad_res;
2106                 }
2107                 changed |= WIPHY_PARAM_RETRY_LONG;
2108         }
2109
2110         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2111                 frag_threshold = nla_get_u32(
2112                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2113                 if (frag_threshold < 256) {
2114                         result = -EINVAL;
2115                         goto bad_res;
2116                 }
2117                 if (frag_threshold != (u32) -1) {
2118                         /*
2119                          * Fragments (apart from the last one) are required to
2120                          * have even length. Make the fragmentation code
2121                          * simpler by stripping LSB should someone try to use
2122                          * odd threshold value.
2123                          */
2124                         frag_threshold &= ~0x1;
2125                 }
2126                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2127         }
2128
2129         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2130                 rts_threshold = nla_get_u32(
2131                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2132                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2133         }
2134
2135         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2136                 coverage_class = nla_get_u8(
2137                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2138                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2139         }
2140
2141         if (changed) {
2142                 u8 old_retry_short, old_retry_long;
2143                 u32 old_frag_threshold, old_rts_threshold;
2144                 u8 old_coverage_class;
2145
2146                 if (!rdev->ops->set_wiphy_params) {
2147                         result = -EOPNOTSUPP;
2148                         goto bad_res;
2149                 }
2150
2151                 old_retry_short = rdev->wiphy.retry_short;
2152                 old_retry_long = rdev->wiphy.retry_long;
2153                 old_frag_threshold = rdev->wiphy.frag_threshold;
2154                 old_rts_threshold = rdev->wiphy.rts_threshold;
2155                 old_coverage_class = rdev->wiphy.coverage_class;
2156
2157                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2158                         rdev->wiphy.retry_short = retry_short;
2159                 if (changed & WIPHY_PARAM_RETRY_LONG)
2160                         rdev->wiphy.retry_long = retry_long;
2161                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2162                         rdev->wiphy.frag_threshold = frag_threshold;
2163                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2164                         rdev->wiphy.rts_threshold = rts_threshold;
2165                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2166                         rdev->wiphy.coverage_class = coverage_class;
2167
2168                 result = rdev_set_wiphy_params(rdev, changed);
2169                 if (result) {
2170                         rdev->wiphy.retry_short = old_retry_short;
2171                         rdev->wiphy.retry_long = old_retry_long;
2172                         rdev->wiphy.frag_threshold = old_frag_threshold;
2173                         rdev->wiphy.rts_threshold = old_rts_threshold;
2174                         rdev->wiphy.coverage_class = old_coverage_class;
2175                 }
2176         }
2177
2178  bad_res:
2179         if (netdev)
2180                 dev_put(netdev);
2181         return result;
2182 }
2183
2184 static inline u64 wdev_id(struct wireless_dev *wdev)
2185 {
2186         return (u64)wdev->identifier |
2187                ((u64)wiphy_to_dev(wdev->wiphy)->wiphy_idx << 32);
2188 }
2189
2190 static int nl80211_send_chandef(struct sk_buff *msg,
2191                                 const struct cfg80211_chan_def *chandef)
2192 {
2193         WARN_ON(!cfg80211_chandef_valid(chandef));
2194
2195         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2196                         chandef->chan->center_freq))
2197                 return -ENOBUFS;
2198         switch (chandef->width) {
2199         case NL80211_CHAN_WIDTH_20_NOHT:
2200         case NL80211_CHAN_WIDTH_20:
2201         case NL80211_CHAN_WIDTH_40:
2202                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2203                                 cfg80211_get_chandef_type(chandef)))
2204                         return -ENOBUFS;
2205                 break;
2206         default:
2207                 break;
2208         }
2209         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2210                 return -ENOBUFS;
2211         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2212                 return -ENOBUFS;
2213         if (chandef->center_freq2 &&
2214             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2215                 return -ENOBUFS;
2216         return 0;
2217 }
2218
2219 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2220                               struct cfg80211_registered_device *rdev,
2221                               struct wireless_dev *wdev)
2222 {
2223         struct net_device *dev = wdev->netdev;
2224         void *hdr;
2225
2226         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
2227         if (!hdr)
2228                 return -1;
2229
2230         if (dev &&
2231             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2232              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2233                 goto nla_put_failure;
2234
2235         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2236             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2237             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2238             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2239             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2240                         rdev->devlist_generation ^
2241                         (cfg80211_rdev_list_generation << 2)))
2242                 goto nla_put_failure;
2243
2244         if (rdev->ops->get_channel) {
2245                 int ret;
2246                 struct cfg80211_chan_def chandef;
2247
2248                 ret = rdev_get_channel(rdev, wdev, &chandef);
2249                 if (ret == 0) {
2250                         if (nl80211_send_chandef(msg, &chandef))
2251                                 goto nla_put_failure;
2252                 }
2253         }
2254
2255         if (wdev->ssid_len) {
2256                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2257                         goto nla_put_failure;
2258         }
2259
2260         return genlmsg_end(msg, hdr);
2261
2262  nla_put_failure:
2263         genlmsg_cancel(msg, hdr);
2264         return -EMSGSIZE;
2265 }
2266
2267 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2268 {
2269         int wp_idx = 0;
2270         int if_idx = 0;
2271         int wp_start = cb->args[0];
2272         int if_start = cb->args[1];
2273         struct cfg80211_registered_device *rdev;
2274         struct wireless_dev *wdev;
2275
2276         rtnl_lock();
2277         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2278                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2279                         continue;
2280                 if (wp_idx < wp_start) {
2281                         wp_idx++;
2282                         continue;
2283                 }
2284                 if_idx = 0;
2285
2286                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
2287                         if (if_idx < if_start) {
2288                                 if_idx++;
2289                                 continue;
2290                         }
2291                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2292                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2293                                                rdev, wdev) < 0) {
2294                                 goto out;
2295                         }
2296                         if_idx++;
2297                 }
2298
2299                 wp_idx++;
2300         }
2301  out:
2302         rtnl_unlock();
2303
2304         cb->args[0] = wp_idx;
2305         cb->args[1] = if_idx;
2306
2307         return skb->len;
2308 }
2309
2310 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2311 {
2312         struct sk_buff *msg;
2313         struct cfg80211_registered_device *dev = info->user_ptr[0];
2314         struct wireless_dev *wdev = info->user_ptr[1];
2315
2316         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2317         if (!msg)
2318                 return -ENOMEM;
2319
2320         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2321                                dev, wdev) < 0) {
2322                 nlmsg_free(msg);
2323                 return -ENOBUFS;
2324         }
2325
2326         return genlmsg_reply(msg, info);
2327 }
2328
2329 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2330         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2331         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2332         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2333         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2334         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2335         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2336 };
2337
2338 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2339 {
2340         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2341         int flag;
2342
2343         *mntrflags = 0;
2344
2345         if (!nla)
2346                 return -EINVAL;
2347
2348         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2349                              nla, mntr_flags_policy))
2350                 return -EINVAL;
2351
2352         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2353                 if (flags[flag])
2354                         *mntrflags |= (1<<flag);
2355
2356         return 0;
2357 }
2358
2359 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2360                                struct net_device *netdev, u8 use_4addr,
2361                                enum nl80211_iftype iftype)
2362 {
2363         if (!use_4addr) {
2364                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2365                         return -EBUSY;
2366                 return 0;
2367         }
2368
2369         switch (iftype) {
2370         case NL80211_IFTYPE_AP_VLAN:
2371                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2372                         return 0;
2373                 break;
2374         case NL80211_IFTYPE_STATION:
2375                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2376                         return 0;
2377                 break;
2378         default:
2379                 break;
2380         }
2381
2382         return -EOPNOTSUPP;
2383 }
2384
2385 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2386 {
2387         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2388         struct vif_params params;
2389         int err;
2390         enum nl80211_iftype otype, ntype;
2391         struct net_device *dev = info->user_ptr[1];
2392         u32 _flags, *flags = NULL;
2393         bool change = false;
2394
2395         memset(&params, 0, sizeof(params));
2396
2397         otype = ntype = dev->ieee80211_ptr->iftype;
2398
2399         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2400                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2401                 if (otype != ntype)
2402                         change = true;
2403                 if (ntype > NL80211_IFTYPE_MAX)
2404                         return -EINVAL;
2405         }
2406
2407         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2408                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2409
2410                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2411                         return -EINVAL;
2412                 if (netif_running(dev))
2413                         return -EBUSY;
2414
2415                 wdev_lock(wdev);
2416                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2417                              IEEE80211_MAX_MESH_ID_LEN);
2418                 wdev->mesh_id_up_len =
2419                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2420                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2421                        wdev->mesh_id_up_len);
2422                 wdev_unlock(wdev);
2423         }
2424
2425         if (info->attrs[NL80211_ATTR_4ADDR]) {
2426                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2427                 change = true;
2428                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2429                 if (err)
2430                         return err;
2431         } else {
2432                 params.use_4addr = -1;
2433         }
2434
2435         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2436                 if (ntype != NL80211_IFTYPE_MONITOR)
2437                         return -EINVAL;
2438                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2439                                           &_flags);
2440                 if (err)
2441                         return err;
2442
2443                 flags = &_flags;
2444                 change = true;
2445         }
2446
2447         if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
2448             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2449                 return -EOPNOTSUPP;
2450
2451         if (change)
2452                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2453         else
2454                 err = 0;
2455
2456         if (!err && params.use_4addr != -1)
2457                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2458
2459         return err;
2460 }
2461
2462 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2463 {
2464         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2465         struct vif_params params;
2466         struct wireless_dev *wdev;
2467         struct sk_buff *msg;
2468         int err;
2469         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2470         u32 flags;
2471
2472         memset(&params, 0, sizeof(params));
2473
2474         if (!info->attrs[NL80211_ATTR_IFNAME])
2475                 return -EINVAL;
2476
2477         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2478                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2479                 if (type > NL80211_IFTYPE_MAX)
2480                         return -EINVAL;
2481         }
2482
2483         if (!rdev->ops->add_virtual_intf ||
2484             !(rdev->wiphy.interface_modes & (1 << type)))
2485                 return -EOPNOTSUPP;
2486
2487         if (type == NL80211_IFTYPE_P2P_DEVICE && info->attrs[NL80211_ATTR_MAC]) {
2488                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2489                            ETH_ALEN);
2490                 if (!is_valid_ether_addr(params.macaddr))
2491                         return -EADDRNOTAVAIL;
2492         }
2493
2494         if (info->attrs[NL80211_ATTR_4ADDR]) {
2495                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2496                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2497                 if (err)
2498                         return err;
2499         }
2500
2501         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2502         if (!msg)
2503                 return -ENOMEM;
2504
2505         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2506                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2507                                   &flags);
2508
2509         if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
2510             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2511                 return -EOPNOTSUPP;
2512
2513         wdev = rdev_add_virtual_intf(rdev,
2514                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2515                                 type, err ? NULL : &flags, &params);
2516         if (IS_ERR(wdev)) {
2517                 nlmsg_free(msg);
2518                 return PTR_ERR(wdev);
2519         }
2520
2521         switch (type) {
2522         case NL80211_IFTYPE_MESH_POINT:
2523                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2524                         break;
2525                 wdev_lock(wdev);
2526                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2527                              IEEE80211_MAX_MESH_ID_LEN);
2528                 wdev->mesh_id_up_len =
2529                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2530                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2531                        wdev->mesh_id_up_len);
2532                 wdev_unlock(wdev);
2533                 break;
2534         case NL80211_IFTYPE_P2P_DEVICE:
2535                 /*
2536                  * P2P Device doesn't have a netdev, so doesn't go
2537                  * through the netdev notifier and must be added here
2538                  */
2539                 mutex_init(&wdev->mtx);
2540                 INIT_LIST_HEAD(&wdev->event_list);
2541                 spin_lock_init(&wdev->event_lock);
2542                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2543                 spin_lock_init(&wdev->mgmt_registrations_lock);
2544
2545                 wdev->identifier = ++rdev->wdev_id;
2546                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2547                 rdev->devlist_generation++;
2548                 break;
2549         default:
2550                 break;
2551         }
2552
2553         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2554                                rdev, wdev) < 0) {
2555                 nlmsg_free(msg);
2556                 return -ENOBUFS;
2557         }
2558
2559         return genlmsg_reply(msg, info);
2560 }
2561
2562 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2563 {
2564         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2565         struct wireless_dev *wdev = info->user_ptr[1];
2566
2567         if (!rdev->ops->del_virtual_intf)
2568                 return -EOPNOTSUPP;
2569
2570         /*
2571          * If we remove a wireless device without a netdev then clear
2572          * user_ptr[1] so that nl80211_post_doit won't dereference it
2573          * to check if it needs to do dev_put(). Otherwise it crashes
2574          * since the wdev has been freed, unlike with a netdev where
2575          * we need the dev_put() for the netdev to really be freed.
2576          */
2577         if (!wdev->netdev)
2578                 info->user_ptr[1] = NULL;
2579
2580         return rdev_del_virtual_intf(rdev, wdev);
2581 }
2582
2583 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2584 {
2585         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2586         struct net_device *dev = info->user_ptr[1];
2587         u16 noack_map;
2588
2589         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2590                 return -EINVAL;
2591
2592         if (!rdev->ops->set_noack_map)
2593                 return -EOPNOTSUPP;
2594
2595         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2596
2597         return rdev_set_noack_map(rdev, dev, noack_map);
2598 }
2599
2600 struct get_key_cookie {
2601         struct sk_buff *msg;
2602         int error;
2603         int idx;
2604 };
2605
2606 static void get_key_callback(void *c, struct key_params *params)
2607 {
2608         struct nlattr *key;
2609         struct get_key_cookie *cookie = c;
2610
2611         if ((params->key &&
2612              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2613                      params->key_len, params->key)) ||
2614             (params->seq &&
2615              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2616                      params->seq_len, params->seq)) ||
2617             (params->cipher &&
2618              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2619                          params->cipher)))
2620                 goto nla_put_failure;
2621
2622         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2623         if (!key)
2624                 goto nla_put_failure;
2625
2626         if ((params->key &&
2627              nla_put(cookie->msg, NL80211_KEY_DATA,
2628                      params->key_len, params->key)) ||
2629             (params->seq &&
2630              nla_put(cookie->msg, NL80211_KEY_SEQ,
2631                      params->seq_len, params->seq)) ||
2632             (params->cipher &&
2633              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2634                          params->cipher)))
2635                 goto nla_put_failure;
2636
2637         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2638                 goto nla_put_failure;
2639
2640         nla_nest_end(cookie->msg, key);
2641
2642         return;
2643  nla_put_failure:
2644         cookie->error = 1;
2645 }
2646
2647 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2648 {
2649         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2650         int err;
2651         struct net_device *dev = info->user_ptr[1];
2652         u8 key_idx = 0;
2653         const u8 *mac_addr = NULL;
2654         bool pairwise;
2655         struct get_key_cookie cookie = {
2656                 .error = 0,
2657         };
2658         void *hdr;
2659         struct sk_buff *msg;
2660
2661         if (info->attrs[NL80211_ATTR_KEY_IDX])
2662                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2663
2664         if (key_idx > 5)
2665                 return -EINVAL;
2666
2667         if (info->attrs[NL80211_ATTR_MAC])
2668                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2669
2670         pairwise = !!mac_addr;
2671         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2672                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2673                 if (kt >= NUM_NL80211_KEYTYPES)
2674                         return -EINVAL;
2675                 if (kt != NL80211_KEYTYPE_GROUP &&
2676                     kt != NL80211_KEYTYPE_PAIRWISE)
2677                         return -EINVAL;
2678                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2679         }
2680
2681         if (!rdev->ops->get_key)
2682                 return -EOPNOTSUPP;
2683
2684         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2685         if (!msg)
2686                 return -ENOMEM;
2687
2688         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2689                              NL80211_CMD_NEW_KEY);
2690         if (!hdr)
2691                 return -ENOBUFS;
2692
2693         cookie.msg = msg;
2694         cookie.idx = key_idx;
2695
2696         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2697             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2698                 goto nla_put_failure;
2699         if (mac_addr &&
2700             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2701                 goto nla_put_failure;
2702
2703         if (pairwise && mac_addr &&
2704             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2705                 return -ENOENT;
2706
2707         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2708                            get_key_callback);
2709
2710         if (err)
2711                 goto free_msg;
2712
2713         if (cookie.error)
2714                 goto nla_put_failure;
2715
2716         genlmsg_end(msg, hdr);
2717         return genlmsg_reply(msg, info);
2718
2719  nla_put_failure:
2720         err = -ENOBUFS;
2721  free_msg:
2722         nlmsg_free(msg);
2723         return err;
2724 }
2725
2726 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2727 {
2728         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2729         struct key_parse key;
2730         int err;
2731         struct net_device *dev = info->user_ptr[1];
2732
2733         err = nl80211_parse_key(info, &key);
2734         if (err)
2735                 return err;
2736
2737         if (key.idx < 0)
2738                 return -EINVAL;
2739
2740         /* only support setting default key */
2741         if (!key.def && !key.defmgmt)
2742                 return -EINVAL;
2743
2744         wdev_lock(dev->ieee80211_ptr);
2745
2746         if (key.def) {
2747                 if (!rdev->ops->set_default_key) {
2748                         err = -EOPNOTSUPP;
2749                         goto out;
2750                 }
2751
2752                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2753                 if (err)
2754                         goto out;
2755
2756                 err = rdev_set_default_key(rdev, dev, key.idx,
2757                                                  key.def_uni, key.def_multi);
2758
2759                 if (err)
2760                         goto out;
2761
2762 #ifdef CONFIG_CFG80211_WEXT
2763                 dev->ieee80211_ptr->wext.default_key = key.idx;
2764 #endif
2765         } else {
2766                 if (key.def_uni || !key.def_multi) {
2767                         err = -EINVAL;
2768                         goto out;
2769                 }
2770
2771                 if (!rdev->ops->set_default_mgmt_key) {
2772                         err = -EOPNOTSUPP;
2773                         goto out;
2774                 }
2775
2776                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2777                 if (err)
2778                         goto out;
2779
2780                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2781                 if (err)
2782                         goto out;
2783
2784 #ifdef CONFIG_CFG80211_WEXT
2785                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2786 #endif
2787         }
2788
2789  out:
2790         wdev_unlock(dev->ieee80211_ptr);
2791
2792         return err;
2793 }
2794
2795 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2796 {
2797         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2798         int err;
2799         struct net_device *dev = info->user_ptr[1];
2800         struct key_parse key;
2801         const u8 *mac_addr = NULL;
2802
2803         err = nl80211_parse_key(info, &key);
2804         if (err)
2805                 return err;
2806
2807         if (!key.p.key)
2808                 return -EINVAL;
2809
2810         if (info->attrs[NL80211_ATTR_MAC])
2811                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2812
2813         if (key.type == -1) {
2814                 if (mac_addr)
2815                         key.type = NL80211_KEYTYPE_PAIRWISE;
2816                 else
2817                         key.type = NL80211_KEYTYPE_GROUP;
2818         }
2819
2820         /* for now */
2821         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2822             key.type != NL80211_KEYTYPE_GROUP)
2823                 return -EINVAL;
2824
2825         if (!rdev->ops->add_key)
2826                 return -EOPNOTSUPP;
2827
2828         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2829                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2830                                            mac_addr))
2831                 return -EINVAL;
2832
2833         wdev_lock(dev->ieee80211_ptr);
2834         err = nl80211_key_allowed(dev->ieee80211_ptr);
2835         if (!err)
2836                 err = rdev_add_key(rdev, dev, key.idx,
2837                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2838                                     mac_addr, &key.p);
2839         wdev_unlock(dev->ieee80211_ptr);
2840
2841         return err;
2842 }
2843
2844 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2845 {
2846         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2847         int err;
2848         struct net_device *dev = info->user_ptr[1];
2849         u8 *mac_addr = NULL;
2850         struct key_parse key;
2851
2852         err = nl80211_parse_key(info, &key);
2853         if (err)
2854                 return err;
2855
2856         if (info->attrs[NL80211_ATTR_MAC])
2857                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2858
2859         if (key.type == -1) {
2860                 if (mac_addr)
2861                         key.type = NL80211_KEYTYPE_PAIRWISE;
2862                 else
2863                         key.type = NL80211_KEYTYPE_GROUP;
2864         }
2865
2866         /* for now */
2867         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2868             key.type != NL80211_KEYTYPE_GROUP)
2869                 return -EINVAL;
2870
2871         if (!rdev->ops->del_key)
2872                 return -EOPNOTSUPP;
2873
2874         wdev_lock(dev->ieee80211_ptr);
2875         err = nl80211_key_allowed(dev->ieee80211_ptr);
2876
2877         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2878             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2879                 err = -ENOENT;
2880
2881         if (!err)
2882                 err = rdev_del_key(rdev, dev, key.idx,
2883                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2884                                    mac_addr);
2885
2886 #ifdef CONFIG_CFG80211_WEXT
2887         if (!err) {
2888                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
2889                         dev->ieee80211_ptr->wext.default_key = -1;
2890                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2891                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2892         }
2893 #endif
2894         wdev_unlock(dev->ieee80211_ptr);
2895
2896         return err;
2897 }
2898
2899 /* This function returns an error or the number of nested attributes */
2900 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
2901 {
2902         struct nlattr *attr;
2903         int n_entries = 0, tmp;
2904
2905         nla_for_each_nested(attr, nl_attr, tmp) {
2906                 if (nla_len(attr) != ETH_ALEN)
2907                         return -EINVAL;
2908
2909                 n_entries++;
2910         }
2911
2912         return n_entries;
2913 }
2914
2915 /*
2916  * This function parses ACL information and allocates memory for ACL data.
2917  * On successful return, the calling function is responsible to free the
2918  * ACL buffer returned by this function.
2919  */
2920 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
2921                                                 struct genl_info *info)
2922 {
2923         enum nl80211_acl_policy acl_policy;
2924         struct nlattr *attr;
2925         struct cfg80211_acl_data *acl;
2926         int i = 0, n_entries, tmp;
2927
2928         if (!wiphy->max_acl_mac_addrs)
2929                 return ERR_PTR(-EOPNOTSUPP);
2930
2931         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
2932                 return ERR_PTR(-EINVAL);
2933
2934         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
2935         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
2936             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
2937                 return ERR_PTR(-EINVAL);
2938
2939         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
2940                 return ERR_PTR(-EINVAL);
2941
2942         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
2943         if (n_entries < 0)
2944                 return ERR_PTR(n_entries);
2945
2946         if (n_entries > wiphy->max_acl_mac_addrs)
2947                 return ERR_PTR(-ENOTSUPP);
2948
2949         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
2950                       GFP_KERNEL);
2951         if (!acl)
2952                 return ERR_PTR(-ENOMEM);
2953
2954         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
2955                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
2956                 i++;
2957         }
2958
2959         acl->n_acl_entries = n_entries;
2960         acl->acl_policy = acl_policy;
2961
2962         return acl;
2963 }
2964
2965 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
2966 {
2967         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2968         struct net_device *dev = info->user_ptr[1];
2969         struct cfg80211_acl_data *acl;
2970         int err;
2971
2972         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2973             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2974                 return -EOPNOTSUPP;
2975
2976         if (!dev->ieee80211_ptr->beacon_interval)
2977                 return -EINVAL;
2978
2979         acl = parse_acl_data(&rdev->wiphy, info);
2980         if (IS_ERR(acl))
2981                 return PTR_ERR(acl);
2982
2983         err = rdev_set_mac_acl(rdev, dev, acl);
2984
2985         kfree(acl);
2986
2987         return err;
2988 }
2989
2990 static int nl80211_parse_beacon(struct nlattr *attrs[],
2991                                 struct cfg80211_beacon_data *bcn)
2992 {
2993         bool haveinfo = false;
2994
2995         if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
2996             !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
2997             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
2998             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2999                 return -EINVAL;
3000
3001         memset(bcn, 0, sizeof(*bcn));
3002
3003         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
3004                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
3005                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
3006                 if (!bcn->head_len)
3007                         return -EINVAL;
3008                 haveinfo = true;
3009         }
3010
3011         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
3012                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
3013                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
3014                 haveinfo = true;
3015         }
3016
3017         if (!haveinfo)
3018                 return -EINVAL;
3019
3020         if (attrs[NL80211_ATTR_IE]) {
3021                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
3022                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3023         }
3024
3025         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3026                 bcn->proberesp_ies =
3027                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3028                 bcn->proberesp_ies_len =
3029                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3030         }
3031
3032         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3033                 bcn->assocresp_ies =
3034                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3035                 bcn->assocresp_ies_len =
3036                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3037         }
3038
3039         if (attrs[NL80211_ATTR_PROBE_RESP]) {
3040                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
3041                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3042         }
3043
3044         return 0;
3045 }
3046
3047 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
3048                                    struct cfg80211_ap_settings *params)
3049 {
3050         struct wireless_dev *wdev;
3051         bool ret = false;
3052
3053         list_for_each_entry(wdev, &rdev->wdev_list, list) {
3054                 if (wdev->iftype != NL80211_IFTYPE_AP &&
3055                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
3056                         continue;
3057
3058                 if (!wdev->preset_chandef.chan)
3059                         continue;
3060
3061                 params->chandef = wdev->preset_chandef;
3062                 ret = true;
3063                 break;
3064         }
3065
3066         return ret;
3067 }
3068
3069 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3070                                     enum nl80211_auth_type auth_type,
3071                                     enum nl80211_commands cmd)
3072 {
3073         if (auth_type > NL80211_AUTHTYPE_MAX)
3074                 return false;
3075
3076         switch (cmd) {
3077         case NL80211_CMD_AUTHENTICATE:
3078                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3079                     auth_type == NL80211_AUTHTYPE_SAE)
3080                         return false;
3081                 return true;
3082         case NL80211_CMD_CONNECT:
3083         case NL80211_CMD_START_AP:
3084                 /* SAE not supported yet */
3085                 if (auth_type == NL80211_AUTHTYPE_SAE)
3086                         return false;
3087                 return true;
3088         default:
3089                 return false;
3090         }
3091 }
3092
3093 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3094 {
3095         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3096         struct net_device *dev = info->user_ptr[1];
3097         struct wireless_dev *wdev = dev->ieee80211_ptr;
3098         struct cfg80211_ap_settings params;
3099         int err;
3100         u8 radar_detect_width = 0;
3101
3102         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3103             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3104                 return -EOPNOTSUPP;
3105
3106         if (!rdev->ops->start_ap)
3107                 return -EOPNOTSUPP;
3108
3109         if (wdev->beacon_interval)
3110                 return -EALREADY;
3111
3112         memset(&params, 0, sizeof(params));
3113
3114         /* these are required for START_AP */
3115         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3116             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3117             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3118                 return -EINVAL;
3119
3120         err = nl80211_parse_beacon(info->attrs, &params.beacon);
3121         if (err)
3122                 return err;
3123
3124         params.beacon_interval =
3125                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3126         params.dtim_period =
3127                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3128
3129         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
3130         if (err)
3131                 return err;
3132
3133         /*
3134          * In theory, some of these attributes should be required here
3135          * but since they were not used when the command was originally
3136          * added, keep them optional for old user space programs to let
3137          * them continue to work with drivers that do not need the
3138          * additional information -- drivers must check!
3139          */
3140         if (info->attrs[NL80211_ATTR_SSID]) {
3141                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3142                 params.ssid_len =
3143                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3144                 if (params.ssid_len == 0 ||
3145                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3146                         return -EINVAL;
3147         }
3148
3149         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3150                 params.hidden_ssid = nla_get_u32(
3151                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3152                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3153                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3154                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3155                         return -EINVAL;
3156         }
3157
3158         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3159
3160         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3161                 params.auth_type = nla_get_u32(
3162                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3163                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3164                                              NL80211_CMD_START_AP))
3165                         return -EINVAL;
3166         } else
3167                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3168
3169         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3170                                       NL80211_MAX_NR_CIPHER_SUITES);
3171         if (err)
3172                 return err;
3173
3174         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3175                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3176                         return -EOPNOTSUPP;
3177                 params.inactivity_timeout = nla_get_u16(
3178                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3179         }
3180
3181         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3182                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3183                         return -EINVAL;
3184                 params.p2p_ctwindow =
3185                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3186                 if (params.p2p_ctwindow > 127)
3187                         return -EINVAL;
3188                 if (params.p2p_ctwindow != 0 &&
3189                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3190                         return -EINVAL;
3191         }
3192
3193         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3194                 u8 tmp;
3195
3196                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3197                         return -EINVAL;
3198                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3199                 if (tmp > 1)
3200                         return -EINVAL;
3201                 params.p2p_opp_ps = tmp;
3202                 if (params.p2p_opp_ps != 0 &&
3203                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3204                         return -EINVAL;
3205         }
3206
3207         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3208                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
3209                 if (err)
3210                         return err;
3211         } else if (wdev->preset_chandef.chan) {
3212                 params.chandef = wdev->preset_chandef;
3213         } else if (!nl80211_get_ap_channel(rdev, &params))
3214                 return -EINVAL;
3215
3216         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
3217                 return -EINVAL;
3218
3219         err = cfg80211_chandef_dfs_required(wdev->wiphy, &params.chandef);
3220         if (err < 0)
3221                 return err;
3222         if (err) {
3223                 radar_detect_width = BIT(params.chandef.width);
3224                 params.radar_required = true;
3225         }
3226
3227         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
3228                                            params.chandef.chan,
3229                                            CHAN_MODE_SHARED,
3230                                            radar_detect_width);
3231         if (err)
3232                 return err;
3233
3234         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3235                 params.acl = parse_acl_data(&rdev->wiphy, info);
3236                 if (IS_ERR(params.acl))
3237                         return PTR_ERR(params.acl);
3238         }
3239
3240         wdev_lock(wdev);
3241         err = rdev_start_ap(rdev, dev, &params);
3242         if (!err) {
3243                 wdev->preset_chandef = params.chandef;
3244                 wdev->beacon_interval = params.beacon_interval;
3245                 wdev->channel = params.chandef.chan;
3246                 wdev->ssid_len = params.ssid_len;
3247                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3248         }
3249         wdev_unlock(wdev);
3250
3251         kfree(params.acl);
3252
3253         return err;
3254 }
3255
3256 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3257 {
3258         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3259         struct net_device *dev = info->user_ptr[1];
3260         struct wireless_dev *wdev = dev->ieee80211_ptr;
3261         struct cfg80211_beacon_data params;
3262         int err;
3263
3264         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3265             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3266                 return -EOPNOTSUPP;
3267
3268         if (!rdev->ops->change_beacon)
3269                 return -EOPNOTSUPP;
3270
3271         if (!wdev->beacon_interval)
3272                 return -EINVAL;
3273
3274         err = nl80211_parse_beacon(info->attrs, &params);
3275         if (err)
3276                 return err;
3277
3278         wdev_lock(wdev);
3279         err = rdev_change_beacon(rdev, dev, &params);
3280         wdev_unlock(wdev);
3281
3282         return err;
3283 }
3284
3285 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3286 {
3287         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3288         struct net_device *dev = info->user_ptr[1];
3289
3290         return cfg80211_stop_ap(rdev, dev);
3291 }
3292
3293 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3294         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3295         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3296         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3297         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3298         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3299         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3300 };
3301
3302 static int parse_station_flags(struct genl_info *info,
3303                                enum nl80211_iftype iftype,
3304                                struct station_parameters *params)
3305 {
3306         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3307         struct nlattr *nla;
3308         int flag;
3309
3310         /*
3311          * Try parsing the new attribute first so userspace
3312          * can specify both for older kernels.
3313          */
3314         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3315         if (nla) {
3316                 struct nl80211_sta_flag_update *sta_flags;
3317
3318                 sta_flags = nla_data(nla);
3319                 params->sta_flags_mask = sta_flags->mask;
3320                 params->sta_flags_set = sta_flags->set;
3321                 params->sta_flags_set &= params->sta_flags_mask;
3322                 if ((params->sta_flags_mask |
3323                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3324                         return -EINVAL;
3325                 return 0;
3326         }
3327
3328         /* if present, parse the old attribute */
3329
3330         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3331         if (!nla)
3332                 return 0;
3333
3334         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3335                              nla, sta_flags_policy))
3336                 return -EINVAL;
3337
3338         /*
3339          * Only allow certain flags for interface types so that
3340          * other attributes are silently ignored. Remember that
3341          * this is backward compatibility code with old userspace
3342          * and shouldn't be hit in other cases anyway.
3343          */
3344         switch (iftype) {
3345         case NL80211_IFTYPE_AP:
3346         case NL80211_IFTYPE_AP_VLAN:
3347         case NL80211_IFTYPE_P2P_GO:
3348                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3349                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3350                                          BIT(NL80211_STA_FLAG_WME) |
3351                                          BIT(NL80211_STA_FLAG_MFP);
3352                 break;
3353         case NL80211_IFTYPE_P2P_CLIENT:
3354         case NL80211_IFTYPE_STATION:
3355                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3356                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3357                 break;
3358         case NL80211_IFTYPE_MESH_POINT:
3359                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3360                                          BIT(NL80211_STA_FLAG_MFP) |
3361                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3362         default:
3363                 return -EINVAL;
3364         }
3365
3366         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3367                 if (flags[flag]) {
3368                         params->sta_flags_set |= (1<<flag);
3369
3370                         /* no longer support new API additions in old API */
3371                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3372                                 return -EINVAL;
3373                 }
3374         }
3375
3376         return 0;
3377 }
3378
3379 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3380                                  int attr)
3381 {
3382         struct nlattr *rate;
3383         u32 bitrate;
3384         u16 bitrate_compat;
3385
3386         rate = nla_nest_start(msg, attr);
3387         if (!rate)
3388                 return false;
3389
3390         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3391         bitrate = cfg80211_calculate_bitrate(info);
3392         /* report 16-bit bitrate only if we can */
3393         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3394         if (bitrate > 0 &&
3395             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3396                 return false;
3397         if (bitrate_compat > 0 &&
3398             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3399                 return false;
3400
3401         if (info->flags & RATE_INFO_FLAGS_MCS) {
3402                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3403                         return false;
3404                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3405                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3406                         return false;
3407                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3408                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3409                         return false;
3410         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3411                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3412                         return false;
3413                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3414                         return false;
3415                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3416                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3417                         return false;
3418                 if (info->flags & RATE_INFO_FLAGS_80_MHZ_WIDTH &&
3419                     nla_put_flag(msg, NL80211_RATE_INFO_80_MHZ_WIDTH))
3420                         return false;
3421                 if (info->flags & RATE_INFO_FLAGS_80P80_MHZ_WIDTH &&
3422                     nla_put_flag(msg, NL80211_RATE_INFO_80P80_MHZ_WIDTH))
3423                         return false;
3424                 if (info->flags & RATE_INFO_FLAGS_160_MHZ_WIDTH &&
3425                     nla_put_flag(msg, NL80211_RATE_INFO_160_MHZ_WIDTH))
3426                         return false;
3427                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3428                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3429                         return false;
3430         }
3431
3432         nla_nest_end(msg, rate);
3433         return true;
3434 }
3435
3436 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
3437                                int id)
3438 {
3439         void *attr;
3440         int i = 0;
3441
3442         if (!mask)
3443                 return true;
3444
3445         attr = nla_nest_start(msg, id);
3446         if (!attr)
3447                 return false;
3448
3449         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
3450                 if (!(mask & BIT(i)))
3451                         continue;
3452
3453                 if (nla_put_u8(msg, i, signal[i]))
3454                         return false;
3455         }
3456
3457         nla_nest_end(msg, attr);
3458
3459         return true;
3460 }
3461
3462 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
3463                                 int flags,
3464                                 struct cfg80211_registered_device *rdev,
3465                                 struct net_device *dev,
3466                                 const u8 *mac_addr, struct station_info *sinfo)
3467 {
3468         void *hdr;
3469         struct nlattr *sinfoattr, *bss_param;
3470
3471         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3472         if (!hdr)
3473                 return -1;
3474
3475         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3476             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3477             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3478                 goto nla_put_failure;
3479
3480         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3481         if (!sinfoattr)
3482                 goto nla_put_failure;
3483         if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
3484             nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
3485                         sinfo->connected_time))
3486                 goto nla_put_failure;
3487         if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
3488             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
3489                         sinfo->inactive_time))
3490                 goto nla_put_failure;
3491         if ((sinfo->filled & (STATION_INFO_RX_BYTES |
3492                               STATION_INFO_RX_BYTES64)) &&
3493             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3494                         (u32)sinfo->rx_bytes))
3495                 goto nla_put_failure;
3496         if ((sinfo->filled & (STATION_INFO_TX_BYTES |
3497                               STATION_INFO_TX_BYTES64)) &&
3498             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3499                         (u32)sinfo->tx_bytes))
3500                 goto nla_put_failure;
3501         if ((sinfo->filled & STATION_INFO_RX_BYTES64) &&
3502             nla_put_u64(msg, NL80211_STA_INFO_RX_BYTES64,
3503                         sinfo->rx_bytes))
3504                 goto nla_put_failure;
3505         if ((sinfo->filled & STATION_INFO_TX_BYTES64) &&
3506             nla_put_u64(msg, NL80211_STA_INFO_TX_BYTES64,
3507                         sinfo->tx_bytes))
3508                 goto nla_put_failure;
3509         if ((sinfo->filled & STATION_INFO_LLID) &&
3510             nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
3511                 goto nla_put_failure;
3512         if ((sinfo->filled & STATION_INFO_PLID) &&
3513             nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
3514                 goto nla_put_failure;
3515         if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
3516             nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
3517                        sinfo->plink_state))
3518                 goto nla_put_failure;
3519         switch (rdev->wiphy.signal_type) {
3520         case CFG80211_SIGNAL_TYPE_MBM:
3521                 if ((sinfo->filled & STATION_INFO_SIGNAL) &&
3522                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
3523                                sinfo->signal))
3524                         goto nla_put_failure;
3525                 if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
3526                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
3527                                sinfo->signal_avg))
3528                         goto nla_put_failure;
3529                 break;
3530         default:
3531                 break;
3532         }
3533         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL) {
3534                 if (!nl80211_put_signal(msg, sinfo->chains,
3535                                         sinfo->chain_signal,
3536                                         NL80211_STA_INFO_CHAIN_SIGNAL))
3537                         goto nla_put_failure;
3538         }
3539         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL_AVG) {
3540                 if (!nl80211_put_signal(msg, sinfo->chains,
3541                                         sinfo->chain_signal_avg,
3542                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
3543                         goto nla_put_failure;
3544         }
3545         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
3546                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3547                                           NL80211_STA_INFO_TX_BITRATE))
3548                         goto nla_put_failure;
3549         }
3550         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
3551                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3552                                           NL80211_STA_INFO_RX_BITRATE))
3553                         goto nla_put_failure;
3554         }
3555         if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
3556             nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
3557                         sinfo->rx_packets))
3558                 goto nla_put_failure;
3559         if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
3560             nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
3561                         sinfo->tx_packets))
3562                 goto nla_put_failure;
3563         if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
3564             nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
3565                         sinfo->tx_retries))
3566                 goto nla_put_failure;
3567         if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
3568             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
3569                         sinfo->tx_failed))
3570                 goto nla_put_failure;
3571         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
3572             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
3573                         sinfo->beacon_loss_count))
3574                 goto nla_put_failure;
3575         if ((sinfo->filled & STATION_INFO_LOCAL_PM) &&
3576             nla_put_u32(msg, NL80211_STA_INFO_LOCAL_PM,
3577                         sinfo->local_pm))
3578                 goto nla_put_failure;
3579         if ((sinfo->filled & STATION_INFO_PEER_PM) &&
3580             nla_put_u32(msg, NL80211_STA_INFO_PEER_PM,
3581                         sinfo->peer_pm))
3582                 goto nla_put_failure;
3583         if ((sinfo->filled & STATION_INFO_NONPEER_PM) &&
3584             nla_put_u32(msg, NL80211_STA_INFO_NONPEER_PM,
3585                         sinfo->nonpeer_pm))
3586                 goto nla_put_failure;
3587         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
3588                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3589                 if (!bss_param)
3590                         goto nla_put_failure;
3591
3592                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3593                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3594                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3595                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3596                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3597                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3598                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3599                                sinfo->bss_param.dtim_period) ||
3600                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3601                                 sinfo->bss_param.beacon_interval))
3602                         goto nla_put_failure;
3603
3604                 nla_nest_end(msg, bss_param);
3605         }
3606         if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
3607             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3608                     sizeof(struct nl80211_sta_flag_update),
3609                     &sinfo->sta_flags))
3610                 goto nla_put_failure;
3611         if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
3612                 nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
3613                             sinfo->t_offset))
3614                 goto nla_put_failure;
3615         nla_nest_end(msg, sinfoattr);
3616
3617         if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
3618             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3619                     sinfo->assoc_req_ies))
3620                 goto nla_put_failure;
3621
3622         return genlmsg_end(msg, hdr);
3623
3624  nla_put_failure:
3625         genlmsg_cancel(msg, hdr);
3626         return -EMSGSIZE;
3627 }
3628
3629 static int nl80211_dump_station(struct sk_buff *skb,
3630                                 struct netlink_callback *cb)
3631 {
3632         struct station_info sinfo;
3633         struct cfg80211_registered_device *dev;
3634         struct wireless_dev *wdev;
3635         u8 mac_addr[ETH_ALEN];
3636         int sta_idx = cb->args[2];
3637         int err;
3638
3639         err = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
3640         if (err)
3641                 return err;
3642
3643         if (!wdev->netdev) {
3644                 err = -EINVAL;
3645                 goto out_err;
3646         }
3647
3648         if (!dev->ops->dump_station) {
3649                 err = -EOPNOTSUPP;
3650                 goto out_err;
3651         }
3652
3653         while (1) {
3654                 memset(&sinfo, 0, sizeof(sinfo));
3655                 err = rdev_dump_station(dev, wdev->netdev, sta_idx,
3656                                         mac_addr, &sinfo);
3657                 if (err == -ENOENT)
3658                         break;
3659                 if (err)
3660                         goto out_err;
3661
3662                 if (nl80211_send_station(skb,
3663                                 NETLINK_CB(cb->skb).portid,
3664                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3665                                 dev, wdev->netdev, mac_addr,
3666                                 &sinfo) < 0)
3667                         goto out;
3668
3669                 sta_idx++;
3670         }
3671
3672
3673  out:
3674         cb->args[2] = sta_idx;
3675         err = skb->len;
3676  out_err:
3677         nl80211_finish_wdev_dump(dev);
3678
3679         return err;
3680 }
3681
3682 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3683 {
3684         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3685         struct net_device *dev = info->user_ptr[1];
3686         struct station_info sinfo;
3687         struct sk_buff *msg;
3688         u8 *mac_addr = NULL;
3689         int err;
3690
3691         memset(&sinfo, 0, sizeof(sinfo));
3692
3693         if (!info->attrs[NL80211_ATTR_MAC])
3694                 return -EINVAL;
3695
3696         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3697
3698         if (!rdev->ops->get_station)
3699                 return -EOPNOTSUPP;
3700
3701         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3702         if (err)
3703                 return err;
3704
3705         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3706         if (!msg)
3707                 return -ENOMEM;
3708
3709         if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3710                                  rdev, dev, mac_addr, &sinfo) < 0) {
3711                 nlmsg_free(msg);
3712                 return -ENOBUFS;
3713         }
3714
3715         return genlmsg_reply(msg, info);
3716 }
3717
3718 int cfg80211_check_station_change(struct wiphy *wiphy,
3719                                   struct station_parameters *params,
3720                                   enum cfg80211_station_type statype)
3721 {
3722         if (params->listen_interval != -1)
3723                 return -EINVAL;
3724         if (params->aid)
3725                 return -EINVAL;
3726
3727         /* When you run into this, adjust the code below for the new flag */
3728         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
3729
3730         switch (statype) {
3731         case CFG80211_STA_MESH_PEER_KERNEL:
3732         case CFG80211_STA_MESH_PEER_USER:
3733                 /*
3734                  * No ignoring the TDLS flag here -- the userspace mesh
3735                  * code doesn't have the bug of including TDLS in the
3736                  * mask everywhere.
3737                  */
3738                 if (params->sta_flags_mask &
3739                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3740                                   BIT(NL80211_STA_FLAG_MFP) |
3741                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3742                         return -EINVAL;
3743                 break;
3744         case CFG80211_STA_TDLS_PEER_SETUP:
3745         case CFG80211_STA_TDLS_PEER_ACTIVE:
3746                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3747                         return -EINVAL;
3748                 /* ignore since it can't change */
3749                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3750                 break;
3751         default:
3752                 /* disallow mesh-specific things */
3753                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3754                         return -EINVAL;
3755                 if (params->local_pm)
3756                         return -EINVAL;
3757                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3758                         return -EINVAL;
3759         }
3760
3761         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
3762             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
3763                 /* TDLS can't be set, ... */
3764                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3765                         return -EINVAL;
3766                 /*
3767                  * ... but don't bother the driver with it. This works around
3768                  * a hostapd/wpa_supplicant issue -- it always includes the
3769                  * TLDS_PEER flag in the mask even for AP mode.
3770                  */
3771                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3772         }
3773
3774         if (statype != CFG80211_STA_TDLS_PEER_SETUP) {
3775                 /* reject other things that can't change */
3776                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
3777                         return -EINVAL;
3778                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
3779                         return -EINVAL;
3780                 if (params->supported_rates)
3781                         return -EINVAL;
3782                 if (params->ext_capab || params->ht_capa || params->vht_capa)
3783                         return -EINVAL;
3784         }
3785
3786         if (statype != CFG80211_STA_AP_CLIENT) {
3787                 if (params->vlan)
3788                         return -EINVAL;
3789         }
3790
3791         switch (statype) {
3792         case CFG80211_STA_AP_MLME_CLIENT:
3793                 /* Use this only for authorizing/unauthorizing a station */
3794                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
3795                         return -EOPNOTSUPP;
3796                 break;
3797         case CFG80211_STA_AP_CLIENT:
3798                 /* accept only the listed bits */
3799                 if (params->sta_flags_mask &
3800                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3801                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3802                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
3803                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3804                                   BIT(NL80211_STA_FLAG_WME) |
3805                                   BIT(NL80211_STA_FLAG_MFP)))
3806                         return -EINVAL;
3807
3808                 /* but authenticated/associated only if driver handles it */
3809                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
3810                     params->sta_flags_mask &
3811                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3812                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
3813                         return -EINVAL;
3814                 break;
3815         case CFG80211_STA_IBSS:
3816         case CFG80211_STA_AP_STA:
3817                 /* reject any changes other than AUTHORIZED */
3818                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
3819                         return -EINVAL;
3820                 break;
3821         case CFG80211_STA_TDLS_PEER_SETUP:
3822                 /* reject any changes other than AUTHORIZED or WME */
3823                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3824                                                BIT(NL80211_STA_FLAG_WME)))
3825                         return -EINVAL;
3826                 /* force (at least) rates when authorizing */
3827                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
3828                     !params->supported_rates)
3829                         return -EINVAL;
3830                 break;
3831         case CFG80211_STA_TDLS_PEER_ACTIVE:
3832                 /* reject any changes */
3833                 return -EINVAL;
3834         case CFG80211_STA_MESH_PEER_KERNEL:
3835                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3836                         return -EINVAL;
3837                 break;
3838         case CFG80211_STA_MESH_PEER_USER:
3839                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3840                         return -EINVAL;
3841                 break;
3842         }
3843
3844         return 0;
3845 }
3846 EXPORT_SYMBOL(cfg80211_check_station_change);
3847
3848 /*
3849  * Get vlan interface making sure it is running and on the right wiphy.
3850  */
3851 static struct net_device *get_vlan(struct genl_info *info,
3852                                    struct cfg80211_registered_device *rdev)
3853 {
3854         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
3855         struct net_device *v;
3856         int ret;
3857
3858         if (!vlanattr)
3859                 return NULL;
3860
3861         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
3862         if (!v)
3863                 return ERR_PTR(-ENODEV);
3864
3865         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
3866                 ret = -EINVAL;
3867                 goto error;
3868         }
3869
3870         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
3871             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3872             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
3873                 ret = -EINVAL;
3874                 goto error;
3875         }
3876
3877         if (!netif_running(v)) {
3878                 ret = -ENETDOWN;
3879                 goto error;
3880         }
3881
3882         return v;
3883  error:
3884         dev_put(v);
3885         return ERR_PTR(ret);
3886 }
3887
3888 static struct nla_policy
3889 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
3890         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
3891         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
3892 };
3893
3894 static int nl80211_parse_sta_wme(struct genl_info *info,
3895                                  struct station_parameters *params)
3896 {
3897         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
3898         struct nlattr *nla;
3899         int err;
3900
3901         /* parse WME attributes if present */
3902         if (!info->attrs[NL80211_ATTR_STA_WME])
3903                 return 0;
3904
3905         nla = info->attrs[NL80211_ATTR_STA_WME];
3906         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
3907                                nl80211_sta_wme_policy);
3908         if (err)
3909                 return err;
3910
3911         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
3912                 params->uapsd_queues = nla_get_u8(
3913                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
3914         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
3915                 return -EINVAL;
3916
3917         if (tb[NL80211_STA_WME_MAX_SP])
3918                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
3919
3920         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
3921                 return -EINVAL;
3922
3923         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
3924
3925         return 0;
3926 }
3927
3928 static int nl80211_parse_sta_channel_info(struct genl_info *info,
3929                                       struct station_parameters *params)
3930 {
3931         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
3932                 params->supported_channels =
3933                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
3934                 params->supported_channels_len =
3935                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
3936                 /*
3937                  * Need to include at least one (first channel, number of
3938                  * channels) tuple for each subband, and must have proper
3939                  * tuples for the rest of the data as well.
3940                  */
3941                 if (params->supported_channels_len < 2)
3942                         return -EINVAL;
3943                 if (params->supported_channels_len % 2)
3944                         return -EINVAL;
3945         }
3946
3947         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
3948                 params->supported_oper_classes =
3949                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
3950                 params->supported_oper_classes_len =
3951                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
3952                 /*
3953                  * The value of the Length field of the Supported Operating
3954                  * Classes element is between 2 and 253.
3955                  */
3956                 if (params->supported_oper_classes_len < 2 ||
3957                     params->supported_oper_classes_len > 253)
3958                         return -EINVAL;
3959         }
3960         return 0;
3961 }
3962
3963 static int nl80211_set_station_tdls(struct genl_info *info,
3964                                     struct station_parameters *params)
3965 {
3966         int err;
3967         /* Dummy STA entry gets updated once the peer capabilities are known */
3968         if (info->attrs[NL80211_ATTR_PEER_AID])
3969                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
3970         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3971                 params->ht_capa =
3972                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3973         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
3974                 params->vht_capa =
3975                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
3976
3977         err = nl80211_parse_sta_channel_info(info, params);
3978         if (err)
3979                 return err;
3980
3981         return nl80211_parse_sta_wme(info, params);
3982 }
3983
3984 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
3985 {
3986         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3987         struct net_device *dev = info->user_ptr[1];
3988         struct station_parameters params;
3989         u8 *mac_addr;
3990         int err;
3991
3992         memset(&params, 0, sizeof(params));
3993
3994         params.listen_interval = -1;
3995
3996         if (!rdev->ops->change_station)
3997                 return -EOPNOTSUPP;
3998
3999         if (info->attrs[NL80211_ATTR_STA_AID])
4000                 return -EINVAL;
4001
4002         if (!info->attrs[NL80211_ATTR_MAC])
4003                 return -EINVAL;
4004
4005         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4006
4007         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
4008                 params.supported_rates =
4009                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4010                 params.supported_rates_len =
4011                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4012         }
4013
4014         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4015                 params.capability =
4016                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4017                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4018         }
4019
4020         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4021                 params.ext_capab =
4022                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4023                 params.ext_capab_len =
4024                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4025         }
4026
4027         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4028                 return -EINVAL;
4029
4030         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4031                 return -EINVAL;
4032
4033         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4034                 params.plink_action =
4035                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4036                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4037                         return -EINVAL;
4038         }
4039
4040         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
4041                 params.plink_state =
4042                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
4043                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
4044                         return -EINVAL;
4045                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
4046         }
4047
4048         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
4049                 enum nl80211_mesh_power_mode pm = nla_get_u32(
4050                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
4051
4052                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
4053                     pm > NL80211_MESH_POWER_MAX)
4054                         return -EINVAL;
4055
4056                 params.local_pm = pm;
4057         }
4058
4059         /* Include parameters for TDLS peer (will check later) */
4060         err = nl80211_set_station_tdls(info, &params);
4061         if (err)
4062                 return err;
4063
4064         params.vlan = get_vlan(info, rdev);
4065         if (IS_ERR(params.vlan))
4066                 return PTR_ERR(params.vlan);
4067
4068         switch (dev->ieee80211_ptr->iftype) {
4069         case NL80211_IFTYPE_AP:
4070         case NL80211_IFTYPE_AP_VLAN:
4071         case NL80211_IFTYPE_P2P_GO:
4072         case NL80211_IFTYPE_P2P_CLIENT:
4073         case NL80211_IFTYPE_STATION:
4074         case NL80211_IFTYPE_ADHOC:
4075         case NL80211_IFTYPE_MESH_POINT:
4076                 break;
4077         default:
4078                 err = -EOPNOTSUPP;
4079                 goto out_put_vlan;
4080         }
4081
4082         /* driver will call cfg80211_check_station_change() */
4083         err = rdev_change_station(rdev, dev, mac_addr, &params);
4084
4085  out_put_vlan:
4086         if (params.vlan)
4087                 dev_put(params.vlan);
4088
4089         return err;
4090 }
4091
4092 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
4093 {
4094         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4095         int err;
4096         struct net_device *dev = info->user_ptr[1];
4097         struct station_parameters params;
4098         u8 *mac_addr = NULL;
4099
4100         memset(&params, 0, sizeof(params));
4101
4102         if (!rdev->ops->add_station)
4103                 return -EOPNOTSUPP;
4104
4105         if (!info->attrs[NL80211_ATTR_MAC])
4106                 return -EINVAL;
4107
4108         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4109                 return -EINVAL;
4110
4111         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
4112                 return -EINVAL;
4113
4114         if (!info->attrs[NL80211_ATTR_STA_AID] &&
4115             !info->attrs[NL80211_ATTR_PEER_AID])
4116                 return -EINVAL;
4117
4118         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4119         params.supported_rates =
4120                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4121         params.supported_rates_len =
4122                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4123         params.listen_interval =
4124                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4125
4126         if (info->attrs[NL80211_ATTR_PEER_AID])
4127                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4128         else
4129                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4130         if (!params.aid || params.aid > IEEE80211_MAX_AID)
4131                 return -EINVAL;
4132
4133         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4134                 params.capability =
4135                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4136                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4137         }
4138
4139         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4140                 params.ext_capab =
4141                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4142                 params.ext_capab_len =
4143                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4144         }
4145
4146         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4147                 params.ht_capa =
4148                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4149
4150         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4151                 params.vht_capa =
4152                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4153
4154         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4155                 params.plink_action =
4156                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4157                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4158                         return -EINVAL;
4159         }
4160
4161         err = nl80211_parse_sta_channel_info(info, &params);
4162         if (err)
4163                 return err;
4164
4165         err = nl80211_parse_sta_wme(info, &params);
4166         if (err)
4167                 return err;
4168
4169         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4170                 return -EINVAL;
4171
4172         /* When you run into this, adjust the code below for the new flag */
4173         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4174
4175         switch (dev->ieee80211_ptr->iftype) {
4176         case NL80211_IFTYPE_AP:
4177         case NL80211_IFTYPE_AP_VLAN:
4178         case NL80211_IFTYPE_P2P_GO:
4179                 /* ignore WME attributes if iface/sta is not capable */
4180                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
4181                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
4182                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4183
4184                 /* TDLS peers cannot be added */
4185                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4186                     info->attrs[NL80211_ATTR_PEER_AID])
4187                         return -EINVAL;
4188                 /* but don't bother the driver with it */
4189                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4190
4191                 /* allow authenticated/associated only if driver handles it */
4192                 if (!(rdev->wiphy.features &
4193                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4194                     params.sta_flags_mask &
4195                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4196                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4197                         return -EINVAL;
4198
4199                 /* must be last in here for error handling */
4200                 params.vlan = get_vlan(info, rdev);
4201                 if (IS_ERR(params.vlan))
4202                         return PTR_ERR(params.vlan);
4203                 break;
4204         case NL80211_IFTYPE_MESH_POINT:
4205                 /* ignore uAPSD data */
4206                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4207
4208                 /* associated is disallowed */
4209                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
4210                         return -EINVAL;
4211                 /* TDLS peers cannot be added */
4212                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4213                     info->attrs[NL80211_ATTR_PEER_AID])
4214                         return -EINVAL;
4215                 break;
4216         case NL80211_IFTYPE_STATION:
4217         case NL80211_IFTYPE_P2P_CLIENT:
4218                 /* ignore uAPSD data */
4219                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4220
4221                 /* these are disallowed */
4222                 if (params.sta_flags_mask &
4223                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
4224                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4225                         return -EINVAL;
4226                 /* Only TDLS peers can be added */
4227                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4228                         return -EINVAL;
4229                 /* Can only add if TDLS ... */
4230                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
4231                         return -EOPNOTSUPP;
4232                 /* ... with external setup is supported */
4233                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
4234                         return -EOPNOTSUPP;
4235                 /*
4236                  * Older wpa_supplicant versions always mark the TDLS peer
4237                  * as authorized, but it shouldn't yet be.
4238                  */
4239                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4240                 break;
4241         default:
4242                 return -EOPNOTSUPP;
4243         }
4244
4245         /* be aware of params.vlan when changing code here */
4246
4247         err = rdev_add_station(rdev, dev, mac_addr, &params);
4248
4249         if (params.vlan)
4250                 dev_put(params.vlan);
4251         return err;
4252 }
4253
4254 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
4255 {
4256         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4257         struct net_device *dev = info->user_ptr[1];
4258         u8 *mac_addr = NULL;
4259
4260         if (info->attrs[NL80211_ATTR_MAC])
4261                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4262
4263         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4264             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4265             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4266             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4267                 return -EINVAL;
4268
4269         if (!rdev->ops->del_station)
4270                 return -EOPNOTSUPP;
4271
4272         return rdev_del_station(rdev, dev, mac_addr);
4273 }
4274
4275 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4276                                 int flags, struct net_device *dev,
4277                                 u8 *dst, u8 *next_hop,
4278                                 struct mpath_info *pinfo)
4279 {
4280         void *hdr;
4281         struct nlattr *pinfoattr;
4282
4283         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
4284         if (!hdr)
4285                 return -1;
4286
4287         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4288             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
4289             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
4290             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
4291                 goto nla_put_failure;
4292
4293         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
4294         if (!pinfoattr)
4295                 goto nla_put_failure;
4296         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
4297             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
4298                         pinfo->frame_qlen))
4299                 goto nla_put_failure;
4300         if (((pinfo->filled & MPATH_INFO_SN) &&
4301              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
4302             ((pinfo->filled & MPATH_INFO_METRIC) &&
4303              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
4304                          pinfo->metric)) ||
4305             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
4306              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
4307                          pinfo->exptime)) ||
4308             ((pinfo->filled & MPATH_INFO_FLAGS) &&
4309              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
4310                         pinfo->flags)) ||
4311             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
4312              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
4313                          pinfo->discovery_timeout)) ||
4314             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
4315              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
4316                         pinfo->discovery_retries)))
4317                 goto nla_put_failure;
4318
4319         nla_nest_end(msg, pinfoattr);
4320
4321         return genlmsg_end(msg, hdr);
4322
4323  nla_put_failure:
4324         genlmsg_cancel(msg, hdr);
4325         return -EMSGSIZE;
4326 }
4327
4328 static int nl80211_dump_mpath(struct sk_buff *skb,
4329                               struct netlink_callback *cb)
4330 {
4331         struct mpath_info pinfo;
4332         struct cfg80211_registered_device *dev;
4333         struct wireless_dev *wdev;
4334         u8 dst[ETH_ALEN];
4335         u8 next_hop[ETH_ALEN];
4336         int path_idx = cb->args[2];
4337         int err;
4338
4339         err = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
4340         if (err)
4341                 return err;
4342
4343         if (!dev->ops->dump_mpath) {
4344                 err = -EOPNOTSUPP;
4345                 goto out_err;
4346         }
4347
4348         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4349                 err = -EOPNOTSUPP;
4350                 goto out_err;
4351         }
4352
4353         while (1) {
4354                 err = rdev_dump_mpath(dev, wdev->netdev, path_idx, dst,
4355                                       next_hop, &pinfo);
4356                 if (err == -ENOENT)
4357                         break;
4358                 if (err)
4359                         goto out_err;
4360
4361                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4362                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4363                                        wdev->netdev, dst, next_hop,
4364                                        &pinfo) < 0)
4365                         goto out;
4366
4367                 path_idx++;
4368         }
4369
4370
4371  out:
4372         cb->args[2] = path_idx;
4373         err = skb->len;
4374  out_err:
4375         nl80211_finish_wdev_dump(dev);
4376         return err;
4377 }
4378
4379 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
4380 {
4381         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4382         int err;
4383         struct net_device *dev = info->user_ptr[1];
4384         struct mpath_info pinfo;
4385         struct sk_buff *msg;
4386         u8 *dst = NULL;
4387         u8 next_hop[ETH_ALEN];
4388
4389         memset(&pinfo, 0, sizeof(pinfo));
4390
4391         if (!info->attrs[NL80211_ATTR_MAC])
4392                 return -EINVAL;
4393
4394         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4395
4396         if (!rdev->ops->get_mpath)
4397                 return -EOPNOTSUPP;
4398
4399         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4400                 return -EOPNOTSUPP;
4401
4402         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4403         if (err)
4404                 return err;
4405
4406         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4407         if (!msg)
4408                 return -ENOMEM;
4409
4410         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4411                                  dev, dst, next_hop, &pinfo) < 0) {
4412                 nlmsg_free(msg);
4413                 return -ENOBUFS;
4414         }
4415
4416         return genlmsg_reply(msg, info);
4417 }
4418
4419 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
4420 {
4421         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4422         struct net_device *dev = info->user_ptr[1];
4423         u8 *dst = NULL;
4424         u8 *next_hop = NULL;
4425
4426         if (!info->attrs[NL80211_ATTR_MAC])
4427                 return -EINVAL;
4428
4429         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4430                 return -EINVAL;
4431
4432         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4433         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4434
4435         if (!rdev->ops->change_mpath)
4436                 return -EOPNOTSUPP;
4437
4438         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4439                 return -EOPNOTSUPP;
4440
4441         return rdev_change_mpath(rdev, dev, dst, next_hop);
4442 }
4443
4444 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
4445 {
4446         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4447         struct net_device *dev = info->user_ptr[1];
4448         u8 *dst = NULL;
4449         u8 *next_hop = NULL;
4450
4451         if (!info->attrs[NL80211_ATTR_MAC])
4452                 return -EINVAL;
4453
4454         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4455                 return -EINVAL;
4456
4457         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4458         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4459
4460         if (!rdev->ops->add_mpath)
4461                 return -EOPNOTSUPP;
4462
4463         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4464                 return -EOPNOTSUPP;
4465
4466         return rdev_add_mpath(rdev, dev, dst, next_hop);
4467 }
4468
4469 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
4470 {
4471         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4472         struct net_device *dev = info->user_ptr[1];
4473         u8 *dst = NULL;
4474
4475         if (info->attrs[NL80211_ATTR_MAC])
4476                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4477
4478         if (!rdev->ops->del_mpath)
4479                 return -EOPNOTSUPP;
4480
4481         return rdev_del_mpath(rdev, dev, dst);
4482 }
4483
4484 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
4485 {
4486         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4487         struct net_device *dev = info->user_ptr[1];
4488         struct wireless_dev *wdev = dev->ieee80211_ptr;
4489         struct bss_parameters params;
4490         int err;
4491
4492         memset(&params, 0, sizeof(params));
4493         /* default to not changing parameters */
4494         params.use_cts_prot = -1;
4495         params.use_short_preamble = -1;
4496         params.use_short_slot_time = -1;
4497         params.ap_isolate = -1;
4498         params.ht_opmode = -1;
4499         params.p2p_ctwindow = -1;
4500         params.p2p_opp_ps = -1;
4501
4502         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
4503                 params.use_cts_prot =
4504                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
4505         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
4506                 params.use_short_preamble =
4507                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
4508         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
4509                 params.use_short_slot_time =
4510                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4511         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4512                 params.basic_rates =
4513                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4514                 params.basic_rates_len =
4515                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4516         }
4517         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
4518                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4519         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
4520                 params.ht_opmode =
4521                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4522
4523         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4524                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4525                         return -EINVAL;
4526                 params.p2p_ctwindow =
4527                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4528                 if (params.p2p_ctwindow < 0)
4529                         return -EINVAL;
4530                 if (params.p2p_ctwindow != 0 &&
4531                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4532                         return -EINVAL;
4533         }
4534
4535         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4536                 u8 tmp;
4537
4538                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4539                         return -EINVAL;
4540                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4541                 if (tmp > 1)
4542                         return -EINVAL;
4543                 params.p2p_opp_ps = tmp;
4544                 if (params.p2p_opp_ps &&
4545                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4546                         return -EINVAL;
4547         }
4548
4549         if (!rdev->ops->change_bss)
4550                 return -EOPNOTSUPP;
4551
4552         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4553             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4554                 return -EOPNOTSUPP;
4555
4556         wdev_lock(wdev);
4557         err = rdev_change_bss(rdev, dev, &params);
4558         wdev_unlock(wdev);
4559
4560         return err;
4561 }
4562
4563 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
4564         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
4565         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
4566         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
4567         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
4568         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
4569         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
4570 };
4571
4572 static int parse_reg_rule(struct nlattr *tb[],
4573         struct ieee80211_reg_rule *reg_rule)
4574 {
4575         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
4576         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
4577
4578         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
4579                 return -EINVAL;
4580         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
4581                 return -EINVAL;
4582         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
4583                 return -EINVAL;
4584         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
4585                 return -EINVAL;
4586         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
4587                 return -EINVAL;
4588
4589         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
4590
4591         freq_range->start_freq_khz =
4592                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
4593         freq_range->end_freq_khz =
4594                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
4595         freq_range->max_bandwidth_khz =
4596                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
4597
4598         power_rule->max_eirp =
4599                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
4600
4601         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
4602                 power_rule->max_antenna_gain =
4603                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
4604
4605         return 0;
4606 }
4607
4608 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
4609 {
4610         int r;
4611         char *data = NULL;
4612         enum nl80211_user_reg_hint_type user_reg_hint_type;
4613
4614         /*
4615          * You should only get this when cfg80211 hasn't yet initialized
4616          * completely when built-in to the kernel right between the time
4617          * window between nl80211_init() and regulatory_init(), if that is
4618          * even possible.
4619          */
4620         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4621                 return -EINPROGRESS;
4622
4623         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4624                 return -EINVAL;
4625
4626         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4627
4628         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
4629                 user_reg_hint_type =
4630                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
4631         else
4632                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
4633
4634         switch (user_reg_hint_type) {
4635         case NL80211_USER_REG_HINT_USER:
4636         case NL80211_USER_REG_HINT_CELL_BASE:
4637                 break;
4638         default:
4639                 return -EINVAL;
4640         }
4641
4642         r = regulatory_hint_user(data, user_reg_hint_type);
4643
4644         return r;
4645 }
4646
4647 static int nl80211_get_mesh_config(struct sk_buff *skb,
4648                                    struct genl_info *info)
4649 {
4650         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4651         struct net_device *dev = info->user_ptr[1];
4652         struct wireless_dev *wdev = dev->ieee80211_ptr;
4653         struct mesh_config cur_params;
4654         int err = 0;
4655         void *hdr;
4656         struct nlattr *pinfoattr;
4657         struct sk_buff *msg;
4658
4659         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4660                 return -EOPNOTSUPP;
4661
4662         if (!rdev->ops->get_mesh_config)
4663                 return -EOPNOTSUPP;
4664
4665         wdev_lock(wdev);
4666         /* If not connected, get default parameters */
4667         if (!wdev->mesh_id_len)
4668                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
4669         else
4670                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
4671         wdev_unlock(wdev);
4672
4673         if (err)
4674                 return err;
4675
4676         /* Draw up a netlink message to send back */
4677         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4678         if (!msg)
4679                 return -ENOMEM;
4680         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4681                              NL80211_CMD_GET_MESH_CONFIG);
4682         if (!hdr)
4683                 goto out;
4684         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
4685         if (!pinfoattr)
4686                 goto nla_put_failure;
4687         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4688             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
4689                         cur_params.dot11MeshRetryTimeout) ||
4690             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4691                         cur_params.dot11MeshConfirmTimeout) ||
4692             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
4693                         cur_params.dot11MeshHoldingTimeout) ||
4694             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
4695                         cur_params.dot11MeshMaxPeerLinks) ||
4696             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
4697                        cur_params.dot11MeshMaxRetries) ||
4698             nla_put_u8(msg, NL80211_MESHCONF_TTL,
4699                        cur_params.dot11MeshTTL) ||
4700             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
4701                        cur_params.element_ttl) ||
4702             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4703                        cur_params.auto_open_plinks) ||
4704             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4705                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
4706             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4707                        cur_params.dot11MeshHWMPmaxPREQretries) ||
4708             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
4709                         cur_params.path_refresh_time) ||
4710             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4711                         cur_params.min_discovery_timeout) ||
4712             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4713                         cur_params.dot11MeshHWMPactivePathTimeout) ||
4714             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4715                         cur_params.dot11MeshHWMPpreqMinInterval) ||
4716             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4717                         cur_params.dot11MeshHWMPperrMinInterval) ||
4718             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4719                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
4720             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
4721                        cur_params.dot11MeshHWMPRootMode) ||
4722             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4723                         cur_params.dot11MeshHWMPRannInterval) ||
4724             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4725                        cur_params.dot11MeshGateAnnouncementProtocol) ||
4726             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
4727                        cur_params.dot11MeshForwarding) ||
4728             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
4729                         cur_params.rssi_threshold) ||
4730             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
4731                         cur_params.ht_opmode) ||
4732             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4733                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
4734             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4735                         cur_params.dot11MeshHWMProotInterval) ||
4736             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4737                         cur_params.dot11MeshHWMPconfirmationInterval) ||
4738             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
4739                         cur_params.power_mode) ||
4740             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
4741                         cur_params.dot11MeshAwakeWindowDuration) ||
4742             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
4743                         cur_params.plink_timeout))
4744                 goto nla_put_failure;
4745         nla_nest_end(msg, pinfoattr);
4746         genlmsg_end(msg, hdr);
4747         return genlmsg_reply(msg, info);
4748
4749  nla_put_failure:
4750         genlmsg_cancel(msg, hdr);
4751  out:
4752         nlmsg_free(msg);
4753         return -ENOBUFS;
4754 }
4755
4756 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
4757         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
4758         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
4759         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
4760         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
4761         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
4762         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
4763         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
4764         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
4765         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
4766         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
4767         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
4768         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
4769         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
4770         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
4771         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
4772         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
4773         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
4774         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
4775         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
4776         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
4777         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
4778         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
4779         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
4780         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
4781         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
4782         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
4783         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
4784         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
4785 };
4786
4787 static const struct nla_policy
4788         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
4789         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
4790         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
4791         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
4792         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
4793         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
4794         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
4795         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
4796                                     .len = IEEE80211_MAX_DATA_LEN },
4797         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
4798 };
4799
4800 static int nl80211_parse_mesh_config(struct genl_info *info,
4801                                      struct mesh_config *cfg,
4802                                      u32 *mask_out)
4803 {
4804         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
4805         u32 mask = 0;
4806
4807 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
4808 do {                                                                        \
4809         if (tb[attr]) {                                                     \
4810                 if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
4811                         return -EINVAL;                                     \
4812                 cfg->param = fn(tb[attr]);                                  \
4813                 mask |= (1 << (attr - 1));                                  \
4814         }                                                                   \
4815 } while (0)
4816
4817
4818         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
4819                 return -EINVAL;
4820         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
4821                              info->attrs[NL80211_ATTR_MESH_CONFIG],
4822                              nl80211_meshconf_params_policy))
4823                 return -EINVAL;
4824
4825         /* This makes sure that there aren't more than 32 mesh config
4826          * parameters (otherwise our bitfield scheme would not work.) */
4827         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
4828
4829         /* Fill in the params struct */
4830         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
4831                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
4832                                   nla_get_u16);
4833         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
4834                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4835                                   nla_get_u16);
4836         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
4837                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
4838                                   nla_get_u16);
4839         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
4840                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
4841                                   nla_get_u16);
4842         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
4843                                   mask, NL80211_MESHCONF_MAX_RETRIES,
4844                                   nla_get_u8);
4845         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
4846                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
4847         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
4848                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
4849                                   nla_get_u8);
4850         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
4851                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4852                                   nla_get_u8);
4853         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
4854                                   1, 255, mask,
4855                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4856                                   nla_get_u32);
4857         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
4858                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4859                                   nla_get_u8);
4860         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
4861                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
4862                                   nla_get_u32);
4863         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
4864                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4865                                   nla_get_u16);
4866         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
4867                                   1, 65535, mask,
4868                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4869                                   nla_get_u32);
4870         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
4871                                   1, 65535, mask,
4872                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4873                                   nla_get_u16);
4874         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
4875                                   1, 65535, mask,
4876                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4877                                   nla_get_u16);
4878         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4879                                   dot11MeshHWMPnetDiameterTraversalTime,
4880                                   1, 65535, mask,
4881                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4882                                   nla_get_u16);
4883         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
4884                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
4885                                   nla_get_u8);
4886         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
4887                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4888                                   nla_get_u16);
4889         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4890                                   dot11MeshGateAnnouncementProtocol, 0, 1,
4891                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4892                                   nla_get_u8);
4893         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
4894                                   mask, NL80211_MESHCONF_FORWARDING,
4895                                   nla_get_u8);
4896         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
4897                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
4898                                   nla_get_s32);
4899         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
4900                                   mask, NL80211_MESHCONF_HT_OPMODE,
4901                                   nla_get_u16);
4902         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
4903                                   1, 65535, mask,
4904                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4905                                   nla_get_u32);
4906         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
4907                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4908                                   nla_get_u16);
4909         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4910                                   dot11MeshHWMPconfirmationInterval,
4911                                   1, 65535, mask,
4912                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4913                                   nla_get_u16);
4914         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
4915                                   NL80211_MESH_POWER_ACTIVE,
4916                                   NL80211_MESH_POWER_MAX,
4917                                   mask, NL80211_MESHCONF_POWER_MODE,
4918                                   nla_get_u32);
4919         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
4920                                   0, 65535, mask,
4921                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
4922         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 1, 0xffffffff,
4923                                   mask, NL80211_MESHCONF_PLINK_TIMEOUT,
4924                                   nla_get_u32);
4925         if (mask_out)
4926                 *mask_out = mask;
4927
4928         return 0;
4929
4930 #undef FILL_IN_MESH_PARAM_IF_SET
4931 }
4932
4933 static int nl80211_parse_mesh_setup(struct genl_info *info,
4934                                      struct mesh_setup *setup)
4935 {
4936         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4937         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
4938
4939         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
4940                 return -EINVAL;
4941         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
4942                              info->attrs[NL80211_ATTR_MESH_SETUP],
4943                              nl80211_mesh_setup_params_policy))
4944                 return -EINVAL;
4945
4946         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
4947                 setup->sync_method =
4948                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
4949                  IEEE80211_SYNC_METHOD_VENDOR :
4950                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
4951
4952         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
4953                 setup->path_sel_proto =
4954                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
4955                  IEEE80211_PATH_PROTOCOL_VENDOR :
4956                  IEEE80211_PATH_PROTOCOL_HWMP;
4957
4958         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
4959                 setup->path_metric =
4960                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
4961                  IEEE80211_PATH_METRIC_VENDOR :
4962                  IEEE80211_PATH_METRIC_AIRTIME;
4963
4964
4965         if (tb[NL80211_MESH_SETUP_IE]) {
4966                 struct nlattr *ieattr =
4967                         tb[NL80211_MESH_SETUP_IE];
4968                 if (!is_valid_ie_attr(ieattr))
4969                         return -EINVAL;
4970                 setup->ie = nla_data(ieattr);
4971                 setup->ie_len = nla_len(ieattr);
4972         }
4973         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
4974             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
4975                 return -EINVAL;
4976         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
4977         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
4978         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
4979         if (setup->is_secure)
4980                 setup->user_mpm = true;
4981
4982         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
4983                 if (!setup->user_mpm)
4984                         return -EINVAL;
4985                 setup->auth_id =
4986                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
4987         }
4988
4989         return 0;
4990 }
4991
4992 static int nl80211_update_mesh_config(struct sk_buff *skb,
4993                                       struct genl_info *info)
4994 {
4995         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4996         struct net_device *dev = info->user_ptr[1];
4997         struct wireless_dev *wdev = dev->ieee80211_ptr;
4998         struct mesh_config cfg;
4999         u32 mask;
5000         int err;
5001
5002         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5003                 return -EOPNOTSUPP;
5004
5005         if (!rdev->ops->update_mesh_config)
5006                 return -EOPNOTSUPP;
5007
5008         err = nl80211_parse_mesh_config(info, &cfg, &mask);
5009         if (err)
5010                 return err;
5011
5012         wdev_lock(wdev);
5013         if (!wdev->mesh_id_len)
5014                 err = -ENOLINK;
5015
5016         if (!err)
5017                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
5018
5019         wdev_unlock(wdev);
5020
5021         return err;
5022 }
5023
5024 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
5025 {
5026         const struct ieee80211_regdomain *regdom;
5027         struct sk_buff *msg;
5028         void *hdr = NULL;
5029         struct nlattr *nl_reg_rules;
5030         unsigned int i;
5031
5032         if (!cfg80211_regdomain)
5033                 return -EINVAL;
5034
5035         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5036         if (!msg)
5037                 return -ENOBUFS;
5038
5039         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5040                              NL80211_CMD_GET_REG);
5041         if (!hdr)
5042                 goto put_failure;
5043
5044         if (reg_last_request_cell_base() &&
5045             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
5046                         NL80211_USER_REG_HINT_CELL_BASE))
5047                 goto nla_put_failure;
5048
5049         rcu_read_lock();
5050         regdom = rcu_dereference(cfg80211_regdomain);
5051
5052         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
5053             (regdom->dfs_region &&
5054              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
5055                 goto nla_put_failure_rcu;
5056
5057         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
5058         if (!nl_reg_rules)
5059                 goto nla_put_failure_rcu;
5060
5061         for (i = 0; i < regdom->n_reg_rules; i++) {
5062                 struct nlattr *nl_reg_rule;
5063                 const struct ieee80211_reg_rule *reg_rule;
5064                 const struct ieee80211_freq_range *freq_range;
5065                 const struct ieee80211_power_rule *power_rule;
5066
5067                 reg_rule = &regdom->reg_rules[i];
5068                 freq_range = &reg_rule->freq_range;
5069                 power_rule = &reg_rule->power_rule;
5070
5071                 nl_reg_rule = nla_nest_start(msg, i);
5072                 if (!nl_reg_rule)
5073                         goto nla_put_failure_rcu;
5074
5075                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
5076                                 reg_rule->flags) ||
5077                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
5078                                 freq_range->start_freq_khz) ||
5079                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
5080                                 freq_range->end_freq_khz) ||
5081                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
5082                                 freq_range->max_bandwidth_khz) ||
5083                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
5084                                 power_rule->max_antenna_gain) ||
5085                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
5086                                 power_rule->max_eirp))
5087                         goto nla_put_failure_rcu;
5088
5089                 nla_nest_end(msg, nl_reg_rule);
5090         }
5091         rcu_read_unlock();
5092
5093         nla_nest_end(msg, nl_reg_rules);
5094
5095         genlmsg_end(msg, hdr);
5096         return genlmsg_reply(msg, info);
5097
5098 nla_put_failure_rcu:
5099         rcu_read_unlock();
5100 nla_put_failure:
5101         genlmsg_cancel(msg, hdr);
5102 put_failure:
5103         nlmsg_free(msg);
5104         return -EMSGSIZE;
5105 }
5106
5107 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
5108 {
5109         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
5110         struct nlattr *nl_reg_rule;
5111         char *alpha2 = NULL;
5112         int rem_reg_rules = 0, r = 0;
5113         u32 num_rules = 0, rule_idx = 0, size_of_regd;
5114         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
5115         struct ieee80211_regdomain *rd = NULL;
5116
5117         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5118                 return -EINVAL;
5119
5120         if (!info->attrs[NL80211_ATTR_REG_RULES])
5121                 return -EINVAL;
5122
5123         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5124
5125         if (info->attrs[NL80211_ATTR_DFS_REGION])
5126                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
5127
5128         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5129                             rem_reg_rules) {
5130                 num_rules++;
5131                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
5132                         return -EINVAL;
5133         }
5134
5135         if (!reg_is_valid_request(alpha2))
5136                 return -EINVAL;
5137
5138         size_of_regd = sizeof(struct ieee80211_regdomain) +
5139                        num_rules * sizeof(struct ieee80211_reg_rule);
5140
5141         rd = kzalloc(size_of_regd, GFP_KERNEL);
5142         if (!rd)
5143                 return -ENOMEM;
5144
5145         rd->n_reg_rules = num_rules;
5146         rd->alpha2[0] = alpha2[0];
5147         rd->alpha2[1] = alpha2[1];
5148
5149         /*
5150          * Disable DFS master mode if the DFS region was
5151          * not supported or known on this kernel.
5152          */
5153         if (reg_supported_dfs_region(dfs_region))
5154                 rd->dfs_region = dfs_region;
5155
5156         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5157                             rem_reg_rules) {
5158                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
5159                           nla_data(nl_reg_rule), nla_len(nl_reg_rule),
5160                           reg_rule_policy);
5161                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
5162                 if (r)
5163                         goto bad_reg;
5164
5165                 rule_idx++;
5166
5167                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
5168                         r = -EINVAL;
5169                         goto bad_reg;
5170                 }
5171         }
5172
5173         r = set_regdom(rd);
5174         /* set_regdom took ownership */
5175         rd = NULL;
5176
5177  bad_reg:
5178         kfree(rd);
5179         return r;
5180 }
5181
5182 static int validate_scan_freqs(struct nlattr *freqs)
5183 {
5184         struct nlattr *attr1, *attr2;
5185         int n_channels = 0, tmp1, tmp2;
5186
5187         nla_for_each_nested(attr1, freqs, tmp1) {
5188                 n_channels++;
5189                 /*
5190                  * Some hardware has a limited channel list for
5191                  * scanning, and it is pretty much nonsensical
5192                  * to scan for a channel twice, so disallow that
5193                  * and don't require drivers to check that the
5194                  * channel list they get isn't longer than what
5195                  * they can scan, as long as they can scan all
5196                  * the channels they registered at once.
5197                  */
5198                 nla_for_each_nested(attr2, freqs, tmp2)
5199                         if (attr1 != attr2 &&
5200                             nla_get_u32(attr1) == nla_get_u32(attr2))
5201                                 return 0;
5202         }
5203
5204         return n_channels;
5205 }
5206
5207 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
5208 {
5209         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5210         struct wireless_dev *wdev = info->user_ptr[1];
5211         struct cfg80211_scan_request *request;
5212         struct nlattr *attr;
5213         struct wiphy *wiphy;
5214         int err, tmp, n_ssids = 0, n_channels, i;
5215         size_t ie_len;
5216
5217         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5218                 return -EINVAL;
5219
5220         wiphy = &rdev->wiphy;
5221
5222         if (!rdev->ops->scan)
5223                 return -EOPNOTSUPP;
5224
5225         if (rdev->scan_req) {
5226                 err = -EBUSY;
5227                 goto unlock;
5228         }
5229
5230         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5231                 n_channels = validate_scan_freqs(
5232                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5233                 if (!n_channels) {
5234                         err = -EINVAL;
5235                         goto unlock;
5236                 }
5237         } else {
5238                 enum ieee80211_band band;
5239                 n_channels = 0;
5240
5241                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
5242                         if (wiphy->bands[band])
5243                                 n_channels += wiphy->bands[band]->n_channels;
5244         }
5245
5246         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5247                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
5248                         n_ssids++;
5249
5250         if (n_ssids > wiphy->max_scan_ssids) {
5251                 err = -EINVAL;
5252                 goto unlock;
5253         }
5254
5255         if (info->attrs[NL80211_ATTR_IE])
5256                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5257         else
5258                 ie_len = 0;
5259
5260         if (ie_len > wiphy->max_scan_ie_len) {
5261                 err = -EINVAL;
5262                 goto unlock;
5263         }
5264
5265         request = kzalloc(sizeof(*request)
5266                         + sizeof(*request->ssids) * n_ssids
5267                         + sizeof(*request->channels) * n_channels
5268                         + ie_len, GFP_KERNEL);
5269         if (!request) {
5270                 err = -ENOMEM;
5271                 goto unlock;
5272         }
5273
5274         if (n_ssids)
5275                 request->ssids = (void *)&request->channels[n_channels];
5276         request->n_ssids = n_ssids;
5277         if (ie_len) {
5278                 if (request->ssids)
5279                         request->ie = (void *)(request->ssids + n_ssids);
5280                 else
5281                         request->ie = (void *)(request->channels + n_channels);
5282         }
5283
5284         i = 0;
5285         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5286                 /* user specified, bail out if channel not found */
5287                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
5288                         struct ieee80211_channel *chan;
5289
5290                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5291
5292                         if (!chan) {
5293                                 err = -EINVAL;
5294                                 goto out_free;
5295                         }
5296
5297                         /* ignore disabled channels */
5298                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5299                                 continue;
5300
5301                         request->channels[i] = chan;
5302                         i++;
5303                 }
5304         } else {
5305                 enum ieee80211_band band;
5306
5307                 /* all channels */
5308                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5309                         int j;
5310                         if (!wiphy->bands[band])
5311                                 continue;
5312                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5313                                 struct ieee80211_channel *chan;
5314
5315                                 chan = &wiphy->bands[band]->channels[j];
5316
5317                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5318                                         continue;
5319
5320                                 request->channels[i] = chan;
5321                                 i++;
5322                         }
5323                 }
5324         }
5325
5326         if (!i) {
5327                 err = -EINVAL;
5328                 goto out_free;
5329         }
5330
5331         request->n_channels = i;
5332
5333         i = 0;
5334         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5335                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
5336                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5337                                 err = -EINVAL;
5338                                 goto out_free;
5339                         }
5340                         request->ssids[i].ssid_len = nla_len(attr);
5341                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
5342                         i++;
5343                 }
5344         }
5345
5346         if (info->attrs[NL80211_ATTR_IE]) {
5347                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5348                 memcpy((void *)request->ie,
5349                        nla_data(info->attrs[NL80211_ATTR_IE]),
5350                        request->ie_len);
5351         }
5352
5353         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
5354                 if (wiphy->bands[i])
5355                         request->rates[i] =
5356                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
5357
5358         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
5359                 nla_for_each_nested(attr,
5360                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
5361                                     tmp) {
5362                         enum ieee80211_band band = nla_type(attr);
5363
5364                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
5365                                 err = -EINVAL;
5366                                 goto out_free;
5367                         }
5368                         err = ieee80211_get_ratemask(wiphy->bands[band],
5369                                                      nla_data(attr),
5370                                                      nla_len(attr),
5371                                                      &request->rates[band]);
5372                         if (err)
5373                                 goto out_free;
5374                 }
5375         }
5376
5377         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5378                 request->flags = nla_get_u32(
5379                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5380                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5381                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
5382                         err = -EOPNOTSUPP;
5383                         goto out_free;
5384                 }
5385         }
5386
5387         request->no_cck =
5388                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
5389
5390         request->wdev = wdev;
5391         request->wiphy = &rdev->wiphy;
5392         request->scan_start = jiffies;
5393
5394         rdev->scan_req = request;
5395         err = rdev_scan(rdev, request);
5396
5397         if (!err) {
5398                 nl80211_send_scan_start(rdev, wdev);
5399                 if (wdev->netdev)
5400                         dev_hold(wdev->netdev);
5401         } else {
5402  out_free:
5403                 rdev->scan_req = NULL;
5404                 kfree(request);
5405         }
5406
5407  unlock:
5408         return err;
5409 }
5410
5411 static int nl80211_start_sched_scan(struct sk_buff *skb,
5412                                     struct genl_info *info)
5413 {
5414         struct cfg80211_sched_scan_request *request;
5415         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5416         struct net_device *dev = info->user_ptr[1];
5417         struct nlattr *attr;
5418         struct wiphy *wiphy;
5419         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
5420         u32 interval;
5421         enum ieee80211_band band;
5422         size_t ie_len;
5423         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
5424
5425         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5426             !rdev->ops->sched_scan_start)
5427                 return -EOPNOTSUPP;
5428
5429         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5430                 return -EINVAL;
5431
5432         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
5433                 return -EINVAL;
5434
5435         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
5436         if (interval == 0)
5437                 return -EINVAL;
5438
5439         wiphy = &rdev->wiphy;
5440
5441         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5442                 n_channels = validate_scan_freqs(
5443                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5444                 if (!n_channels)
5445                         return -EINVAL;
5446         } else {
5447                 n_channels = 0;
5448
5449                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
5450                         if (wiphy->bands[band])
5451                                 n_channels += wiphy->bands[band]->n_channels;
5452         }
5453
5454         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5455                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5456                                     tmp)
5457                         n_ssids++;
5458
5459         if (n_ssids > wiphy->max_sched_scan_ssids)
5460                 return -EINVAL;
5461
5462         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
5463                 nla_for_each_nested(attr,
5464                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5465                                     tmp)
5466                         n_match_sets++;
5467
5468         if (n_match_sets > wiphy->max_match_sets)
5469                 return -EINVAL;
5470
5471         if (info->attrs[NL80211_ATTR_IE])
5472                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5473         else
5474                 ie_len = 0;
5475
5476         if (ie_len > wiphy->max_sched_scan_ie_len)
5477                 return -EINVAL;
5478
5479         if (rdev->sched_scan_req) {
5480                 err = -EINPROGRESS;
5481                 goto out;
5482         }
5483
5484         request = kzalloc(sizeof(*request)
5485                         + sizeof(*request->ssids) * n_ssids
5486                         + sizeof(*request->match_sets) * n_match_sets
5487                         + sizeof(*request->channels) * n_channels
5488                         + ie_len, GFP_KERNEL);
5489         if (!request) {
5490                 err = -ENOMEM;
5491                 goto out;
5492         }
5493
5494         if (n_ssids)
5495                 request->ssids = (void *)&request->channels[n_channels];
5496         request->n_ssids = n_ssids;
5497         if (ie_len) {
5498                 if (request->ssids)
5499                         request->ie = (void *)(request->ssids + n_ssids);
5500                 else
5501                         request->ie = (void *)(request->channels + n_channels);
5502         }
5503
5504         if (n_match_sets) {
5505                 if (request->ie)
5506                         request->match_sets = (void *)(request->ie + ie_len);
5507                 else if (request->ssids)
5508                         request->match_sets =
5509                                 (void *)(request->ssids + n_ssids);
5510                 else
5511                         request->match_sets =
5512                                 (void *)(request->channels + n_channels);
5513         }
5514         request->n_match_sets = n_match_sets;
5515
5516         i = 0;
5517         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5518                 /* user specified, bail out if channel not found */
5519                 nla_for_each_nested(attr,
5520                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
5521                                     tmp) {
5522                         struct ieee80211_channel *chan;
5523
5524                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5525
5526                         if (!chan) {
5527                                 err = -EINVAL;
5528                                 goto out_free;
5529                         }
5530
5531                         /* ignore disabled channels */
5532                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5533                                 continue;
5534
5535                         request->channels[i] = chan;
5536                         i++;
5537                 }
5538         } else {
5539                 /* all channels */
5540                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5541                         int j;
5542                         if (!wiphy->bands[band])
5543                                 continue;
5544                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5545                                 struct ieee80211_channel *chan;
5546
5547                                 chan = &wiphy->bands[band]->channels[j];
5548
5549                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5550                                         continue;
5551
5552                                 request->channels[i] = chan;
5553                                 i++;
5554                         }
5555                 }
5556         }
5557
5558         if (!i) {
5559                 err = -EINVAL;
5560                 goto out_free;
5561         }
5562
5563         request->n_channels = i;
5564
5565         i = 0;
5566         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5567                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5568                                     tmp) {
5569                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5570                                 err = -EINVAL;
5571                                 goto out_free;
5572                         }
5573                         request->ssids[i].ssid_len = nla_len(attr);
5574                         memcpy(request->ssids[i].ssid, nla_data(attr),
5575                                nla_len(attr));
5576                         i++;
5577                 }
5578         }
5579
5580         i = 0;
5581         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5582                 nla_for_each_nested(attr,
5583                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5584                                     tmp) {
5585                         struct nlattr *ssid, *rssi;
5586
5587                         nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5588                                   nla_data(attr), nla_len(attr),
5589                                   nl80211_match_policy);
5590                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
5591                         if (ssid) {
5592                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
5593                                         err = -EINVAL;
5594                                         goto out_free;
5595                                 }
5596                                 memcpy(request->match_sets[i].ssid.ssid,
5597                                        nla_data(ssid), nla_len(ssid));
5598                                 request->match_sets[i].ssid.ssid_len =
5599                                         nla_len(ssid);
5600                         }
5601                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5602                         if (rssi)
5603                                 request->rssi_thold = nla_get_u32(rssi);
5604                         else
5605                                 request->rssi_thold =
5606                                                    NL80211_SCAN_RSSI_THOLD_OFF;
5607                         i++;
5608                 }
5609         }
5610
5611         if (info->attrs[NL80211_ATTR_IE]) {
5612                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5613                 memcpy((void *)request->ie,
5614                        nla_data(info->attrs[NL80211_ATTR_IE]),
5615                        request->ie_len);
5616         }
5617
5618         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5619                 request->flags = nla_get_u32(
5620                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5621                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5622                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
5623                         err = -EOPNOTSUPP;
5624                         goto out_free;
5625                 }
5626         }
5627
5628         request->dev = dev;
5629         request->wiphy = &rdev->wiphy;
5630         request->interval = interval;
5631         request->scan_start = jiffies;
5632
5633         err = rdev_sched_scan_start(rdev, dev, request);
5634         if (!err) {
5635                 rdev->sched_scan_req = request;
5636                 nl80211_send_sched_scan(rdev, dev,
5637                                         NL80211_CMD_START_SCHED_SCAN);
5638                 goto out;
5639         }
5640
5641 out_free:
5642         kfree(request);
5643 out:
5644         return err;
5645 }
5646
5647 static int nl80211_stop_sched_scan(struct sk_buff *skb,
5648                                    struct genl_info *info)
5649 {
5650         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5651
5652         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5653             !rdev->ops->sched_scan_stop)
5654                 return -EOPNOTSUPP;
5655
5656         return __cfg80211_stop_sched_scan(rdev, false);
5657 }
5658
5659 static int nl80211_start_radar_detection(struct sk_buff *skb,
5660                                          struct genl_info *info)
5661 {
5662         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5663         struct net_device *dev = info->user_ptr[1];
5664         struct wireless_dev *wdev = dev->ieee80211_ptr;
5665         struct cfg80211_chan_def chandef;
5666         int err;
5667
5668         err = nl80211_parse_chandef(rdev, info, &chandef);
5669         if (err)
5670                 return err;
5671
5672         if (netif_carrier_ok(dev))
5673                 return -EBUSY;
5674
5675         if (wdev->cac_started)
5676                 return -EBUSY;
5677
5678         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef);
5679         if (err < 0)
5680                 return err;
5681
5682         if (err == 0)
5683                 return -EINVAL;
5684
5685         if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef))
5686                 return -EINVAL;
5687
5688         if (!rdev->ops->start_radar_detection)
5689                 return -EOPNOTSUPP;
5690
5691         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
5692                                            chandef.chan, CHAN_MODE_SHARED,
5693                                            BIT(chandef.width));
5694         if (err)
5695                 return err;
5696
5697         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef);
5698         if (!err) {
5699                 wdev->channel = chandef.chan;
5700                 wdev->cac_started = true;
5701                 wdev->cac_start_time = jiffies;
5702         }
5703         return err;
5704 }
5705
5706 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
5707 {
5708         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5709         struct net_device *dev = info->user_ptr[1];
5710         struct wireless_dev *wdev = dev->ieee80211_ptr;
5711         struct cfg80211_csa_settings params;
5712         /* csa_attrs is defined static to avoid waste of stack size - this
5713          * function is called under RTNL lock, so this should not be a problem.
5714          */
5715         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
5716         u8 radar_detect_width = 0;
5717         int err;
5718         bool need_new_beacon = false;
5719
5720         if (!rdev->ops->channel_switch ||
5721             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
5722                 return -EOPNOTSUPP;
5723
5724         switch (dev->ieee80211_ptr->iftype) {
5725         case NL80211_IFTYPE_AP:
5726         case NL80211_IFTYPE_P2P_GO:
5727                 need_new_beacon = true;
5728
5729                 /* useless if AP is not running */
5730                 if (!wdev->beacon_interval)
5731                         return -EINVAL;
5732                 break;
5733         case NL80211_IFTYPE_ADHOC:
5734         case NL80211_IFTYPE_MESH_POINT:
5735                 break;
5736         default:
5737                 return -EOPNOTSUPP;
5738         }
5739
5740         memset(&params, 0, sizeof(params));
5741
5742         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
5743             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
5744                 return -EINVAL;
5745
5746         /* only important for AP, IBSS and mesh create IEs internally */
5747         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
5748                 return -EINVAL;
5749
5750         params.count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
5751
5752         if (!need_new_beacon)
5753                 goto skip_beacons;
5754
5755         err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
5756         if (err)
5757                 return err;
5758
5759         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
5760                                info->attrs[NL80211_ATTR_CSA_IES],
5761                                nl80211_policy);
5762         if (err)
5763                 return err;
5764
5765         err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
5766         if (err)
5767                 return err;
5768
5769         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
5770                 return -EINVAL;
5771
5772         params.counter_offset_beacon =
5773                 nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
5774         if (params.counter_offset_beacon >= params.beacon_csa.tail_len)
5775                 return -EINVAL;
5776
5777         /* sanity check - counters should be the same */
5778         if (params.beacon_csa.tail[params.counter_offset_beacon] !=
5779             params.count)
5780                 return -EINVAL;
5781
5782         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
5783                 params.counter_offset_presp =
5784                         nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
5785                 if (params.counter_offset_presp >=
5786                     params.beacon_csa.probe_resp_len)
5787                         return -EINVAL;
5788
5789                 if (params.beacon_csa.probe_resp[params.counter_offset_presp] !=
5790                     params.count)
5791                         return -EINVAL;
5792         }
5793
5794 skip_beacons:
5795         err = nl80211_parse_chandef(rdev, info, &params.chandef);
5796         if (err)
5797                 return err;
5798
5799         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
5800                 return -EINVAL;
5801
5802         if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP ||
5803             dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO ||
5804             dev->ieee80211_ptr->iftype == NL80211_IFTYPE_ADHOC) {
5805                 err = cfg80211_chandef_dfs_required(wdev->wiphy,
5806                                                     &params.chandef);
5807                 if (err < 0) {
5808                         return err;
5809                 } else if (err) {
5810                         radar_detect_width = BIT(params.chandef.width);
5811                         params.radar_required = true;
5812                 }
5813         }
5814
5815         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
5816                                            params.chandef.chan,
5817                                            CHAN_MODE_SHARED,
5818                                            radar_detect_width);
5819         if (err)
5820                 return err;
5821
5822         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
5823                 params.block_tx = true;
5824
5825         wdev_lock(wdev);
5826         err = rdev_channel_switch(rdev, dev, &params);
5827         wdev_unlock(wdev);
5828
5829         return err;
5830 }
5831
5832 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
5833                             u32 seq, int flags,
5834                             struct cfg80211_registered_device *rdev,
5835                             struct wireless_dev *wdev,
5836                             struct cfg80211_internal_bss *intbss)
5837 {
5838         struct cfg80211_bss *res = &intbss->pub;
5839         const struct cfg80211_bss_ies *ies;
5840         void *hdr;
5841         struct nlattr *bss;
5842         bool tsf = false;
5843
5844         ASSERT_WDEV_LOCK(wdev);
5845
5846         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
5847                              NL80211_CMD_NEW_SCAN_RESULTS);
5848         if (!hdr)
5849                 return -1;
5850
5851         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
5852
5853         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
5854                 goto nla_put_failure;
5855         if (wdev->netdev &&
5856             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
5857                 goto nla_put_failure;
5858         if (nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
5859                 goto nla_put_failure;
5860
5861         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
5862         if (!bss)
5863                 goto nla_put_failure;
5864         if ((!is_zero_ether_addr(res->bssid) &&
5865              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
5866                 goto nla_put_failure;
5867
5868         rcu_read_lock();
5869         ies = rcu_dereference(res->ies);
5870         if (ies) {
5871                 if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5872                         goto fail_unlock_rcu;
5873                 tsf = true;
5874                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
5875                                         ies->len, ies->data))
5876                         goto fail_unlock_rcu;
5877         }
5878         ies = rcu_dereference(res->beacon_ies);
5879         if (ies) {
5880                 if (!tsf && nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5881                         goto fail_unlock_rcu;
5882                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
5883                                         ies->len, ies->data))
5884                         goto fail_unlock_rcu;
5885         }
5886         rcu_read_unlock();
5887
5888         if (res->beacon_interval &&
5889             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
5890                 goto nla_put_failure;
5891         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
5892             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
5893             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
5894             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
5895                         jiffies_to_msecs(jiffies - intbss->ts)))
5896                 goto nla_put_failure;
5897
5898         switch (rdev->wiphy.signal_type) {
5899         case CFG80211_SIGNAL_TYPE_MBM:
5900                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
5901                         goto nla_put_failure;
5902                 break;
5903         case CFG80211_SIGNAL_TYPE_UNSPEC:
5904                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
5905                         goto nla_put_failure;
5906                 break;
5907         default:
5908                 break;
5909         }
5910
5911         switch (wdev->iftype) {
5912         case NL80211_IFTYPE_P2P_CLIENT:
5913         case NL80211_IFTYPE_STATION:
5914                 if (intbss == wdev->current_bss &&
5915                     nla_put_u32(msg, NL80211_BSS_STATUS,
5916                                 NL80211_BSS_STATUS_ASSOCIATED))
5917                         goto nla_put_failure;
5918                 break;
5919         case NL80211_IFTYPE_ADHOC:
5920                 if (intbss == wdev->current_bss &&
5921                     nla_put_u32(msg, NL80211_BSS_STATUS,
5922                                 NL80211_BSS_STATUS_IBSS_JOINED))
5923                         goto nla_put_failure;
5924                 break;
5925         default:
5926                 break;
5927         }
5928
5929         nla_nest_end(msg, bss);
5930
5931         return genlmsg_end(msg, hdr);
5932
5933  fail_unlock_rcu:
5934         rcu_read_unlock();
5935  nla_put_failure:
5936         genlmsg_cancel(msg, hdr);
5937         return -EMSGSIZE;
5938 }
5939
5940 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
5941 {
5942         struct cfg80211_registered_device *rdev;
5943         struct cfg80211_internal_bss *scan;
5944         struct wireless_dev *wdev;
5945         int start = cb->args[2], idx = 0;
5946         int err;
5947
5948         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5949         if (err)
5950                 return err;
5951
5952         wdev_lock(wdev);
5953         spin_lock_bh(&rdev->bss_lock);
5954         cfg80211_bss_expire(rdev);
5955
5956         cb->seq = rdev->bss_generation;
5957
5958         list_for_each_entry(scan, &rdev->bss_list, list) {
5959                 if (++idx <= start)
5960                         continue;
5961                 if (nl80211_send_bss(skb, cb,
5962                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5963                                 rdev, wdev, scan) < 0) {
5964                         idx--;
5965                         break;
5966                 }
5967         }
5968
5969         spin_unlock_bh(&rdev->bss_lock);
5970         wdev_unlock(wdev);
5971
5972         cb->args[2] = idx;
5973         nl80211_finish_wdev_dump(rdev);
5974
5975         return skb->len;
5976 }
5977
5978 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
5979                                 int flags, struct net_device *dev,
5980                                 struct survey_info *survey)
5981 {
5982         void *hdr;
5983         struct nlattr *infoattr;
5984
5985         hdr = nl80211hdr_put(msg, portid, seq, flags,
5986                              NL80211_CMD_NEW_SURVEY_RESULTS);
5987         if (!hdr)
5988                 return -ENOMEM;
5989
5990         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
5991                 goto nla_put_failure;
5992
5993         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
5994         if (!infoattr)
5995                 goto nla_put_failure;
5996
5997         if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
5998                         survey->channel->center_freq))
5999                 goto nla_put_failure;
6000
6001         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
6002             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
6003                 goto nla_put_failure;
6004         if ((survey->filled & SURVEY_INFO_IN_USE) &&
6005             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
6006                 goto nla_put_failure;
6007         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
6008             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
6009                         survey->channel_time))
6010                 goto nla_put_failure;
6011         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
6012             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
6013                         survey->channel_time_busy))
6014                 goto nla_put_failure;
6015         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
6016             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
6017                         survey->channel_time_ext_busy))
6018                 goto nla_put_failure;
6019         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
6020             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
6021                         survey->channel_time_rx))
6022                 goto nla_put_failure;
6023         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
6024             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
6025                         survey->channel_time_tx))
6026                 goto nla_put_failure;
6027
6028         nla_nest_end(msg, infoattr);
6029
6030         return genlmsg_end(msg, hdr);
6031
6032  nla_put_failure:
6033         genlmsg_cancel(msg, hdr);
6034         return -EMSGSIZE;
6035 }
6036
6037 static int nl80211_dump_survey(struct sk_buff *skb,
6038                         struct netlink_callback *cb)
6039 {
6040         struct survey_info survey;
6041         struct cfg80211_registered_device *dev;
6042         struct wireless_dev *wdev;
6043         int survey_idx = cb->args[2];
6044         int res;
6045
6046         res = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
6047         if (res)
6048                 return res;
6049
6050         if (!wdev->netdev) {
6051                 res = -EINVAL;
6052                 goto out_err;
6053         }
6054
6055         if (!dev->ops->dump_survey) {
6056                 res = -EOPNOTSUPP;
6057                 goto out_err;
6058         }
6059
6060         while (1) {
6061                 struct ieee80211_channel *chan;
6062
6063                 res = rdev_dump_survey(dev, wdev->netdev, survey_idx, &survey);
6064                 if (res == -ENOENT)
6065                         break;
6066                 if (res)
6067                         goto out_err;
6068
6069                 /* Survey without a channel doesn't make sense */
6070                 if (!survey.channel) {
6071                         res = -EINVAL;
6072                         goto out;
6073                 }
6074
6075                 chan = ieee80211_get_channel(&dev->wiphy,
6076                                              survey.channel->center_freq);
6077                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
6078                         survey_idx++;
6079                         continue;
6080                 }
6081
6082                 if (nl80211_send_survey(skb,
6083                                 NETLINK_CB(cb->skb).portid,
6084                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6085                                 wdev->netdev, &survey) < 0)
6086                         goto out;
6087                 survey_idx++;
6088         }
6089
6090  out:
6091         cb->args[2] = survey_idx;
6092         res = skb->len;
6093  out_err:
6094         nl80211_finish_wdev_dump(dev);
6095         return res;
6096 }
6097
6098 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
6099 {
6100         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
6101                                   NL80211_WPA_VERSION_2));
6102 }
6103
6104 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
6105 {
6106         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6107         struct net_device *dev = info->user_ptr[1];
6108         struct ieee80211_channel *chan;
6109         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
6110         int err, ssid_len, ie_len = 0, sae_data_len = 0;
6111         enum nl80211_auth_type auth_type;
6112         struct key_parse key;
6113         bool local_state_change;
6114
6115         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6116                 return -EINVAL;
6117
6118         if (!info->attrs[NL80211_ATTR_MAC])
6119                 return -EINVAL;
6120
6121         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
6122                 return -EINVAL;
6123
6124         if (!info->attrs[NL80211_ATTR_SSID])
6125                 return -EINVAL;
6126
6127         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
6128                 return -EINVAL;
6129
6130         err = nl80211_parse_key(info, &key);
6131         if (err)
6132                 return err;
6133
6134         if (key.idx >= 0) {
6135                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
6136                         return -EINVAL;
6137                 if (!key.p.key || !key.p.key_len)
6138                         return -EINVAL;
6139                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
6140                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
6141                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
6142                      key.p.key_len != WLAN_KEY_LEN_WEP104))
6143                         return -EINVAL;
6144                 if (key.idx > 4)
6145                         return -EINVAL;
6146         } else {
6147                 key.p.key_len = 0;
6148                 key.p.key = NULL;
6149         }
6150
6151         if (key.idx >= 0) {
6152                 int i;
6153                 bool ok = false;
6154                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
6155                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
6156                                 ok = true;
6157                                 break;
6158                         }
6159                 }
6160                 if (!ok)
6161                         return -EINVAL;
6162         }
6163
6164         if (!rdev->ops->auth)
6165                 return -EOPNOTSUPP;
6166
6167         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6168             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6169                 return -EOPNOTSUPP;
6170
6171         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6172         chan = ieee80211_get_channel(&rdev->wiphy,
6173                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6174         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
6175                 return -EINVAL;
6176
6177         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6178         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6179
6180         if (info->attrs[NL80211_ATTR_IE]) {
6181                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6182                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6183         }
6184
6185         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6186         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
6187                 return -EINVAL;
6188
6189         if (auth_type == NL80211_AUTHTYPE_SAE &&
6190             !info->attrs[NL80211_ATTR_SAE_DATA])
6191                 return -EINVAL;
6192
6193         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
6194                 if (auth_type != NL80211_AUTHTYPE_SAE)
6195                         return -EINVAL;
6196                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
6197                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
6198                 /* need to include at least Auth Transaction and Status Code */
6199                 if (sae_data_len < 4)
6200                         return -EINVAL;
6201         }
6202
6203         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6204
6205         /*
6206          * Since we no longer track auth state, ignore
6207          * requests to only change local state.
6208          */
6209         if (local_state_change)
6210                 return 0;
6211
6212         wdev_lock(dev->ieee80211_ptr);
6213         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
6214                                  ssid, ssid_len, ie, ie_len,
6215                                  key.p.key, key.p.key_len, key.idx,
6216                                  sae_data, sae_data_len);
6217         wdev_unlock(dev->ieee80211_ptr);
6218         return err;
6219 }
6220
6221 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
6222                                    struct genl_info *info,
6223                                    struct cfg80211_crypto_settings *settings,
6224                                    int cipher_limit)
6225 {
6226         memset(settings, 0, sizeof(*settings));
6227
6228         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
6229
6230         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
6231                 u16 proto;
6232                 proto = nla_get_u16(
6233                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
6234                 settings->control_port_ethertype = cpu_to_be16(proto);
6235                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
6236                     proto != ETH_P_PAE)
6237                         return -EINVAL;
6238                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
6239                         settings->control_port_no_encrypt = true;
6240         } else
6241                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
6242
6243         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
6244                 void *data;
6245                 int len, i;
6246
6247                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6248                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6249                 settings->n_ciphers_pairwise = len / sizeof(u32);
6250
6251                 if (len % sizeof(u32))
6252                         return -EINVAL;
6253
6254                 if (settings->n_ciphers_pairwise > cipher_limit)
6255                         return -EINVAL;
6256
6257                 memcpy(settings->ciphers_pairwise, data, len);
6258
6259                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
6260                         if (!cfg80211_supported_cipher_suite(
6261                                         &rdev->wiphy,
6262                                         settings->ciphers_pairwise[i]))
6263                                 return -EINVAL;
6264         }
6265
6266         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
6267                 settings->cipher_group =
6268                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
6269                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
6270                                                      settings->cipher_group))
6271                         return -EINVAL;
6272         }
6273
6274         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
6275                 settings->wpa_versions =
6276                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
6277                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
6278                         return -EINVAL;
6279         }
6280
6281         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
6282                 void *data;
6283                 int len;
6284
6285                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
6286                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
6287                 settings->n_akm_suites = len / sizeof(u32);
6288
6289                 if (len % sizeof(u32))
6290                         return -EINVAL;
6291
6292                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
6293                         return -EINVAL;
6294
6295                 memcpy(settings->akm_suites, data, len);
6296         }
6297
6298         return 0;
6299 }
6300
6301 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
6302 {
6303         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6304         struct net_device *dev = info->user_ptr[1];
6305         struct ieee80211_channel *chan;
6306         struct cfg80211_assoc_request req = {};
6307         const u8 *bssid, *ssid;
6308         int err, ssid_len = 0;
6309
6310         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6311                 return -EINVAL;
6312
6313         if (!info->attrs[NL80211_ATTR_MAC] ||
6314             !info->attrs[NL80211_ATTR_SSID] ||
6315             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
6316                 return -EINVAL;
6317
6318         if (!rdev->ops->assoc)
6319                 return -EOPNOTSUPP;
6320
6321         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6322             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6323                 return -EOPNOTSUPP;
6324
6325         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6326
6327         chan = ieee80211_get_channel(&rdev->wiphy,
6328                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6329         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
6330                 return -EINVAL;
6331
6332         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6333         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6334
6335         if (info->attrs[NL80211_ATTR_IE]) {
6336                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6337                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6338         }
6339
6340         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6341                 enum nl80211_mfp mfp =
6342                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6343                 if (mfp == NL80211_MFP_REQUIRED)
6344                         req.use_mfp = true;
6345                 else if (mfp != NL80211_MFP_NO)
6346                         return -EINVAL;
6347         }
6348
6349         if (info->attrs[NL80211_ATTR_PREV_BSSID])
6350                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
6351
6352         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6353                 req.flags |= ASSOC_REQ_DISABLE_HT;
6354
6355         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6356                 memcpy(&req.ht_capa_mask,
6357                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6358                        sizeof(req.ht_capa_mask));
6359
6360         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6361                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6362                         return -EINVAL;
6363                 memcpy(&req.ht_capa,
6364                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6365                        sizeof(req.ht_capa));
6366         }
6367
6368         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
6369                 req.flags |= ASSOC_REQ_DISABLE_VHT;
6370
6371         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6372                 memcpy(&req.vht_capa_mask,
6373                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
6374                        sizeof(req.vht_capa_mask));
6375
6376         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
6377                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6378                         return -EINVAL;
6379                 memcpy(&req.vht_capa,
6380                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
6381                        sizeof(req.vht_capa));
6382         }
6383
6384         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
6385         if (!err) {
6386                 wdev_lock(dev->ieee80211_ptr);
6387                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
6388                                           ssid, ssid_len, &req);
6389                 wdev_unlock(dev->ieee80211_ptr);
6390         }
6391
6392         return err;
6393 }
6394
6395 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
6396 {
6397         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6398         struct net_device *dev = info->user_ptr[1];
6399         const u8 *ie = NULL, *bssid;
6400         int ie_len = 0, err;
6401         u16 reason_code;
6402         bool local_state_change;
6403
6404         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6405                 return -EINVAL;
6406
6407         if (!info->attrs[NL80211_ATTR_MAC])
6408                 return -EINVAL;
6409
6410         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6411                 return -EINVAL;
6412
6413         if (!rdev->ops->deauth)
6414                 return -EOPNOTSUPP;
6415
6416         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6417             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6418                 return -EOPNOTSUPP;
6419
6420         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6421
6422         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6423         if (reason_code == 0) {
6424                 /* Reason Code 0 is reserved */
6425                 return -EINVAL;
6426         }
6427
6428         if (info->attrs[NL80211_ATTR_IE]) {
6429                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6430                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6431         }
6432
6433         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6434
6435         wdev_lock(dev->ieee80211_ptr);
6436         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
6437                                    local_state_change);
6438         wdev_unlock(dev->ieee80211_ptr);
6439         return err;
6440 }
6441
6442 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
6443 {
6444         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6445         struct net_device *dev = info->user_ptr[1];
6446         const u8 *ie = NULL, *bssid;
6447         int ie_len = 0, err;
6448         u16 reason_code;
6449         bool local_state_change;
6450
6451         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6452                 return -EINVAL;
6453
6454         if (!info->attrs[NL80211_ATTR_MAC])
6455                 return -EINVAL;
6456
6457         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6458                 return -EINVAL;
6459
6460         if (!rdev->ops->disassoc)
6461                 return -EOPNOTSUPP;
6462
6463         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6464             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6465                 return -EOPNOTSUPP;
6466
6467         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6468
6469         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6470         if (reason_code == 0) {
6471                 /* Reason Code 0 is reserved */
6472                 return -EINVAL;
6473         }
6474
6475         if (info->attrs[NL80211_ATTR_IE]) {
6476                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6477                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6478         }
6479
6480         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6481
6482         wdev_lock(dev->ieee80211_ptr);
6483         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
6484                                      local_state_change);
6485         wdev_unlock(dev->ieee80211_ptr);
6486         return err;
6487 }
6488
6489 static bool
6490 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
6491                          int mcast_rate[IEEE80211_NUM_BANDS],
6492                          int rateval)
6493 {
6494         struct wiphy *wiphy = &rdev->wiphy;
6495         bool found = false;
6496         int band, i;
6497
6498         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
6499                 struct ieee80211_supported_band *sband;
6500
6501                 sband = wiphy->bands[band];
6502                 if (!sband)
6503                         continue;
6504
6505                 for (i = 0; i < sband->n_bitrates; i++) {
6506                         if (sband->bitrates[i].bitrate == rateval) {
6507                                 mcast_rate[band] = i + 1;
6508                                 found = true;
6509                                 break;
6510                         }
6511                 }
6512         }
6513
6514         return found;
6515 }
6516
6517 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
6518 {
6519         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6520         struct net_device *dev = info->user_ptr[1];
6521         struct cfg80211_ibss_params ibss;
6522         struct wiphy *wiphy;
6523         struct cfg80211_cached_keys *connkeys = NULL;
6524         int err;
6525
6526         memset(&ibss, 0, sizeof(ibss));
6527
6528         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6529                 return -EINVAL;
6530
6531         if (!info->attrs[NL80211_ATTR_SSID] ||
6532             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6533                 return -EINVAL;
6534
6535         ibss.beacon_interval = 100;
6536
6537         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
6538                 ibss.beacon_interval =
6539                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
6540                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
6541                         return -EINVAL;
6542         }
6543
6544         if (!rdev->ops->join_ibss)
6545                 return -EOPNOTSUPP;
6546
6547         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6548                 return -EOPNOTSUPP;
6549
6550         wiphy = &rdev->wiphy;
6551
6552         if (info->attrs[NL80211_ATTR_MAC]) {
6553                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6554
6555                 if (!is_valid_ether_addr(ibss.bssid))
6556                         return -EINVAL;
6557         }
6558         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6559         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6560
6561         if (info->attrs[NL80211_ATTR_IE]) {
6562                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6563                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6564         }
6565
6566         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
6567         if (err)
6568                 return err;
6569
6570         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef))
6571                 return -EINVAL;
6572
6573         switch (ibss.chandef.width) {
6574         case NL80211_CHAN_WIDTH_5:
6575         case NL80211_CHAN_WIDTH_10:
6576         case NL80211_CHAN_WIDTH_20_NOHT:
6577                 break;
6578         case NL80211_CHAN_WIDTH_20:
6579         case NL80211_CHAN_WIDTH_40:
6580                 if (rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)
6581                         break;
6582         default:
6583                 return -EINVAL;
6584         }
6585
6586         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
6587         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
6588
6589         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
6590                 u8 *rates =
6591                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6592                 int n_rates =
6593                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6594                 struct ieee80211_supported_band *sband =
6595                         wiphy->bands[ibss.chandef.chan->band];
6596
6597                 err = ieee80211_get_ratemask(sband, rates, n_rates,
6598                                              &ibss.basic_rates);
6599                 if (err)
6600                         return err;
6601         }
6602
6603         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6604                 memcpy(&ibss.ht_capa_mask,
6605                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6606                        sizeof(ibss.ht_capa_mask));
6607
6608         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6609                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6610                         return -EINVAL;
6611                 memcpy(&ibss.ht_capa,
6612                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6613                        sizeof(ibss.ht_capa));
6614         }
6615
6616         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
6617             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
6618                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
6619                 return -EINVAL;
6620
6621         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6622                 bool no_ht = false;
6623
6624                 connkeys = nl80211_parse_connkeys(rdev,
6625                                           info->attrs[NL80211_ATTR_KEYS],
6626                                           &no_ht);
6627                 if (IS_ERR(connkeys))
6628                         return PTR_ERR(connkeys);
6629
6630                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
6631                     no_ht) {
6632                         kfree(connkeys);
6633                         return -EINVAL;
6634                 }
6635         }
6636
6637         ibss.control_port =
6638                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
6639
6640         ibss.userspace_handles_dfs =
6641                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
6642
6643         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
6644         if (err)
6645                 kfree(connkeys);
6646         return err;
6647 }
6648
6649 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
6650 {
6651         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6652         struct net_device *dev = info->user_ptr[1];
6653
6654         if (!rdev->ops->leave_ibss)
6655                 return -EOPNOTSUPP;
6656
6657         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6658                 return -EOPNOTSUPP;
6659
6660         return cfg80211_leave_ibss(rdev, dev, false);
6661 }
6662
6663 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
6664 {
6665         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6666         struct net_device *dev = info->user_ptr[1];
6667         int mcast_rate[IEEE80211_NUM_BANDS];
6668         u32 nla_rate;
6669         int err;
6670
6671         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
6672             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6673                 return -EOPNOTSUPP;
6674
6675         if (!rdev->ops->set_mcast_rate)
6676                 return -EOPNOTSUPP;
6677
6678         memset(mcast_rate, 0, sizeof(mcast_rate));
6679
6680         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
6681                 return -EINVAL;
6682
6683         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
6684         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
6685                 return -EINVAL;
6686
6687         err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
6688
6689         return err;
6690 }
6691
6692
6693 #ifdef CONFIG_NL80211_TESTMODE
6694 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
6695 {
6696         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6697         struct wireless_dev *wdev =
6698                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
6699         int err;
6700
6701         if (!rdev->ops->testmode_cmd)
6702                 return -EOPNOTSUPP;
6703
6704         if (IS_ERR(wdev)) {
6705                 err = PTR_ERR(wdev);
6706                 if (err != -EINVAL)
6707                         return err;
6708                 wdev = NULL;
6709         } else if (wdev->wiphy != &rdev->wiphy) {
6710                 return -EINVAL;
6711         }
6712
6713         if (!info->attrs[NL80211_ATTR_TESTDATA])
6714                 return -EINVAL;
6715
6716         rdev->testmode_info = info;
6717         err = rdev_testmode_cmd(rdev, wdev,
6718                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
6719                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
6720         rdev->testmode_info = NULL;
6721
6722         return err;
6723 }
6724
6725 static int nl80211_testmode_dump(struct sk_buff *skb,
6726                                  struct netlink_callback *cb)
6727 {
6728         struct cfg80211_registered_device *rdev;
6729         int err;
6730         long phy_idx;
6731         void *data = NULL;
6732         int data_len = 0;
6733
6734         rtnl_lock();
6735
6736         if (cb->args[0]) {
6737                 /*
6738                  * 0 is a valid index, but not valid for args[0],
6739                  * so we need to offset by 1.
6740                  */
6741                 phy_idx = cb->args[0] - 1;
6742         } else {
6743                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
6744                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
6745                                   nl80211_policy);
6746                 if (err)
6747                         goto out_err;
6748
6749                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
6750                                                   nl80211_fam.attrbuf);
6751                 if (IS_ERR(rdev)) {
6752                         err = PTR_ERR(rdev);
6753                         goto out_err;
6754                 }
6755                 phy_idx = rdev->wiphy_idx;
6756                 rdev = NULL;
6757
6758                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
6759                         cb->args[1] =
6760                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
6761         }
6762
6763         if (cb->args[1]) {
6764                 data = nla_data((void *)cb->args[1]);
6765                 data_len = nla_len((void *)cb->args[1]);
6766         }
6767
6768         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
6769         if (!rdev) {
6770                 err = -ENOENT;
6771                 goto out_err;
6772         }
6773
6774         if (!rdev->ops->testmode_dump) {
6775                 err = -EOPNOTSUPP;
6776                 goto out_err;
6777         }
6778
6779         while (1) {
6780                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
6781                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
6782                                            NL80211_CMD_TESTMODE);
6783                 struct nlattr *tmdata;
6784
6785                 if (!hdr)
6786                         break;
6787
6788                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
6789                         genlmsg_cancel(skb, hdr);
6790                         break;
6791                 }
6792
6793                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6794                 if (!tmdata) {
6795                         genlmsg_cancel(skb, hdr);
6796                         break;
6797                 }
6798                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
6799                 nla_nest_end(skb, tmdata);
6800
6801                 if (err == -ENOBUFS || err == -ENOENT) {
6802                         genlmsg_cancel(skb, hdr);
6803                         break;
6804                 } else if (err) {
6805                         genlmsg_cancel(skb, hdr);
6806                         goto out_err;
6807                 }
6808
6809                 genlmsg_end(skb, hdr);
6810         }
6811
6812         err = skb->len;
6813         /* see above */
6814         cb->args[0] = phy_idx + 1;
6815  out_err:
6816         rtnl_unlock();
6817         return err;
6818 }
6819
6820 static struct sk_buff *
6821 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
6822                               int approxlen, u32 portid, u32 seq, gfp_t gfp)
6823 {
6824         struct sk_buff *skb;
6825         void *hdr;
6826         struct nlattr *data;
6827
6828         skb = nlmsg_new(approxlen + 100, gfp);
6829         if (!skb)
6830                 return NULL;
6831
6832         hdr = nl80211hdr_put(skb, portid, seq, 0, NL80211_CMD_TESTMODE);
6833         if (!hdr) {
6834                 kfree_skb(skb);
6835                 return NULL;
6836         }
6837
6838         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
6839                 goto nla_put_failure;
6840         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6841
6842         ((void **)skb->cb)[0] = rdev;
6843         ((void **)skb->cb)[1] = hdr;
6844         ((void **)skb->cb)[2] = data;
6845
6846         return skb;
6847
6848  nla_put_failure:
6849         kfree_skb(skb);
6850         return NULL;
6851 }
6852
6853 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
6854                                                   int approxlen)
6855 {
6856         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6857
6858         if (WARN_ON(!rdev->testmode_info))
6859                 return NULL;
6860
6861         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
6862                                 rdev->testmode_info->snd_portid,
6863                                 rdev->testmode_info->snd_seq,
6864                                 GFP_KERNEL);
6865 }
6866 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
6867
6868 int cfg80211_testmode_reply(struct sk_buff *skb)
6869 {
6870         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
6871         void *hdr = ((void **)skb->cb)[1];
6872         struct nlattr *data = ((void **)skb->cb)[2];
6873
6874         if (WARN_ON(!rdev->testmode_info)) {
6875                 kfree_skb(skb);
6876                 return -EINVAL;
6877         }
6878
6879         nla_nest_end(skb, data);
6880         genlmsg_end(skb, hdr);
6881         return genlmsg_reply(skb, rdev->testmode_info);
6882 }
6883 EXPORT_SYMBOL(cfg80211_testmode_reply);
6884
6885 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
6886                                                   int approxlen, gfp_t gfp)
6887 {
6888         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6889
6890         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
6891 }
6892 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
6893
6894 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
6895 {
6896         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
6897         void *hdr = ((void **)skb->cb)[1];
6898         struct nlattr *data = ((void **)skb->cb)[2];
6899
6900         nla_nest_end(skb, data);
6901         genlmsg_end(skb, hdr);
6902         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
6903                                 NL80211_MCGRP_TESTMODE, gfp);
6904 }
6905 EXPORT_SYMBOL(cfg80211_testmode_event);
6906 #endif
6907
6908 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
6909 {
6910         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6911         struct net_device *dev = info->user_ptr[1];
6912         struct cfg80211_connect_params connect;
6913         struct wiphy *wiphy;
6914         struct cfg80211_cached_keys *connkeys = NULL;
6915         int err;
6916
6917         memset(&connect, 0, sizeof(connect));
6918
6919         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6920                 return -EINVAL;
6921
6922         if (!info->attrs[NL80211_ATTR_SSID] ||
6923             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6924                 return -EINVAL;
6925
6926         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
6927                 connect.auth_type =
6928                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6929                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
6930                                              NL80211_CMD_CONNECT))
6931                         return -EINVAL;
6932         } else
6933                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
6934
6935         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
6936
6937         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
6938                                       NL80211_MAX_NR_CIPHER_SUITES);
6939         if (err)
6940                 return err;
6941
6942         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6943             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6944                 return -EOPNOTSUPP;
6945
6946         wiphy = &rdev->wiphy;
6947
6948         connect.bg_scan_period = -1;
6949         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
6950                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
6951                 connect.bg_scan_period =
6952                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
6953         }
6954
6955         if (info->attrs[NL80211_ATTR_MAC])
6956                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6957         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6958         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6959
6960         if (info->attrs[NL80211_ATTR_IE]) {
6961                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6962                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6963         }
6964
6965         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6966                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6967                 if (connect.mfp != NL80211_MFP_REQUIRED &&
6968                     connect.mfp != NL80211_MFP_NO)
6969                         return -EINVAL;
6970         } else {
6971                 connect.mfp = NL80211_MFP_NO;
6972         }
6973
6974         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6975                 connect.channel =
6976                         ieee80211_get_channel(wiphy,
6977                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6978                 if (!connect.channel ||
6979                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
6980                         return -EINVAL;
6981         }
6982
6983         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6984                 connkeys = nl80211_parse_connkeys(rdev,
6985                                           info->attrs[NL80211_ATTR_KEYS], NULL);
6986                 if (IS_ERR(connkeys))
6987                         return PTR_ERR(connkeys);
6988         }
6989
6990         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6991                 connect.flags |= ASSOC_REQ_DISABLE_HT;
6992
6993         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6994                 memcpy(&connect.ht_capa_mask,
6995                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6996                        sizeof(connect.ht_capa_mask));
6997
6998         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6999                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
7000                         kfree(connkeys);
7001                         return -EINVAL;
7002                 }
7003                 memcpy(&connect.ht_capa,
7004                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7005                        sizeof(connect.ht_capa));
7006         }
7007
7008         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
7009                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
7010
7011         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7012                 memcpy(&connect.vht_capa_mask,
7013                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
7014                        sizeof(connect.vht_capa_mask));
7015
7016         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
7017                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
7018                         kfree(connkeys);
7019                         return -EINVAL;
7020                 }
7021                 memcpy(&connect.vht_capa,
7022                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
7023                        sizeof(connect.vht_capa));
7024         }
7025
7026         wdev_lock(dev->ieee80211_ptr);
7027         err = cfg80211_connect(rdev, dev, &connect, connkeys, NULL);
7028         wdev_unlock(dev->ieee80211_ptr);
7029         if (err)
7030                 kfree(connkeys);
7031         return err;
7032 }
7033
7034 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
7035 {
7036         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7037         struct net_device *dev = info->user_ptr[1];
7038         u16 reason;
7039         int ret;
7040
7041         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7042                 reason = WLAN_REASON_DEAUTH_LEAVING;
7043         else
7044                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7045
7046         if (reason == 0)
7047                 return -EINVAL;
7048
7049         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7050             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7051                 return -EOPNOTSUPP;
7052
7053         wdev_lock(dev->ieee80211_ptr);
7054         ret = cfg80211_disconnect(rdev, dev, reason, true);
7055         wdev_unlock(dev->ieee80211_ptr);
7056         return ret;
7057 }
7058
7059 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
7060 {
7061         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7062         struct net *net;
7063         int err;
7064         u32 pid;
7065
7066         if (!info->attrs[NL80211_ATTR_PID])
7067                 return -EINVAL;
7068
7069         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
7070
7071         net = get_net_ns_by_pid(pid);
7072         if (IS_ERR(net))
7073                 return PTR_ERR(net);
7074
7075         err = 0;
7076
7077         /* check if anything to do */
7078         if (!net_eq(wiphy_net(&rdev->wiphy), net))
7079                 err = cfg80211_switch_netns(rdev, net);
7080
7081         put_net(net);
7082         return err;
7083 }
7084
7085 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
7086 {
7087         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7088         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
7089                         struct cfg80211_pmksa *pmksa) = NULL;
7090         struct net_device *dev = info->user_ptr[1];
7091         struct cfg80211_pmksa pmksa;
7092
7093         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
7094
7095         if (!info->attrs[NL80211_ATTR_MAC])
7096                 return -EINVAL;
7097
7098         if (!info->attrs[NL80211_ATTR_PMKID])
7099                 return -EINVAL;
7100
7101         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
7102         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7103
7104         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7105             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7106                 return -EOPNOTSUPP;
7107
7108         switch (info->genlhdr->cmd) {
7109         case NL80211_CMD_SET_PMKSA:
7110                 rdev_ops = rdev->ops->set_pmksa;
7111                 break;
7112         case NL80211_CMD_DEL_PMKSA:
7113                 rdev_ops = rdev->ops->del_pmksa;
7114                 break;
7115         default:
7116                 WARN_ON(1);
7117                 break;
7118         }
7119
7120         if (!rdev_ops)
7121                 return -EOPNOTSUPP;
7122
7123         return rdev_ops(&rdev->wiphy, dev, &pmksa);
7124 }
7125
7126 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
7127 {
7128         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7129         struct net_device *dev = info->user_ptr[1];
7130
7131         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7132             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7133                 return -EOPNOTSUPP;
7134
7135         if (!rdev->ops->flush_pmksa)
7136                 return -EOPNOTSUPP;
7137
7138         return rdev_flush_pmksa(rdev, dev);
7139 }
7140
7141 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
7142 {
7143         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7144         struct net_device *dev = info->user_ptr[1];
7145         u8 action_code, dialog_token;
7146         u16 status_code;
7147         u8 *peer;
7148
7149         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
7150             !rdev->ops->tdls_mgmt)
7151                 return -EOPNOTSUPP;
7152
7153         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
7154             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
7155             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
7156             !info->attrs[NL80211_ATTR_IE] ||
7157             !info->attrs[NL80211_ATTR_MAC])
7158                 return -EINVAL;
7159
7160         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
7161         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
7162         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
7163         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
7164
7165         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
7166                               dialog_token, status_code,
7167                               nla_data(info->attrs[NL80211_ATTR_IE]),
7168                               nla_len(info->attrs[NL80211_ATTR_IE]));
7169 }
7170
7171 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
7172 {
7173         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7174         struct net_device *dev = info->user_ptr[1];
7175         enum nl80211_tdls_operation operation;
7176         u8 *peer;
7177
7178         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
7179             !rdev->ops->tdls_oper)
7180                 return -EOPNOTSUPP;
7181
7182         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
7183             !info->attrs[NL80211_ATTR_MAC])
7184                 return -EINVAL;
7185
7186         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
7187         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
7188
7189         return rdev_tdls_oper(rdev, dev, peer, operation);
7190 }
7191
7192 static int nl80211_remain_on_channel(struct sk_buff *skb,
7193                                      struct genl_info *info)
7194 {
7195         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7196         struct wireless_dev *wdev = info->user_ptr[1];
7197         struct cfg80211_chan_def chandef;
7198         struct sk_buff *msg;
7199         void *hdr;
7200         u64 cookie;
7201         u32 duration;
7202         int err;
7203
7204         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
7205             !info->attrs[NL80211_ATTR_DURATION])
7206                 return -EINVAL;
7207
7208         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7209
7210         if (!rdev->ops->remain_on_channel ||
7211             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
7212                 return -EOPNOTSUPP;
7213
7214         /*
7215          * We should be on that channel for at least a minimum amount of
7216          * time (10ms) but no longer than the driver supports.
7217          */
7218         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7219             duration > rdev->wiphy.max_remain_on_channel_duration)
7220                 return -EINVAL;
7221
7222         err = nl80211_parse_chandef(rdev, info, &chandef);
7223         if (err)
7224                 return err;
7225
7226         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7227         if (!msg)
7228                 return -ENOMEM;
7229
7230         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7231                              NL80211_CMD_REMAIN_ON_CHANNEL);
7232         if (!hdr) {
7233                 err = -ENOBUFS;
7234                 goto free_msg;
7235         }
7236
7237         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
7238                                      duration, &cookie);
7239
7240         if (err)
7241                 goto free_msg;
7242
7243         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7244                 goto nla_put_failure;
7245
7246         genlmsg_end(msg, hdr);
7247
7248         return genlmsg_reply(msg, info);
7249
7250  nla_put_failure:
7251         err = -ENOBUFS;
7252  free_msg:
7253         nlmsg_free(msg);
7254         return err;
7255 }
7256
7257 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
7258                                             struct genl_info *info)
7259 {
7260         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7261         struct wireless_dev *wdev = info->user_ptr[1];
7262         u64 cookie;
7263
7264         if (!info->attrs[NL80211_ATTR_COOKIE])
7265                 return -EINVAL;
7266
7267         if (!rdev->ops->cancel_remain_on_channel)
7268                 return -EOPNOTSUPP;
7269
7270         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7271
7272         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
7273 }
7274
7275 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
7276                            u8 *rates, u8 rates_len)
7277 {
7278         u8 i;
7279         u32 mask = 0;
7280
7281         for (i = 0; i < rates_len; i++) {
7282                 int rate = (rates[i] & 0x7f) * 5;
7283                 int ridx;
7284                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
7285                         struct ieee80211_rate *srate =
7286                                 &sband->bitrates[ridx];
7287                         if (rate == srate->bitrate) {
7288                                 mask |= 1 << ridx;
7289                                 break;
7290                         }
7291                 }
7292                 if (ridx == sband->n_bitrates)
7293                         return 0; /* rate not found */
7294         }
7295
7296         return mask;
7297 }
7298
7299 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
7300                                u8 *rates, u8 rates_len,
7301                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
7302 {
7303         u8 i;
7304
7305         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
7306
7307         for (i = 0; i < rates_len; i++) {
7308                 int ridx, rbit;
7309
7310                 ridx = rates[i] / 8;
7311                 rbit = BIT(rates[i] % 8);
7312
7313                 /* check validity */
7314                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
7315                         return false;
7316
7317                 /* check availability */
7318                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
7319                         mcs[ridx] |= rbit;
7320                 else
7321                         return false;
7322         }
7323
7324         return true;
7325 }
7326
7327 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
7328         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
7329                                     .len = NL80211_MAX_SUPP_RATES },
7330         [NL80211_TXRATE_MCS] = { .type = NLA_BINARY,
7331                                  .len = NL80211_MAX_SUPP_HT_RATES },
7332 };
7333
7334 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
7335                                        struct genl_info *info)
7336 {
7337         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
7338         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7339         struct cfg80211_bitrate_mask mask;
7340         int rem, i;
7341         struct net_device *dev = info->user_ptr[1];
7342         struct nlattr *tx_rates;
7343         struct ieee80211_supported_band *sband;
7344
7345         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
7346                 return -EINVAL;
7347
7348         if (!rdev->ops->set_bitrate_mask)
7349                 return -EOPNOTSUPP;
7350
7351         memset(&mask, 0, sizeof(mask));
7352         /* Default to all rates enabled */
7353         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
7354                 sband = rdev->wiphy.bands[i];
7355                 mask.control[i].legacy =
7356                         sband ? (1 << sband->n_bitrates) - 1 : 0;
7357                 if (sband)
7358                         memcpy(mask.control[i].mcs,
7359                                sband->ht_cap.mcs.rx_mask,
7360                                sizeof(mask.control[i].mcs));
7361                 else
7362                         memset(mask.control[i].mcs, 0,
7363                                sizeof(mask.control[i].mcs));
7364         }
7365
7366         /*
7367          * The nested attribute uses enum nl80211_band as the index. This maps
7368          * directly to the enum ieee80211_band values used in cfg80211.
7369          */
7370         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
7371         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
7372         {
7373                 enum ieee80211_band band = nla_type(tx_rates);
7374                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
7375                         return -EINVAL;
7376                 sband = rdev->wiphy.bands[band];
7377                 if (sband == NULL)
7378                         return -EINVAL;
7379                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
7380                           nla_len(tx_rates), nl80211_txattr_policy);
7381                 if (tb[NL80211_TXRATE_LEGACY]) {
7382                         mask.control[band].legacy = rateset_to_mask(
7383                                 sband,
7384                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
7385                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
7386                         if ((mask.control[band].legacy == 0) &&
7387                             nla_len(tb[NL80211_TXRATE_LEGACY]))
7388                                 return -EINVAL;
7389                 }
7390                 if (tb[NL80211_TXRATE_MCS]) {
7391                         if (!ht_rateset_to_mask(
7392                                         sband,
7393                                         nla_data(tb[NL80211_TXRATE_MCS]),
7394                                         nla_len(tb[NL80211_TXRATE_MCS]),
7395                                         mask.control[band].mcs))
7396                                 return -EINVAL;
7397                 }
7398
7399                 if (mask.control[band].legacy == 0) {
7400                         /* don't allow empty legacy rates if HT
7401                          * is not even supported. */
7402                         if (!rdev->wiphy.bands[band]->ht_cap.ht_supported)
7403                                 return -EINVAL;
7404
7405                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
7406                                 if (mask.control[band].mcs[i])
7407                                         break;
7408
7409                         /* legacy and mcs rates may not be both empty */
7410                         if (i == IEEE80211_HT_MCS_MASK_LEN)
7411                                 return -EINVAL;
7412                 }
7413         }
7414
7415         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
7416 }
7417
7418 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
7419 {
7420         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7421         struct wireless_dev *wdev = info->user_ptr[1];
7422         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
7423
7424         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
7425                 return -EINVAL;
7426
7427         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
7428                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
7429
7430         switch (wdev->iftype) {
7431         case NL80211_IFTYPE_STATION:
7432         case NL80211_IFTYPE_ADHOC:
7433         case NL80211_IFTYPE_P2P_CLIENT:
7434         case NL80211_IFTYPE_AP:
7435         case NL80211_IFTYPE_AP_VLAN:
7436         case NL80211_IFTYPE_MESH_POINT:
7437         case NL80211_IFTYPE_P2P_GO:
7438         case NL80211_IFTYPE_P2P_DEVICE:
7439                 break;
7440         default:
7441                 return -EOPNOTSUPP;
7442         }
7443
7444         /* not much point in registering if we can't reply */
7445         if (!rdev->ops->mgmt_tx)
7446                 return -EOPNOTSUPP;
7447
7448         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
7449                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
7450                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
7451 }
7452
7453 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
7454 {
7455         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7456         struct wireless_dev *wdev = info->user_ptr[1];
7457         struct cfg80211_chan_def chandef;
7458         int err;
7459         void *hdr = NULL;
7460         u64 cookie;
7461         struct sk_buff *msg = NULL;
7462         struct cfg80211_mgmt_tx_params params = {
7463                 .dont_wait_for_ack =
7464                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
7465         };
7466
7467         if (!info->attrs[NL80211_ATTR_FRAME])
7468                 return -EINVAL;
7469
7470         if (!rdev->ops->mgmt_tx)
7471                 return -EOPNOTSUPP;
7472
7473         switch (wdev->iftype) {
7474         case NL80211_IFTYPE_P2P_DEVICE:
7475                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
7476                         return -EINVAL;
7477         case NL80211_IFTYPE_STATION:
7478         case NL80211_IFTYPE_ADHOC:
7479         case NL80211_IFTYPE_P2P_CLIENT:
7480         case NL80211_IFTYPE_AP:
7481         case NL80211_IFTYPE_AP_VLAN:
7482         case NL80211_IFTYPE_MESH_POINT:
7483         case NL80211_IFTYPE_P2P_GO:
7484                 break;
7485         default:
7486                 return -EOPNOTSUPP;
7487         }
7488
7489         if (info->attrs[NL80211_ATTR_DURATION]) {
7490                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7491                         return -EINVAL;
7492                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7493
7494                 /*
7495                  * We should wait on the channel for at least a minimum amount
7496                  * of time (10ms) but no longer than the driver supports.
7497                  */
7498                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7499                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
7500                         return -EINVAL;
7501
7502         }
7503
7504         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
7505
7506         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7507                 return -EINVAL;
7508
7509         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7510
7511         /* get the channel if any has been specified, otherwise pass NULL to
7512          * the driver. The latter will use the current one
7513          */
7514         chandef.chan = NULL;
7515         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7516                 err = nl80211_parse_chandef(rdev, info, &chandef);
7517                 if (err)
7518                         return err;
7519         }
7520
7521         if (!chandef.chan && params.offchan)
7522                 return -EINVAL;
7523
7524         if (!params.dont_wait_for_ack) {
7525                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7526                 if (!msg)
7527                         return -ENOMEM;
7528
7529                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7530                                      NL80211_CMD_FRAME);
7531                 if (!hdr) {
7532                         err = -ENOBUFS;
7533                         goto free_msg;
7534                 }
7535         }
7536
7537         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
7538         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
7539         params.chan = chandef.chan;
7540         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
7541         if (err)
7542                 goto free_msg;
7543
7544         if (msg) {
7545                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7546                         goto nla_put_failure;
7547
7548                 genlmsg_end(msg, hdr);
7549                 return genlmsg_reply(msg, info);
7550         }
7551
7552         return 0;
7553
7554  nla_put_failure:
7555         err = -ENOBUFS;
7556  free_msg:
7557         nlmsg_free(msg);
7558         return err;
7559 }
7560
7561 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
7562 {
7563         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7564         struct wireless_dev *wdev = info->user_ptr[1];
7565         u64 cookie;
7566
7567         if (!info->attrs[NL80211_ATTR_COOKIE])
7568                 return -EINVAL;
7569
7570         if (!rdev->ops->mgmt_tx_cancel_wait)
7571                 return -EOPNOTSUPP;
7572
7573         switch (wdev->iftype) {
7574         case NL80211_IFTYPE_STATION:
7575         case NL80211_IFTYPE_ADHOC:
7576         case NL80211_IFTYPE_P2P_CLIENT:
7577         case NL80211_IFTYPE_AP:
7578         case NL80211_IFTYPE_AP_VLAN:
7579         case NL80211_IFTYPE_P2P_GO:
7580         case NL80211_IFTYPE_P2P_DEVICE:
7581                 break;
7582         default:
7583                 return -EOPNOTSUPP;
7584         }
7585
7586         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7587
7588         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
7589 }
7590
7591 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
7592 {
7593         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7594         struct wireless_dev *wdev;
7595         struct net_device *dev = info->user_ptr[1];
7596         u8 ps_state;
7597         bool state;
7598         int err;
7599
7600         if (!info->attrs[NL80211_ATTR_PS_STATE])
7601                 return -EINVAL;
7602
7603         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
7604
7605         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
7606                 return -EINVAL;
7607
7608         wdev = dev->ieee80211_ptr;
7609
7610         if (!rdev->ops->set_power_mgmt)
7611                 return -EOPNOTSUPP;
7612
7613         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
7614
7615         if (state == wdev->ps)
7616                 return 0;
7617
7618         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
7619         if (!err)
7620                 wdev->ps = state;
7621         return err;
7622 }
7623
7624 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
7625 {
7626         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7627         enum nl80211_ps_state ps_state;
7628         struct wireless_dev *wdev;
7629         struct net_device *dev = info->user_ptr[1];
7630         struct sk_buff *msg;
7631         void *hdr;
7632         int err;
7633
7634         wdev = dev->ieee80211_ptr;
7635
7636         if (!rdev->ops->set_power_mgmt)
7637                 return -EOPNOTSUPP;
7638
7639         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7640         if (!msg)
7641                 return -ENOMEM;
7642
7643         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7644                              NL80211_CMD_GET_POWER_SAVE);
7645         if (!hdr) {
7646                 err = -ENOBUFS;
7647                 goto free_msg;
7648         }
7649
7650         if (wdev->ps)
7651                 ps_state = NL80211_PS_ENABLED;
7652         else
7653                 ps_state = NL80211_PS_DISABLED;
7654
7655         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
7656                 goto nla_put_failure;
7657
7658         genlmsg_end(msg, hdr);
7659         return genlmsg_reply(msg, info);
7660
7661  nla_put_failure:
7662         err = -ENOBUFS;
7663  free_msg:
7664         nlmsg_free(msg);
7665         return err;
7666 }
7667
7668 static struct nla_policy
7669 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
7670         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
7671         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
7672         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
7673         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
7674         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
7675         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
7676 };
7677
7678 static int nl80211_set_cqm_txe(struct genl_info *info,
7679                                u32 rate, u32 pkts, u32 intvl)
7680 {
7681         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7682         struct net_device *dev = info->user_ptr[1];
7683         struct wireless_dev *wdev = dev->ieee80211_ptr;
7684
7685         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
7686                 return -EINVAL;
7687
7688         if (!rdev->ops->set_cqm_txe_config)
7689                 return -EOPNOTSUPP;
7690
7691         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7692             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7693                 return -EOPNOTSUPP;
7694
7695         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
7696 }
7697
7698 static int nl80211_set_cqm_rssi(struct genl_info *info,
7699                                 s32 threshold, u32 hysteresis)
7700 {
7701         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7702         struct net_device *dev = info->user_ptr[1];
7703         struct wireless_dev *wdev = dev->ieee80211_ptr;
7704
7705         if (threshold > 0)
7706                 return -EINVAL;
7707
7708         /* disabling - hysteresis should also be zero then */
7709         if (threshold == 0)
7710                 hysteresis = 0;
7711
7712         if (!rdev->ops->set_cqm_rssi_config)
7713                 return -EOPNOTSUPP;
7714
7715         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7716             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7717                 return -EOPNOTSUPP;
7718
7719         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
7720 }
7721
7722 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
7723 {
7724         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
7725         struct nlattr *cqm;
7726         int err;
7727
7728         cqm = info->attrs[NL80211_ATTR_CQM];
7729         if (!cqm)
7730                 return -EINVAL;
7731
7732         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
7733                                nl80211_attr_cqm_policy);
7734         if (err)
7735                 return err;
7736
7737         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
7738             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
7739                 s32 threshold = nla_get_s32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
7740                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
7741
7742                 return nl80211_set_cqm_rssi(info, threshold, hysteresis);
7743         }
7744
7745         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
7746             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
7747             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
7748                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
7749                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
7750                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
7751
7752                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
7753         }
7754
7755         return -EINVAL;
7756 }
7757
7758 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
7759 {
7760         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7761         struct net_device *dev = info->user_ptr[1];
7762         struct mesh_config cfg;
7763         struct mesh_setup setup;
7764         int err;
7765
7766         /* start with default */
7767         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
7768         memcpy(&setup, &default_mesh_setup, sizeof(setup));
7769
7770         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
7771                 /* and parse parameters if given */
7772                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
7773                 if (err)
7774                         return err;
7775         }
7776
7777         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
7778             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
7779                 return -EINVAL;
7780
7781         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
7782         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
7783
7784         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
7785             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
7786                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
7787                         return -EINVAL;
7788
7789         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
7790                 setup.beacon_interval =
7791                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
7792                 if (setup.beacon_interval < 10 ||
7793                     setup.beacon_interval > 10000)
7794                         return -EINVAL;
7795         }
7796
7797         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
7798                 setup.dtim_period =
7799                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
7800                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
7801                         return -EINVAL;
7802         }
7803
7804         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
7805                 /* parse additional setup parameters if given */
7806                 err = nl80211_parse_mesh_setup(info, &setup);
7807                 if (err)
7808                         return err;
7809         }
7810
7811         if (setup.user_mpm)
7812                 cfg.auto_open_plinks = false;
7813
7814         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7815                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
7816                 if (err)
7817                         return err;
7818         } else {
7819                 /* cfg80211_join_mesh() will sort it out */
7820                 setup.chandef.chan = NULL;
7821         }
7822
7823         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
7824                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7825                 int n_rates =
7826                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7827                 struct ieee80211_supported_band *sband;
7828
7829                 if (!setup.chandef.chan)
7830                         return -EINVAL;
7831
7832                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
7833
7834                 err = ieee80211_get_ratemask(sband, rates, n_rates,
7835                                              &setup.basic_rates);
7836                 if (err)
7837                         return err;
7838         }
7839
7840         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
7841 }
7842
7843 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
7844 {
7845         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7846         struct net_device *dev = info->user_ptr[1];
7847
7848         return cfg80211_leave_mesh(rdev, dev);
7849 }
7850
7851 #ifdef CONFIG_PM
7852 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
7853                                         struct cfg80211_registered_device *rdev)
7854 {
7855         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
7856         struct nlattr *nl_pats, *nl_pat;
7857         int i, pat_len;
7858
7859         if (!wowlan->n_patterns)
7860                 return 0;
7861
7862         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
7863         if (!nl_pats)
7864                 return -ENOBUFS;
7865
7866         for (i = 0; i < wowlan->n_patterns; i++) {
7867                 nl_pat = nla_nest_start(msg, i + 1);
7868                 if (!nl_pat)
7869                         return -ENOBUFS;
7870                 pat_len = wowlan->patterns[i].pattern_len;
7871                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
7872                             wowlan->patterns[i].mask) ||
7873                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
7874                             wowlan->patterns[i].pattern) ||
7875                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
7876                                 wowlan->patterns[i].pkt_offset))
7877                         return -ENOBUFS;
7878                 nla_nest_end(msg, nl_pat);
7879         }
7880         nla_nest_end(msg, nl_pats);
7881
7882         return 0;
7883 }
7884
7885 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
7886                                    struct cfg80211_wowlan_tcp *tcp)
7887 {
7888         struct nlattr *nl_tcp;
7889
7890         if (!tcp)
7891                 return 0;
7892
7893         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
7894         if (!nl_tcp)
7895                 return -ENOBUFS;
7896
7897         if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
7898             nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
7899             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
7900             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
7901             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
7902             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
7903                     tcp->payload_len, tcp->payload) ||
7904             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
7905                         tcp->data_interval) ||
7906             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
7907                     tcp->wake_len, tcp->wake_data) ||
7908             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
7909                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
7910                 return -ENOBUFS;
7911
7912         if (tcp->payload_seq.len &&
7913             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
7914                     sizeof(tcp->payload_seq), &tcp->payload_seq))
7915                 return -ENOBUFS;
7916
7917         if (tcp->payload_tok.len &&
7918             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
7919                     sizeof(tcp->payload_tok) + tcp->tokens_size,
7920                     &tcp->payload_tok))
7921                 return -ENOBUFS;
7922
7923         nla_nest_end(msg, nl_tcp);
7924
7925         return 0;
7926 }
7927
7928 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
7929 {
7930         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7931         struct sk_buff *msg;
7932         void *hdr;
7933         u32 size = NLMSG_DEFAULT_SIZE;
7934
7935         if (!rdev->wiphy.wowlan)
7936                 return -EOPNOTSUPP;
7937
7938         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
7939                 /* adjust size to have room for all the data */
7940                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
7941                         rdev->wiphy.wowlan_config->tcp->payload_len +
7942                         rdev->wiphy.wowlan_config->tcp->wake_len +
7943                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
7944         }
7945
7946         msg = nlmsg_new(size, GFP_KERNEL);
7947         if (!msg)
7948                 return -ENOMEM;
7949
7950         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7951                              NL80211_CMD_GET_WOWLAN);
7952         if (!hdr)
7953                 goto nla_put_failure;
7954
7955         if (rdev->wiphy.wowlan_config) {
7956                 struct nlattr *nl_wowlan;
7957
7958                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
7959                 if (!nl_wowlan)
7960                         goto nla_put_failure;
7961
7962                 if ((rdev->wiphy.wowlan_config->any &&
7963                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
7964                     (rdev->wiphy.wowlan_config->disconnect &&
7965                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
7966                     (rdev->wiphy.wowlan_config->magic_pkt &&
7967                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
7968                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
7969                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
7970                     (rdev->wiphy.wowlan_config->eap_identity_req &&
7971                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
7972                     (rdev->wiphy.wowlan_config->four_way_handshake &&
7973                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
7974                     (rdev->wiphy.wowlan_config->rfkill_release &&
7975                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
7976                         goto nla_put_failure;
7977
7978                 if (nl80211_send_wowlan_patterns(msg, rdev))
7979                         goto nla_put_failure;
7980
7981                 if (nl80211_send_wowlan_tcp(msg,
7982                                             rdev->wiphy.wowlan_config->tcp))
7983                         goto nla_put_failure;
7984
7985                 nla_nest_end(msg, nl_wowlan);
7986         }
7987
7988         genlmsg_end(msg, hdr);
7989         return genlmsg_reply(msg, info);
7990
7991 nla_put_failure:
7992         nlmsg_free(msg);
7993         return -ENOBUFS;
7994 }
7995
7996 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
7997                                     struct nlattr *attr,
7998                                     struct cfg80211_wowlan *trig)
7999 {
8000         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
8001         struct cfg80211_wowlan_tcp *cfg;
8002         struct nl80211_wowlan_tcp_data_token *tok = NULL;
8003         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
8004         u32 size;
8005         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
8006         int err, port;
8007
8008         if (!rdev->wiphy.wowlan->tcp)
8009                 return -EINVAL;
8010
8011         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
8012                         nla_data(attr), nla_len(attr),
8013                         nl80211_wowlan_tcp_policy);
8014         if (err)
8015                 return err;
8016
8017         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
8018             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
8019             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
8020             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
8021             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
8022             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
8023             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
8024             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
8025                 return -EINVAL;
8026
8027         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
8028         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
8029                 return -EINVAL;
8030
8031         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
8032                         rdev->wiphy.wowlan->tcp->data_interval_max ||
8033             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
8034                 return -EINVAL;
8035
8036         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
8037         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
8038                 return -EINVAL;
8039
8040         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
8041         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
8042                 return -EINVAL;
8043
8044         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
8045                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
8046
8047                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
8048                 tokens_size = tokln - sizeof(*tok);
8049
8050                 if (!tok->len || tokens_size % tok->len)
8051                         return -EINVAL;
8052                 if (!rdev->wiphy.wowlan->tcp->tok)
8053                         return -EINVAL;
8054                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
8055                         return -EINVAL;
8056                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
8057                         return -EINVAL;
8058                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
8059                         return -EINVAL;
8060                 if (tok->offset + tok->len > data_size)
8061                         return -EINVAL;
8062         }
8063
8064         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
8065                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
8066                 if (!rdev->wiphy.wowlan->tcp->seq)
8067                         return -EINVAL;
8068                 if (seq->len == 0 || seq->len > 4)
8069                         return -EINVAL;
8070                 if (seq->len + seq->offset > data_size)
8071                         return -EINVAL;
8072         }
8073
8074         size = sizeof(*cfg);
8075         size += data_size;
8076         size += wake_size + wake_mask_size;
8077         size += tokens_size;
8078
8079         cfg = kzalloc(size, GFP_KERNEL);
8080         if (!cfg)
8081                 return -ENOMEM;
8082         cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
8083         cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
8084         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
8085                ETH_ALEN);
8086         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
8087                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
8088         else
8089                 port = 0;
8090 #ifdef CONFIG_INET
8091         /* allocate a socket and port for it and use it */
8092         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
8093                             IPPROTO_TCP, &cfg->sock, 1);
8094         if (err) {
8095                 kfree(cfg);
8096                 return err;
8097         }
8098         if (inet_csk_get_port(cfg->sock->sk, port)) {
8099                 sock_release(cfg->sock);
8100                 kfree(cfg);
8101                 return -EADDRINUSE;
8102         }
8103         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
8104 #else
8105         if (!port) {
8106                 kfree(cfg);
8107                 return -EINVAL;
8108         }
8109         cfg->src_port = port;
8110 #endif
8111
8112         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
8113         cfg->payload_len = data_size;
8114         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
8115         memcpy((void *)cfg->payload,
8116                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
8117                data_size);
8118         if (seq)
8119                 cfg->payload_seq = *seq;
8120         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
8121         cfg->wake_len = wake_size;
8122         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
8123         memcpy((void *)cfg->wake_data,
8124                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
8125                wake_size);
8126         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
8127                          data_size + wake_size;
8128         memcpy((void *)cfg->wake_mask,
8129                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
8130                wake_mask_size);
8131         if (tok) {
8132                 cfg->tokens_size = tokens_size;
8133                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
8134         }
8135
8136         trig->tcp = cfg;
8137
8138         return 0;
8139 }
8140
8141 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
8142 {
8143         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8144         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
8145         struct cfg80211_wowlan new_triggers = {};
8146         struct cfg80211_wowlan *ntrig;
8147         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
8148         int err, i;
8149         bool prev_enabled = rdev->wiphy.wowlan_config;
8150
8151         if (!wowlan)
8152                 return -EOPNOTSUPP;
8153
8154         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
8155                 cfg80211_rdev_free_wowlan(rdev);
8156                 rdev->wiphy.wowlan_config = NULL;
8157                 goto set_wakeup;
8158         }
8159
8160         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
8161                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
8162                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
8163                         nl80211_wowlan_policy);
8164         if (err)
8165                 return err;
8166
8167         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
8168                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
8169                         return -EINVAL;
8170                 new_triggers.any = true;
8171         }
8172
8173         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
8174                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
8175                         return -EINVAL;
8176                 new_triggers.disconnect = true;
8177         }
8178
8179         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
8180                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
8181                         return -EINVAL;
8182                 new_triggers.magic_pkt = true;
8183         }
8184
8185         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
8186                 return -EINVAL;
8187
8188         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
8189                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
8190                         return -EINVAL;
8191                 new_triggers.gtk_rekey_failure = true;
8192         }
8193
8194         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
8195                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
8196                         return -EINVAL;
8197                 new_triggers.eap_identity_req = true;
8198         }
8199
8200         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
8201                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
8202                         return -EINVAL;
8203                 new_triggers.four_way_handshake = true;
8204         }
8205
8206         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
8207                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
8208                         return -EINVAL;
8209                 new_triggers.rfkill_release = true;
8210         }
8211
8212         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
8213                 struct nlattr *pat;
8214                 int n_patterns = 0;
8215                 int rem, pat_len, mask_len, pkt_offset;
8216                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
8217
8218                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
8219                                     rem)
8220                         n_patterns++;
8221                 if (n_patterns > wowlan->n_patterns)
8222                         return -EINVAL;
8223
8224                 new_triggers.patterns = kcalloc(n_patterns,
8225                                                 sizeof(new_triggers.patterns[0]),
8226                                                 GFP_KERNEL);
8227                 if (!new_triggers.patterns)
8228                         return -ENOMEM;
8229
8230                 new_triggers.n_patterns = n_patterns;
8231                 i = 0;
8232
8233                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
8234                                     rem) {
8235                         nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
8236                                   nla_len(pat), NULL);
8237                         err = -EINVAL;
8238                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
8239                             !pat_tb[NL80211_PKTPAT_PATTERN])
8240                                 goto error;
8241                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
8242                         mask_len = DIV_ROUND_UP(pat_len, 8);
8243                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
8244                                 goto error;
8245                         if (pat_len > wowlan->pattern_max_len ||
8246                             pat_len < wowlan->pattern_min_len)
8247                                 goto error;
8248
8249                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
8250                                 pkt_offset = 0;
8251                         else
8252                                 pkt_offset = nla_get_u32(
8253                                         pat_tb[NL80211_PKTPAT_OFFSET]);
8254                         if (pkt_offset > wowlan->max_pkt_offset)
8255                                 goto error;
8256                         new_triggers.patterns[i].pkt_offset = pkt_offset;
8257
8258                         new_triggers.patterns[i].mask =
8259                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
8260                         if (!new_triggers.patterns[i].mask) {
8261                                 err = -ENOMEM;
8262                                 goto error;
8263                         }
8264                         new_triggers.patterns[i].pattern =
8265                                 new_triggers.patterns[i].mask + mask_len;
8266                         memcpy(new_triggers.patterns[i].mask,
8267                                nla_data(pat_tb[NL80211_PKTPAT_MASK]),
8268                                mask_len);
8269                         new_triggers.patterns[i].pattern_len = pat_len;
8270                         memcpy(new_triggers.patterns[i].pattern,
8271                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
8272                                pat_len);
8273                         i++;
8274                 }
8275         }
8276
8277         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
8278                 err = nl80211_parse_wowlan_tcp(
8279                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
8280                         &new_triggers);
8281                 if (err)
8282                         goto error;
8283         }
8284
8285         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
8286         if (!ntrig) {
8287                 err = -ENOMEM;
8288                 goto error;
8289         }
8290         cfg80211_rdev_free_wowlan(rdev);
8291         rdev->wiphy.wowlan_config = ntrig;
8292
8293  set_wakeup:
8294         if (rdev->ops->set_wakeup &&
8295             prev_enabled != !!rdev->wiphy.wowlan_config)
8296                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
8297
8298         return 0;
8299  error:
8300         for (i = 0; i < new_triggers.n_patterns; i++)
8301                 kfree(new_triggers.patterns[i].mask);
8302         kfree(new_triggers.patterns);
8303         if (new_triggers.tcp && new_triggers.tcp->sock)
8304                 sock_release(new_triggers.tcp->sock);
8305         kfree(new_triggers.tcp);
8306         return err;
8307 }
8308 #endif
8309
8310 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
8311                                        struct cfg80211_registered_device *rdev)
8312 {
8313         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
8314         int i, j, pat_len;
8315         struct cfg80211_coalesce_rules *rule;
8316
8317         if (!rdev->coalesce->n_rules)
8318                 return 0;
8319
8320         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
8321         if (!nl_rules)
8322                 return -ENOBUFS;
8323
8324         for (i = 0; i < rdev->coalesce->n_rules; i++) {
8325                 nl_rule = nla_nest_start(msg, i + 1);
8326                 if (!nl_rule)
8327                         return -ENOBUFS;
8328
8329                 rule = &rdev->coalesce->rules[i];
8330                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
8331                                 rule->delay))
8332                         return -ENOBUFS;
8333
8334                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
8335                                 rule->condition))
8336                         return -ENOBUFS;
8337
8338                 nl_pats = nla_nest_start(msg,
8339                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
8340                 if (!nl_pats)
8341                         return -ENOBUFS;
8342
8343                 for (j = 0; j < rule->n_patterns; j++) {
8344                         nl_pat = nla_nest_start(msg, j + 1);
8345                         if (!nl_pat)
8346                                 return -ENOBUFS;
8347                         pat_len = rule->patterns[j].pattern_len;
8348                         if (nla_put(msg, NL80211_PKTPAT_MASK,
8349                                     DIV_ROUND_UP(pat_len, 8),
8350                                     rule->patterns[j].mask) ||
8351                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
8352                                     rule->patterns[j].pattern) ||
8353                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
8354                                         rule->patterns[j].pkt_offset))
8355                                 return -ENOBUFS;
8356                         nla_nest_end(msg, nl_pat);
8357                 }
8358                 nla_nest_end(msg, nl_pats);
8359                 nla_nest_end(msg, nl_rule);
8360         }
8361         nla_nest_end(msg, nl_rules);
8362
8363         return 0;
8364 }
8365
8366 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
8367 {
8368         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8369         struct sk_buff *msg;
8370         void *hdr;
8371
8372         if (!rdev->wiphy.coalesce)
8373                 return -EOPNOTSUPP;
8374
8375         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8376         if (!msg)
8377                 return -ENOMEM;
8378
8379         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8380                              NL80211_CMD_GET_COALESCE);
8381         if (!hdr)
8382                 goto nla_put_failure;
8383
8384         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
8385                 goto nla_put_failure;
8386
8387         genlmsg_end(msg, hdr);
8388         return genlmsg_reply(msg, info);
8389
8390 nla_put_failure:
8391         nlmsg_free(msg);
8392         return -ENOBUFS;
8393 }
8394
8395 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
8396 {
8397         struct cfg80211_coalesce *coalesce = rdev->coalesce;
8398         int i, j;
8399         struct cfg80211_coalesce_rules *rule;
8400
8401         if (!coalesce)
8402                 return;
8403
8404         for (i = 0; i < coalesce->n_rules; i++) {
8405                 rule = &coalesce->rules[i];
8406                 for (j = 0; j < rule->n_patterns; j++)
8407                         kfree(rule->patterns[j].mask);
8408                 kfree(rule->patterns);
8409         }
8410         kfree(coalesce->rules);
8411         kfree(coalesce);
8412         rdev->coalesce = NULL;
8413 }
8414
8415 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
8416                                        struct nlattr *rule,
8417                                        struct cfg80211_coalesce_rules *new_rule)
8418 {
8419         int err, i;
8420         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
8421         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
8422         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
8423         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
8424
8425         err = nla_parse(tb, NL80211_ATTR_COALESCE_RULE_MAX, nla_data(rule),
8426                         nla_len(rule), nl80211_coalesce_policy);
8427         if (err)
8428                 return err;
8429
8430         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
8431                 new_rule->delay =
8432                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
8433         if (new_rule->delay > coalesce->max_delay)
8434                 return -EINVAL;
8435
8436         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
8437                 new_rule->condition =
8438                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
8439         if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
8440             new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
8441                 return -EINVAL;
8442
8443         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
8444                 return -EINVAL;
8445
8446         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
8447                             rem)
8448                 n_patterns++;
8449         if (n_patterns > coalesce->n_patterns)
8450                 return -EINVAL;
8451
8452         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
8453                                      GFP_KERNEL);
8454         if (!new_rule->patterns)
8455                 return -ENOMEM;
8456
8457         new_rule->n_patterns = n_patterns;
8458         i = 0;
8459
8460         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
8461                             rem) {
8462                 nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
8463                           nla_len(pat), NULL);
8464                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
8465                     !pat_tb[NL80211_PKTPAT_PATTERN])
8466                         return -EINVAL;
8467                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
8468                 mask_len = DIV_ROUND_UP(pat_len, 8);
8469                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
8470                         return -EINVAL;
8471                 if (pat_len > coalesce->pattern_max_len ||
8472                     pat_len < coalesce->pattern_min_len)
8473                         return -EINVAL;
8474
8475                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
8476                         pkt_offset = 0;
8477                 else
8478                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
8479                 if (pkt_offset > coalesce->max_pkt_offset)
8480                         return -EINVAL;
8481                 new_rule->patterns[i].pkt_offset = pkt_offset;
8482
8483                 new_rule->patterns[i].mask =
8484                         kmalloc(mask_len + pat_len, GFP_KERNEL);
8485                 if (!new_rule->patterns[i].mask)
8486                         return -ENOMEM;
8487                 new_rule->patterns[i].pattern =
8488                         new_rule->patterns[i].mask + mask_len;
8489                 memcpy(new_rule->patterns[i].mask,
8490                        nla_data(pat_tb[NL80211_PKTPAT_MASK]), mask_len);
8491                 new_rule->patterns[i].pattern_len = pat_len;
8492                 memcpy(new_rule->patterns[i].pattern,
8493                        nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), pat_len);
8494                 i++;
8495         }
8496
8497         return 0;
8498 }
8499
8500 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
8501 {
8502         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8503         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
8504         struct cfg80211_coalesce new_coalesce = {};
8505         struct cfg80211_coalesce *n_coalesce;
8506         int err, rem_rule, n_rules = 0, i, j;
8507         struct nlattr *rule;
8508         struct cfg80211_coalesce_rules *tmp_rule;
8509
8510         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
8511                 return -EOPNOTSUPP;
8512
8513         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
8514                 cfg80211_rdev_free_coalesce(rdev);
8515                 rdev->ops->set_coalesce(&rdev->wiphy, NULL);
8516                 return 0;
8517         }
8518
8519         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
8520                             rem_rule)
8521                 n_rules++;
8522         if (n_rules > coalesce->n_rules)
8523                 return -EINVAL;
8524
8525         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
8526                                      GFP_KERNEL);
8527         if (!new_coalesce.rules)
8528                 return -ENOMEM;
8529
8530         new_coalesce.n_rules = n_rules;
8531         i = 0;
8532
8533         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
8534                             rem_rule) {
8535                 err = nl80211_parse_coalesce_rule(rdev, rule,
8536                                                   &new_coalesce.rules[i]);
8537                 if (err)
8538                         goto error;
8539
8540                 i++;
8541         }
8542
8543         err = rdev->ops->set_coalesce(&rdev->wiphy, &new_coalesce);
8544         if (err)
8545                 goto error;
8546
8547         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
8548         if (!n_coalesce) {
8549                 err = -ENOMEM;
8550                 goto error;
8551         }
8552         cfg80211_rdev_free_coalesce(rdev);
8553         rdev->coalesce = n_coalesce;
8554
8555         return 0;
8556 error:
8557         for (i = 0; i < new_coalesce.n_rules; i++) {
8558                 tmp_rule = &new_coalesce.rules[i];
8559                 for (j = 0; j < tmp_rule->n_patterns; j++)
8560                         kfree(tmp_rule->patterns[j].mask);
8561                 kfree(tmp_rule->patterns);
8562         }
8563         kfree(new_coalesce.rules);
8564
8565         return err;
8566 }
8567
8568 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
8569 {
8570         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8571         struct net_device *dev = info->user_ptr[1];
8572         struct wireless_dev *wdev = dev->ieee80211_ptr;
8573         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
8574         struct cfg80211_gtk_rekey_data rekey_data;
8575         int err;
8576
8577         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
8578                 return -EINVAL;
8579
8580         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
8581                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
8582                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
8583                         nl80211_rekey_policy);
8584         if (err)
8585                 return err;
8586
8587         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
8588                 return -ERANGE;
8589         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
8590                 return -ERANGE;
8591         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
8592                 return -ERANGE;
8593
8594         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
8595                NL80211_KEK_LEN);
8596         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
8597                NL80211_KCK_LEN);
8598         memcpy(rekey_data.replay_ctr,
8599                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
8600                NL80211_REPLAY_CTR_LEN);
8601
8602         wdev_lock(wdev);
8603         if (!wdev->current_bss) {
8604                 err = -ENOTCONN;
8605                 goto out;
8606         }
8607
8608         if (!rdev->ops->set_rekey_data) {
8609                 err = -EOPNOTSUPP;
8610                 goto out;
8611         }
8612
8613         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
8614  out:
8615         wdev_unlock(wdev);
8616         return err;
8617 }
8618
8619 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
8620                                              struct genl_info *info)
8621 {
8622         struct net_device *dev = info->user_ptr[1];
8623         struct wireless_dev *wdev = dev->ieee80211_ptr;
8624
8625         if (wdev->iftype != NL80211_IFTYPE_AP &&
8626             wdev->iftype != NL80211_IFTYPE_P2P_GO)
8627                 return -EINVAL;
8628
8629         if (wdev->ap_unexpected_nlportid)
8630                 return -EBUSY;
8631
8632         wdev->ap_unexpected_nlportid = info->snd_portid;
8633         return 0;
8634 }
8635
8636 static int nl80211_probe_client(struct sk_buff *skb,
8637                                 struct genl_info *info)
8638 {
8639         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8640         struct net_device *dev = info->user_ptr[1];
8641         struct wireless_dev *wdev = dev->ieee80211_ptr;
8642         struct sk_buff *msg;
8643         void *hdr;
8644         const u8 *addr;
8645         u64 cookie;
8646         int err;
8647
8648         if (wdev->iftype != NL80211_IFTYPE_AP &&
8649             wdev->iftype != NL80211_IFTYPE_P2P_GO)
8650                 return -EOPNOTSUPP;
8651
8652         if (!info->attrs[NL80211_ATTR_MAC])
8653                 return -EINVAL;
8654
8655         if (!rdev->ops->probe_client)
8656                 return -EOPNOTSUPP;
8657
8658         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8659         if (!msg)
8660                 return -ENOMEM;
8661
8662         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8663                              NL80211_CMD_PROBE_CLIENT);
8664         if (!hdr) {
8665                 err = -ENOBUFS;
8666                 goto free_msg;
8667         }
8668
8669         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
8670
8671         err = rdev_probe_client(rdev, dev, addr, &cookie);
8672         if (err)
8673                 goto free_msg;
8674
8675         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8676                 goto nla_put_failure;
8677
8678         genlmsg_end(msg, hdr);
8679
8680         return genlmsg_reply(msg, info);
8681
8682  nla_put_failure:
8683         err = -ENOBUFS;
8684  free_msg:
8685         nlmsg_free(msg);
8686         return err;
8687 }
8688
8689 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
8690 {
8691         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8692         struct cfg80211_beacon_registration *reg, *nreg;
8693         int rv;
8694
8695         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
8696                 return -EOPNOTSUPP;
8697
8698         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
8699         if (!nreg)
8700                 return -ENOMEM;
8701
8702         /* First, check if already registered. */
8703         spin_lock_bh(&rdev->beacon_registrations_lock);
8704         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
8705                 if (reg->nlportid == info->snd_portid) {
8706                         rv = -EALREADY;
8707                         goto out_err;
8708                 }
8709         }
8710         /* Add it to the list */
8711         nreg->nlportid = info->snd_portid;
8712         list_add(&nreg->list, &rdev->beacon_registrations);
8713
8714         spin_unlock_bh(&rdev->beacon_registrations_lock);
8715
8716         return 0;
8717 out_err:
8718         spin_unlock_bh(&rdev->beacon_registrations_lock);
8719         kfree(nreg);
8720         return rv;
8721 }
8722
8723 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
8724 {
8725         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8726         struct wireless_dev *wdev = info->user_ptr[1];
8727         int err;
8728
8729         if (!rdev->ops->start_p2p_device)
8730                 return -EOPNOTSUPP;
8731
8732         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
8733                 return -EOPNOTSUPP;
8734
8735         if (wdev->p2p_started)
8736                 return 0;
8737
8738         err = cfg80211_can_add_interface(rdev, wdev->iftype);
8739         if (err)
8740                 return err;
8741
8742         err = rdev_start_p2p_device(rdev, wdev);
8743         if (err)
8744                 return err;
8745
8746         wdev->p2p_started = true;
8747         rdev->opencount++;
8748
8749         return 0;
8750 }
8751
8752 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
8753 {
8754         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8755         struct wireless_dev *wdev = info->user_ptr[1];
8756
8757         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
8758                 return -EOPNOTSUPP;
8759
8760         if (!rdev->ops->stop_p2p_device)
8761                 return -EOPNOTSUPP;
8762
8763         cfg80211_stop_p2p_device(rdev, wdev);
8764
8765         return 0;
8766 }
8767
8768 static int nl80211_get_protocol_features(struct sk_buff *skb,
8769                                          struct genl_info *info)
8770 {
8771         void *hdr;
8772         struct sk_buff *msg;
8773
8774         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8775         if (!msg)
8776                 return -ENOMEM;
8777
8778         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8779                              NL80211_CMD_GET_PROTOCOL_FEATURES);
8780         if (!hdr)
8781                 goto nla_put_failure;
8782
8783         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
8784                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
8785                 goto nla_put_failure;
8786
8787         genlmsg_end(msg, hdr);
8788         return genlmsg_reply(msg, info);
8789
8790  nla_put_failure:
8791         kfree_skb(msg);
8792         return -ENOBUFS;
8793 }
8794
8795 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
8796 {
8797         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8798         struct cfg80211_update_ft_ies_params ft_params;
8799         struct net_device *dev = info->user_ptr[1];
8800
8801         if (!rdev->ops->update_ft_ies)
8802                 return -EOPNOTSUPP;
8803
8804         if (!info->attrs[NL80211_ATTR_MDID] ||
8805             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8806                 return -EINVAL;
8807
8808         memset(&ft_params, 0, sizeof(ft_params));
8809         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
8810         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8811         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8812
8813         return rdev_update_ft_ies(rdev, dev, &ft_params);
8814 }
8815
8816 static int nl80211_crit_protocol_start(struct sk_buff *skb,
8817                                        struct genl_info *info)
8818 {
8819         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8820         struct wireless_dev *wdev = info->user_ptr[1];
8821         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
8822         u16 duration;
8823         int ret;
8824
8825         if (!rdev->ops->crit_proto_start)
8826                 return -EOPNOTSUPP;
8827
8828         if (WARN_ON(!rdev->ops->crit_proto_stop))
8829                 return -EINVAL;
8830
8831         if (rdev->crit_proto_nlportid)
8832                 return -EBUSY;
8833
8834         /* determine protocol if provided */
8835         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
8836                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
8837
8838         if (proto >= NUM_NL80211_CRIT_PROTO)
8839                 return -EINVAL;
8840
8841         /* timeout must be provided */
8842         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
8843                 return -EINVAL;
8844
8845         duration =
8846                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
8847
8848         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
8849                 return -ERANGE;
8850
8851         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
8852         if (!ret)
8853                 rdev->crit_proto_nlportid = info->snd_portid;
8854
8855         return ret;
8856 }
8857
8858 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
8859                                       struct genl_info *info)
8860 {
8861         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8862         struct wireless_dev *wdev = info->user_ptr[1];
8863
8864         if (!rdev->ops->crit_proto_stop)
8865                 return -EOPNOTSUPP;
8866
8867         if (rdev->crit_proto_nlportid) {
8868                 rdev->crit_proto_nlportid = 0;
8869                 rdev_crit_proto_stop(rdev, wdev);
8870         }
8871         return 0;
8872 }
8873
8874 #define NL80211_FLAG_NEED_WIPHY         0x01
8875 #define NL80211_FLAG_NEED_NETDEV        0x02
8876 #define NL80211_FLAG_NEED_RTNL          0x04
8877 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
8878 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
8879                                          NL80211_FLAG_CHECK_NETDEV_UP)
8880 #define NL80211_FLAG_NEED_WDEV          0x10
8881 /* If a netdev is associated, it must be UP, P2P must be started */
8882 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
8883                                          NL80211_FLAG_CHECK_NETDEV_UP)
8884
8885 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
8886                             struct genl_info *info)
8887 {
8888         struct cfg80211_registered_device *rdev;
8889         struct wireless_dev *wdev;
8890         struct net_device *dev;
8891         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
8892
8893         if (rtnl)
8894                 rtnl_lock();
8895
8896         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
8897                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
8898                 if (IS_ERR(rdev)) {
8899                         if (rtnl)
8900                                 rtnl_unlock();
8901                         return PTR_ERR(rdev);
8902                 }
8903                 info->user_ptr[0] = rdev;
8904         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
8905                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
8906                 ASSERT_RTNL();
8907
8908                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
8909                                                   info->attrs);
8910                 if (IS_ERR(wdev)) {
8911                         if (rtnl)
8912                                 rtnl_unlock();
8913                         return PTR_ERR(wdev);
8914                 }
8915
8916                 dev = wdev->netdev;
8917                 rdev = wiphy_to_dev(wdev->wiphy);
8918
8919                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
8920                         if (!dev) {
8921                                 if (rtnl)
8922                                         rtnl_unlock();
8923                                 return -EINVAL;
8924                         }
8925
8926                         info->user_ptr[1] = dev;
8927                 } else {
8928                         info->user_ptr[1] = wdev;
8929                 }
8930
8931                 if (dev) {
8932                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
8933                             !netif_running(dev)) {
8934                                 if (rtnl)
8935                                         rtnl_unlock();
8936                                 return -ENETDOWN;
8937                         }
8938
8939                         dev_hold(dev);
8940                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
8941                         if (!wdev->p2p_started) {
8942                                 if (rtnl)
8943                                         rtnl_unlock();
8944                                 return -ENETDOWN;
8945                         }
8946                 }
8947
8948                 info->user_ptr[0] = rdev;
8949         }
8950
8951         return 0;
8952 }
8953
8954 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
8955                               struct genl_info *info)
8956 {
8957         if (info->user_ptr[1]) {
8958                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
8959                         struct wireless_dev *wdev = info->user_ptr[1];
8960
8961                         if (wdev->netdev)
8962                                 dev_put(wdev->netdev);
8963                 } else {
8964                         dev_put(info->user_ptr[1]);
8965                 }
8966         }
8967         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
8968                 rtnl_unlock();
8969 }
8970
8971 static const struct genl_ops nl80211_ops[] = {
8972         {
8973                 .cmd = NL80211_CMD_GET_WIPHY,
8974                 .doit = nl80211_get_wiphy,
8975                 .dumpit = nl80211_dump_wiphy,
8976                 .done = nl80211_dump_wiphy_done,
8977                 .policy = nl80211_policy,
8978                 /* can be retrieved by unprivileged users */
8979                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8980                                   NL80211_FLAG_NEED_RTNL,
8981         },
8982         {
8983                 .cmd = NL80211_CMD_SET_WIPHY,
8984                 .doit = nl80211_set_wiphy,
8985                 .policy = nl80211_policy,
8986                 .flags = GENL_ADMIN_PERM,
8987                 .internal_flags = NL80211_FLAG_NEED_RTNL,
8988         },
8989         {
8990                 .cmd = NL80211_CMD_GET_INTERFACE,
8991                 .doit = nl80211_get_interface,
8992                 .dumpit = nl80211_dump_interface,
8993                 .policy = nl80211_policy,
8994                 /* can be retrieved by unprivileged users */
8995                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8996                                   NL80211_FLAG_NEED_RTNL,
8997         },
8998         {
8999                 .cmd = NL80211_CMD_SET_INTERFACE,
9000                 .doit = nl80211_set_interface,
9001                 .policy = nl80211_policy,
9002                 .flags = GENL_ADMIN_PERM,
9003                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9004                                   NL80211_FLAG_NEED_RTNL,
9005         },
9006         {
9007                 .cmd = NL80211_CMD_NEW_INTERFACE,
9008                 .doit = nl80211_new_interface,
9009                 .policy = nl80211_policy,
9010                 .flags = GENL_ADMIN_PERM,
9011                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9012                                   NL80211_FLAG_NEED_RTNL,
9013         },
9014         {
9015                 .cmd = NL80211_CMD_DEL_INTERFACE,
9016                 .doit = nl80211_del_interface,
9017                 .policy = nl80211_policy,
9018                 .flags = GENL_ADMIN_PERM,
9019                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9020                                   NL80211_FLAG_NEED_RTNL,
9021         },
9022         {
9023                 .cmd = NL80211_CMD_GET_KEY,
9024                 .doit = nl80211_get_key,
9025                 .policy = nl80211_policy,
9026                 .flags = GENL_ADMIN_PERM,
9027                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9028                                   NL80211_FLAG_NEED_RTNL,
9029         },
9030         {
9031                 .cmd = NL80211_CMD_SET_KEY,
9032                 .doit = nl80211_set_key,
9033                 .policy = nl80211_policy,
9034                 .flags = GENL_ADMIN_PERM,
9035                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9036                                   NL80211_FLAG_NEED_RTNL,
9037         },
9038         {
9039                 .cmd = NL80211_CMD_NEW_KEY,
9040                 .doit = nl80211_new_key,
9041                 .policy = nl80211_policy,
9042                 .flags = GENL_ADMIN_PERM,
9043                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9044                                   NL80211_FLAG_NEED_RTNL,
9045         },
9046         {
9047                 .cmd = NL80211_CMD_DEL_KEY,
9048                 .doit = nl80211_del_key,
9049                 .policy = nl80211_policy,
9050                 .flags = GENL_ADMIN_PERM,
9051                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9052                                   NL80211_FLAG_NEED_RTNL,
9053         },
9054         {
9055                 .cmd = NL80211_CMD_SET_BEACON,
9056                 .policy = nl80211_policy,
9057                 .flags = GENL_ADMIN_PERM,
9058                 .doit = nl80211_set_beacon,
9059                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9060                                   NL80211_FLAG_NEED_RTNL,
9061         },
9062         {
9063                 .cmd = NL80211_CMD_START_AP,
9064                 .policy = nl80211_policy,
9065                 .flags = GENL_ADMIN_PERM,
9066                 .doit = nl80211_start_ap,
9067                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9068                                   NL80211_FLAG_NEED_RTNL,
9069         },
9070         {
9071                 .cmd = NL80211_CMD_STOP_AP,
9072                 .policy = nl80211_policy,
9073                 .flags = GENL_ADMIN_PERM,
9074                 .doit = nl80211_stop_ap,
9075                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9076                                   NL80211_FLAG_NEED_RTNL,
9077         },
9078         {
9079                 .cmd = NL80211_CMD_GET_STATION,
9080                 .doit = nl80211_get_station,
9081                 .dumpit = nl80211_dump_station,
9082                 .policy = nl80211_policy,
9083                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9084                                   NL80211_FLAG_NEED_RTNL,
9085         },
9086         {
9087                 .cmd = NL80211_CMD_SET_STATION,
9088                 .doit = nl80211_set_station,
9089                 .policy = nl80211_policy,
9090                 .flags = GENL_ADMIN_PERM,
9091                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9092                                   NL80211_FLAG_NEED_RTNL,
9093         },
9094         {
9095                 .cmd = NL80211_CMD_NEW_STATION,
9096                 .doit = nl80211_new_station,
9097                 .policy = nl80211_policy,
9098                 .flags = GENL_ADMIN_PERM,
9099                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9100                                   NL80211_FLAG_NEED_RTNL,
9101         },
9102         {
9103                 .cmd = NL80211_CMD_DEL_STATION,
9104                 .doit = nl80211_del_station,
9105                 .policy = nl80211_policy,
9106                 .flags = GENL_ADMIN_PERM,
9107                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9108                                   NL80211_FLAG_NEED_RTNL,
9109         },
9110         {
9111                 .cmd = NL80211_CMD_GET_MPATH,
9112                 .doit = nl80211_get_mpath,
9113                 .dumpit = nl80211_dump_mpath,
9114                 .policy = nl80211_policy,
9115                 .flags = GENL_ADMIN_PERM,
9116                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9117                                   NL80211_FLAG_NEED_RTNL,
9118         },
9119         {
9120                 .cmd = NL80211_CMD_SET_MPATH,
9121                 .doit = nl80211_set_mpath,
9122                 .policy = nl80211_policy,
9123                 .flags = GENL_ADMIN_PERM,
9124                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9125                                   NL80211_FLAG_NEED_RTNL,
9126         },
9127         {
9128                 .cmd = NL80211_CMD_NEW_MPATH,
9129                 .doit = nl80211_new_mpath,
9130                 .policy = nl80211_policy,
9131                 .flags = GENL_ADMIN_PERM,
9132                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9133                                   NL80211_FLAG_NEED_RTNL,
9134         },
9135         {
9136                 .cmd = NL80211_CMD_DEL_MPATH,
9137                 .doit = nl80211_del_mpath,
9138                 .policy = nl80211_policy,
9139                 .flags = GENL_ADMIN_PERM,
9140                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9141                                   NL80211_FLAG_NEED_RTNL,
9142         },
9143         {
9144                 .cmd = NL80211_CMD_SET_BSS,
9145                 .doit = nl80211_set_bss,
9146                 .policy = nl80211_policy,
9147                 .flags = GENL_ADMIN_PERM,
9148                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9149                                   NL80211_FLAG_NEED_RTNL,
9150         },
9151         {
9152                 .cmd = NL80211_CMD_GET_REG,
9153                 .doit = nl80211_get_reg,
9154                 .policy = nl80211_policy,
9155                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9156                 /* can be retrieved by unprivileged users */
9157         },
9158         {
9159                 .cmd = NL80211_CMD_SET_REG,
9160                 .doit = nl80211_set_reg,
9161                 .policy = nl80211_policy,
9162                 .flags = GENL_ADMIN_PERM,
9163                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9164         },
9165         {
9166                 .cmd = NL80211_CMD_REQ_SET_REG,
9167                 .doit = nl80211_req_set_reg,
9168                 .policy = nl80211_policy,
9169                 .flags = GENL_ADMIN_PERM,
9170         },
9171         {
9172                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
9173                 .doit = nl80211_get_mesh_config,
9174                 .policy = nl80211_policy,
9175                 /* can be retrieved by unprivileged users */
9176                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9177                                   NL80211_FLAG_NEED_RTNL,
9178         },
9179         {
9180                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
9181                 .doit = nl80211_update_mesh_config,
9182                 .policy = nl80211_policy,
9183                 .flags = GENL_ADMIN_PERM,
9184                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9185                                   NL80211_FLAG_NEED_RTNL,
9186         },
9187         {
9188                 .cmd = NL80211_CMD_TRIGGER_SCAN,
9189                 .doit = nl80211_trigger_scan,
9190                 .policy = nl80211_policy,
9191                 .flags = GENL_ADMIN_PERM,
9192                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9193                                   NL80211_FLAG_NEED_RTNL,
9194         },
9195         {
9196                 .cmd = NL80211_CMD_GET_SCAN,
9197                 .policy = nl80211_policy,
9198                 .dumpit = nl80211_dump_scan,
9199         },
9200         {
9201                 .cmd = NL80211_CMD_START_SCHED_SCAN,
9202                 .doit = nl80211_start_sched_scan,
9203                 .policy = nl80211_policy,
9204                 .flags = GENL_ADMIN_PERM,
9205                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9206                                   NL80211_FLAG_NEED_RTNL,
9207         },
9208         {
9209                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
9210                 .doit = nl80211_stop_sched_scan,
9211                 .policy = nl80211_policy,
9212                 .flags = GENL_ADMIN_PERM,
9213                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9214                                   NL80211_FLAG_NEED_RTNL,
9215         },
9216         {
9217                 .cmd = NL80211_CMD_AUTHENTICATE,
9218                 .doit = nl80211_authenticate,
9219                 .policy = nl80211_policy,
9220                 .flags = GENL_ADMIN_PERM,
9221                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9222                                   NL80211_FLAG_NEED_RTNL,
9223         },
9224         {
9225                 .cmd = NL80211_CMD_ASSOCIATE,
9226                 .doit = nl80211_associate,
9227                 .policy = nl80211_policy,
9228                 .flags = GENL_ADMIN_PERM,
9229                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9230                                   NL80211_FLAG_NEED_RTNL,
9231         },
9232         {
9233                 .cmd = NL80211_CMD_DEAUTHENTICATE,
9234                 .doit = nl80211_deauthenticate,
9235                 .policy = nl80211_policy,
9236                 .flags = GENL_ADMIN_PERM,
9237                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9238                                   NL80211_FLAG_NEED_RTNL,
9239         },
9240         {
9241                 .cmd = NL80211_CMD_DISASSOCIATE,
9242                 .doit = nl80211_disassociate,
9243                 .policy = nl80211_policy,
9244                 .flags = GENL_ADMIN_PERM,
9245                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9246                                   NL80211_FLAG_NEED_RTNL,
9247         },
9248         {
9249                 .cmd = NL80211_CMD_JOIN_IBSS,
9250                 .doit = nl80211_join_ibss,
9251                 .policy = nl80211_policy,
9252                 .flags = GENL_ADMIN_PERM,
9253                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9254                                   NL80211_FLAG_NEED_RTNL,
9255         },
9256         {
9257                 .cmd = NL80211_CMD_LEAVE_IBSS,
9258                 .doit = nl80211_leave_ibss,
9259                 .policy = nl80211_policy,
9260                 .flags = GENL_ADMIN_PERM,
9261                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9262                                   NL80211_FLAG_NEED_RTNL,
9263         },
9264 #ifdef CONFIG_NL80211_TESTMODE
9265         {
9266                 .cmd = NL80211_CMD_TESTMODE,
9267                 .doit = nl80211_testmode_do,
9268                 .dumpit = nl80211_testmode_dump,
9269                 .policy = nl80211_policy,
9270                 .flags = GENL_ADMIN_PERM,
9271                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9272                                   NL80211_FLAG_NEED_RTNL,
9273         },
9274 #endif
9275         {
9276                 .cmd = NL80211_CMD_CONNECT,
9277                 .doit = nl80211_connect,
9278                 .policy = nl80211_policy,
9279                 .flags = GENL_ADMIN_PERM,
9280                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9281                                   NL80211_FLAG_NEED_RTNL,
9282         },
9283         {
9284                 .cmd = NL80211_CMD_DISCONNECT,
9285                 .doit = nl80211_disconnect,
9286                 .policy = nl80211_policy,
9287                 .flags = GENL_ADMIN_PERM,
9288                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9289                                   NL80211_FLAG_NEED_RTNL,
9290         },
9291         {
9292                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
9293                 .doit = nl80211_wiphy_netns,
9294                 .policy = nl80211_policy,
9295                 .flags = GENL_ADMIN_PERM,
9296                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9297                                   NL80211_FLAG_NEED_RTNL,
9298         },
9299         {
9300                 .cmd = NL80211_CMD_GET_SURVEY,
9301                 .policy = nl80211_policy,
9302                 .dumpit = nl80211_dump_survey,
9303         },
9304         {
9305                 .cmd = NL80211_CMD_SET_PMKSA,
9306                 .doit = nl80211_setdel_pmksa,
9307                 .policy = nl80211_policy,
9308                 .flags = GENL_ADMIN_PERM,
9309                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9310                                   NL80211_FLAG_NEED_RTNL,
9311         },
9312         {
9313                 .cmd = NL80211_CMD_DEL_PMKSA,
9314                 .doit = nl80211_setdel_pmksa,
9315                 .policy = nl80211_policy,
9316                 .flags = GENL_ADMIN_PERM,
9317                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9318                                   NL80211_FLAG_NEED_RTNL,
9319         },
9320         {
9321                 .cmd = NL80211_CMD_FLUSH_PMKSA,
9322                 .doit = nl80211_flush_pmksa,
9323                 .policy = nl80211_policy,
9324                 .flags = GENL_ADMIN_PERM,
9325                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9326                                   NL80211_FLAG_NEED_RTNL,
9327         },
9328         {
9329                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
9330                 .doit = nl80211_remain_on_channel,
9331                 .policy = nl80211_policy,
9332                 .flags = GENL_ADMIN_PERM,
9333                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9334                                   NL80211_FLAG_NEED_RTNL,
9335         },
9336         {
9337                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
9338                 .doit = nl80211_cancel_remain_on_channel,
9339                 .policy = nl80211_policy,
9340                 .flags = GENL_ADMIN_PERM,
9341                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9342                                   NL80211_FLAG_NEED_RTNL,
9343         },
9344         {
9345                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
9346                 .doit = nl80211_set_tx_bitrate_mask,
9347                 .policy = nl80211_policy,
9348                 .flags = GENL_ADMIN_PERM,
9349                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9350                                   NL80211_FLAG_NEED_RTNL,
9351         },
9352         {
9353                 .cmd = NL80211_CMD_REGISTER_FRAME,
9354                 .doit = nl80211_register_mgmt,
9355                 .policy = nl80211_policy,
9356                 .flags = GENL_ADMIN_PERM,
9357                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9358                                   NL80211_FLAG_NEED_RTNL,
9359         },
9360         {
9361                 .cmd = NL80211_CMD_FRAME,
9362                 .doit = nl80211_tx_mgmt,
9363                 .policy = nl80211_policy,
9364                 .flags = GENL_ADMIN_PERM,
9365                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9366                                   NL80211_FLAG_NEED_RTNL,
9367         },
9368         {
9369                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
9370                 .doit = nl80211_tx_mgmt_cancel_wait,
9371                 .policy = nl80211_policy,
9372                 .flags = GENL_ADMIN_PERM,
9373                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9374                                   NL80211_FLAG_NEED_RTNL,
9375         },
9376         {
9377                 .cmd = NL80211_CMD_SET_POWER_SAVE,
9378                 .doit = nl80211_set_power_save,
9379                 .policy = nl80211_policy,
9380                 .flags = GENL_ADMIN_PERM,
9381                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9382                                   NL80211_FLAG_NEED_RTNL,
9383         },
9384         {
9385                 .cmd = NL80211_CMD_GET_POWER_SAVE,
9386                 .doit = nl80211_get_power_save,
9387                 .policy = nl80211_policy,
9388                 /* can be retrieved by unprivileged users */
9389                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9390                                   NL80211_FLAG_NEED_RTNL,
9391         },
9392         {
9393                 .cmd = NL80211_CMD_SET_CQM,
9394                 .doit = nl80211_set_cqm,
9395                 .policy = nl80211_policy,
9396                 .flags = GENL_ADMIN_PERM,
9397                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9398                                   NL80211_FLAG_NEED_RTNL,
9399         },
9400         {
9401                 .cmd = NL80211_CMD_SET_CHANNEL,
9402                 .doit = nl80211_set_channel,
9403                 .policy = nl80211_policy,
9404                 .flags = GENL_ADMIN_PERM,
9405                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9406                                   NL80211_FLAG_NEED_RTNL,
9407         },
9408         {
9409                 .cmd = NL80211_CMD_SET_WDS_PEER,
9410                 .doit = nl80211_set_wds_peer,
9411                 .policy = nl80211_policy,
9412                 .flags = GENL_ADMIN_PERM,
9413                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9414                                   NL80211_FLAG_NEED_RTNL,
9415         },
9416         {
9417                 .cmd = NL80211_CMD_JOIN_MESH,
9418                 .doit = nl80211_join_mesh,
9419                 .policy = nl80211_policy,
9420                 .flags = GENL_ADMIN_PERM,
9421                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9422                                   NL80211_FLAG_NEED_RTNL,
9423         },
9424         {
9425                 .cmd = NL80211_CMD_LEAVE_MESH,
9426                 .doit = nl80211_leave_mesh,
9427                 .policy = nl80211_policy,
9428                 .flags = GENL_ADMIN_PERM,
9429                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9430                                   NL80211_FLAG_NEED_RTNL,
9431         },
9432 #ifdef CONFIG_PM
9433         {
9434                 .cmd = NL80211_CMD_GET_WOWLAN,
9435                 .doit = nl80211_get_wowlan,
9436                 .policy = nl80211_policy,
9437                 /* can be retrieved by unprivileged users */
9438                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9439                                   NL80211_FLAG_NEED_RTNL,
9440         },
9441         {
9442                 .cmd = NL80211_CMD_SET_WOWLAN,
9443                 .doit = nl80211_set_wowlan,
9444                 .policy = nl80211_policy,
9445                 .flags = GENL_ADMIN_PERM,
9446                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9447                                   NL80211_FLAG_NEED_RTNL,
9448         },
9449 #endif
9450         {
9451                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
9452                 .doit = nl80211_set_rekey_data,
9453                 .policy = nl80211_policy,
9454                 .flags = GENL_ADMIN_PERM,
9455                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9456                                   NL80211_FLAG_NEED_RTNL,
9457         },
9458         {
9459                 .cmd = NL80211_CMD_TDLS_MGMT,
9460                 .doit = nl80211_tdls_mgmt,
9461                 .policy = nl80211_policy,
9462                 .flags = GENL_ADMIN_PERM,
9463                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9464                                   NL80211_FLAG_NEED_RTNL,
9465         },
9466         {
9467                 .cmd = NL80211_CMD_TDLS_OPER,
9468                 .doit = nl80211_tdls_oper,
9469                 .policy = nl80211_policy,
9470                 .flags = GENL_ADMIN_PERM,
9471                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9472                                   NL80211_FLAG_NEED_RTNL,
9473         },
9474         {
9475                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
9476                 .doit = nl80211_register_unexpected_frame,
9477                 .policy = nl80211_policy,
9478                 .flags = GENL_ADMIN_PERM,
9479                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9480                                   NL80211_FLAG_NEED_RTNL,
9481         },
9482         {
9483                 .cmd = NL80211_CMD_PROBE_CLIENT,
9484                 .doit = nl80211_probe_client,
9485                 .policy = nl80211_policy,
9486                 .flags = GENL_ADMIN_PERM,
9487                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9488                                   NL80211_FLAG_NEED_RTNL,
9489         },
9490         {
9491                 .cmd = NL80211_CMD_REGISTER_BEACONS,
9492                 .doit = nl80211_register_beacons,
9493                 .policy = nl80211_policy,
9494                 .flags = GENL_ADMIN_PERM,
9495                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9496                                   NL80211_FLAG_NEED_RTNL,
9497         },
9498         {
9499                 .cmd = NL80211_CMD_SET_NOACK_MAP,
9500                 .doit = nl80211_set_noack_map,
9501                 .policy = nl80211_policy,
9502                 .flags = GENL_ADMIN_PERM,
9503                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9504                                   NL80211_FLAG_NEED_RTNL,
9505         },
9506         {
9507                 .cmd = NL80211_CMD_START_P2P_DEVICE,
9508                 .doit = nl80211_start_p2p_device,
9509                 .policy = nl80211_policy,
9510                 .flags = GENL_ADMIN_PERM,
9511                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9512                                   NL80211_FLAG_NEED_RTNL,
9513         },
9514         {
9515                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
9516                 .doit = nl80211_stop_p2p_device,
9517                 .policy = nl80211_policy,
9518                 .flags = GENL_ADMIN_PERM,
9519                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9520                                   NL80211_FLAG_NEED_RTNL,
9521         },
9522         {
9523                 .cmd = NL80211_CMD_SET_MCAST_RATE,
9524                 .doit = nl80211_set_mcast_rate,
9525                 .policy = nl80211_policy,
9526                 .flags = GENL_ADMIN_PERM,
9527                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9528                                   NL80211_FLAG_NEED_RTNL,
9529         },
9530         {
9531                 .cmd = NL80211_CMD_SET_MAC_ACL,
9532                 .doit = nl80211_set_mac_acl,
9533                 .policy = nl80211_policy,
9534                 .flags = GENL_ADMIN_PERM,
9535                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9536                                   NL80211_FLAG_NEED_RTNL,
9537         },
9538         {
9539                 .cmd = NL80211_CMD_RADAR_DETECT,
9540                 .doit = nl80211_start_radar_detection,
9541                 .policy = nl80211_policy,
9542                 .flags = GENL_ADMIN_PERM,
9543                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9544                                   NL80211_FLAG_NEED_RTNL,
9545         },
9546         {
9547                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
9548                 .doit = nl80211_get_protocol_features,
9549                 .policy = nl80211_policy,
9550         },
9551         {
9552                 .cmd = NL80211_CMD_UPDATE_FT_IES,
9553                 .doit = nl80211_update_ft_ies,
9554                 .policy = nl80211_policy,
9555                 .flags = GENL_ADMIN_PERM,
9556                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9557                                   NL80211_FLAG_NEED_RTNL,
9558         },
9559         {
9560                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
9561                 .doit = nl80211_crit_protocol_start,
9562                 .policy = nl80211_policy,
9563                 .flags = GENL_ADMIN_PERM,
9564                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9565                                   NL80211_FLAG_NEED_RTNL,
9566         },
9567         {
9568                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
9569                 .doit = nl80211_crit_protocol_stop,
9570                 .policy = nl80211_policy,
9571                 .flags = GENL_ADMIN_PERM,
9572                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9573                                   NL80211_FLAG_NEED_RTNL,
9574         },
9575         {
9576                 .cmd = NL80211_CMD_GET_COALESCE,
9577                 .doit = nl80211_get_coalesce,
9578                 .policy = nl80211_policy,
9579                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9580                                   NL80211_FLAG_NEED_RTNL,
9581         },
9582         {
9583                 .cmd = NL80211_CMD_SET_COALESCE,
9584                 .doit = nl80211_set_coalesce,
9585                 .policy = nl80211_policy,
9586                 .flags = GENL_ADMIN_PERM,
9587                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9588                                   NL80211_FLAG_NEED_RTNL,
9589         },
9590         {
9591                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
9592                 .doit = nl80211_channel_switch,
9593                 .policy = nl80211_policy,
9594                 .flags = GENL_ADMIN_PERM,
9595                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9596                                   NL80211_FLAG_NEED_RTNL,
9597         },
9598 };
9599
9600 /* notification functions */
9601
9602 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
9603 {
9604         struct sk_buff *msg;
9605         struct nl80211_dump_wiphy_state state = {};
9606
9607         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9608         if (!msg)
9609                 return;
9610
9611         if (nl80211_send_wiphy(rdev, msg, 0, 0, 0, &state) < 0) {
9612                 nlmsg_free(msg);
9613                 return;
9614         }
9615
9616         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
9617                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
9618 }
9619
9620 static int nl80211_add_scan_req(struct sk_buff *msg,
9621                                 struct cfg80211_registered_device *rdev)
9622 {
9623         struct cfg80211_scan_request *req = rdev->scan_req;
9624         struct nlattr *nest;
9625         int i;
9626
9627         if (WARN_ON(!req))
9628                 return 0;
9629
9630         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
9631         if (!nest)
9632                 goto nla_put_failure;
9633         for (i = 0; i < req->n_ssids; i++) {
9634                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
9635                         goto nla_put_failure;
9636         }
9637         nla_nest_end(msg, nest);
9638
9639         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
9640         if (!nest)
9641                 goto nla_put_failure;
9642         for (i = 0; i < req->n_channels; i++) {
9643                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
9644                         goto nla_put_failure;
9645         }
9646         nla_nest_end(msg, nest);
9647
9648         if (req->ie &&
9649             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
9650                 goto nla_put_failure;
9651
9652         if (req->flags)
9653                 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags);
9654
9655         return 0;
9656  nla_put_failure:
9657         return -ENOBUFS;
9658 }
9659
9660 static int nl80211_send_scan_msg(struct sk_buff *msg,
9661                                  struct cfg80211_registered_device *rdev,
9662                                  struct wireless_dev *wdev,
9663                                  u32 portid, u32 seq, int flags,
9664                                  u32 cmd)
9665 {
9666         void *hdr;
9667
9668         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
9669         if (!hdr)
9670                 return -1;
9671
9672         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9673             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9674                                          wdev->netdev->ifindex)) ||
9675             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
9676                 goto nla_put_failure;
9677
9678         /* ignore errors and send incomplete event anyway */
9679         nl80211_add_scan_req(msg, rdev);
9680
9681         return genlmsg_end(msg, hdr);
9682
9683  nla_put_failure:
9684         genlmsg_cancel(msg, hdr);
9685         return -EMSGSIZE;
9686 }
9687
9688 static int
9689 nl80211_send_sched_scan_msg(struct sk_buff *msg,
9690                             struct cfg80211_registered_device *rdev,
9691                             struct net_device *netdev,
9692                             u32 portid, u32 seq, int flags, u32 cmd)
9693 {
9694         void *hdr;
9695
9696         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
9697         if (!hdr)
9698                 return -1;
9699
9700         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9701             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
9702                 goto nla_put_failure;
9703
9704         return genlmsg_end(msg, hdr);
9705
9706  nla_put_failure:
9707         genlmsg_cancel(msg, hdr);
9708         return -EMSGSIZE;
9709 }
9710
9711 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
9712                              struct wireless_dev *wdev)
9713 {
9714         struct sk_buff *msg;
9715
9716         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9717         if (!msg)
9718                 return;
9719
9720         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9721                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
9722                 nlmsg_free(msg);
9723                 return;
9724         }
9725
9726         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
9727                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
9728 }
9729
9730 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
9731                             struct wireless_dev *wdev)
9732 {
9733         struct sk_buff *msg;
9734
9735         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9736         if (!msg)
9737                 return;
9738
9739         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9740                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
9741                 nlmsg_free(msg);
9742                 return;
9743         }
9744
9745         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
9746                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
9747 }
9748
9749 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
9750                                struct wireless_dev *wdev)
9751 {
9752         struct sk_buff *msg;
9753
9754         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9755         if (!msg)
9756                 return;
9757
9758         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9759                                   NL80211_CMD_SCAN_ABORTED) < 0) {
9760                 nlmsg_free(msg);
9761                 return;
9762         }
9763
9764         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
9765                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
9766 }
9767
9768 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
9769                                      struct net_device *netdev)
9770 {
9771         struct sk_buff *msg;
9772
9773         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9774         if (!msg)
9775                 return;
9776
9777         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
9778                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
9779                 nlmsg_free(msg);
9780                 return;
9781         }
9782
9783         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
9784                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
9785 }
9786
9787 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
9788                              struct net_device *netdev, u32 cmd)
9789 {
9790         struct sk_buff *msg;
9791
9792         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9793         if (!msg)
9794                 return;
9795
9796         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
9797                 nlmsg_free(msg);
9798                 return;
9799         }
9800
9801         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
9802                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
9803 }
9804
9805 /*
9806  * This can happen on global regulatory changes or device specific settings
9807  * based on custom world regulatory domains.
9808  */
9809 void nl80211_send_reg_change_event(struct regulatory_request *request)
9810 {
9811         struct sk_buff *msg;
9812         void *hdr;
9813
9814         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9815         if (!msg)
9816                 return;
9817
9818         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
9819         if (!hdr) {
9820                 nlmsg_free(msg);
9821                 return;
9822         }
9823
9824         /* Userspace can always count this one always being set */
9825         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
9826                 goto nla_put_failure;
9827
9828         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
9829                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9830                                NL80211_REGDOM_TYPE_WORLD))
9831                         goto nla_put_failure;
9832         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
9833                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9834                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
9835                         goto nla_put_failure;
9836         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
9837                    request->intersect) {
9838                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9839                                NL80211_REGDOM_TYPE_INTERSECTION))
9840                         goto nla_put_failure;
9841         } else {
9842                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9843                                NL80211_REGDOM_TYPE_COUNTRY) ||
9844                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
9845                                    request->alpha2))
9846                         goto nla_put_failure;
9847         }
9848
9849         if (request->wiphy_idx != WIPHY_IDX_INVALID &&
9850             nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
9851                 goto nla_put_failure;
9852
9853         genlmsg_end(msg, hdr);
9854
9855         rcu_read_lock();
9856         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
9857                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
9858         rcu_read_unlock();
9859
9860         return;
9861
9862 nla_put_failure:
9863         genlmsg_cancel(msg, hdr);
9864         nlmsg_free(msg);
9865 }
9866
9867 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
9868                                     struct net_device *netdev,
9869                                     const u8 *buf, size_t len,
9870                                     enum nl80211_commands cmd, gfp_t gfp)
9871 {
9872         struct sk_buff *msg;
9873         void *hdr;
9874
9875         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9876         if (!msg)
9877                 return;
9878
9879         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9880         if (!hdr) {
9881                 nlmsg_free(msg);
9882                 return;
9883         }
9884
9885         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9886             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9887             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
9888                 goto nla_put_failure;
9889
9890         genlmsg_end(msg, hdr);
9891
9892         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
9893                                 NL80211_MCGRP_MLME, gfp);
9894         return;
9895
9896  nla_put_failure:
9897         genlmsg_cancel(msg, hdr);
9898         nlmsg_free(msg);
9899 }
9900
9901 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
9902                           struct net_device *netdev, const u8 *buf,
9903                           size_t len, gfp_t gfp)
9904 {
9905         nl80211_send_mlme_event(rdev, netdev, buf, len,
9906                                 NL80211_CMD_AUTHENTICATE, gfp);
9907 }
9908
9909 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
9910                            struct net_device *netdev, const u8 *buf,
9911                            size_t len, gfp_t gfp)
9912 {
9913         nl80211_send_mlme_event(rdev, netdev, buf, len,
9914                                 NL80211_CMD_ASSOCIATE, gfp);
9915 }
9916
9917 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
9918                          struct net_device *netdev, const u8 *buf,
9919                          size_t len, gfp_t gfp)
9920 {
9921         nl80211_send_mlme_event(rdev, netdev, buf, len,
9922                                 NL80211_CMD_DEAUTHENTICATE, gfp);
9923 }
9924
9925 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
9926                            struct net_device *netdev, const u8 *buf,
9927                            size_t len, gfp_t gfp)
9928 {
9929         nl80211_send_mlme_event(rdev, netdev, buf, len,
9930                                 NL80211_CMD_DISASSOCIATE, gfp);
9931 }
9932
9933 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
9934                                   size_t len)
9935 {
9936         struct wireless_dev *wdev = dev->ieee80211_ptr;
9937         struct wiphy *wiphy = wdev->wiphy;
9938         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9939         const struct ieee80211_mgmt *mgmt = (void *)buf;
9940         u32 cmd;
9941
9942         if (WARN_ON(len < 2))
9943                 return;
9944
9945         if (ieee80211_is_deauth(mgmt->frame_control))
9946                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
9947         else
9948                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
9949
9950         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
9951         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC);
9952 }
9953 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
9954
9955 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
9956                                       struct net_device *netdev, int cmd,
9957                                       const u8 *addr, gfp_t gfp)
9958 {
9959         struct sk_buff *msg;
9960         void *hdr;
9961
9962         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9963         if (!msg)
9964                 return;
9965
9966         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9967         if (!hdr) {
9968                 nlmsg_free(msg);
9969                 return;
9970         }
9971
9972         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9973             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9974             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
9975             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
9976                 goto nla_put_failure;
9977
9978         genlmsg_end(msg, hdr);
9979
9980         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
9981                                 NL80211_MCGRP_MLME, gfp);
9982         return;
9983
9984  nla_put_failure:
9985         genlmsg_cancel(msg, hdr);
9986         nlmsg_free(msg);
9987 }
9988
9989 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
9990                                struct net_device *netdev, const u8 *addr,
9991                                gfp_t gfp)
9992 {
9993         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
9994                                   addr, gfp);
9995 }
9996
9997 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
9998                                 struct net_device *netdev, const u8 *addr,
9999                                 gfp_t gfp)
10000 {
10001         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
10002                                   addr, gfp);
10003 }
10004
10005 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
10006                                  struct net_device *netdev, const u8 *bssid,
10007                                  const u8 *req_ie, size_t req_ie_len,
10008                                  const u8 *resp_ie, size_t resp_ie_len,
10009                                  u16 status, gfp_t gfp)
10010 {
10011         struct sk_buff *msg;
10012         void *hdr;
10013
10014         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10015         if (!msg)
10016                 return;
10017
10018         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
10019         if (!hdr) {
10020                 nlmsg_free(msg);
10021                 return;
10022         }
10023
10024         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10025             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10026             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
10027             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
10028             (req_ie &&
10029              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
10030             (resp_ie &&
10031              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
10032                 goto nla_put_failure;
10033
10034         genlmsg_end(msg, hdr);
10035
10036         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10037                                 NL80211_MCGRP_MLME, gfp);
10038         return;
10039
10040  nla_put_failure:
10041         genlmsg_cancel(msg, hdr);
10042         nlmsg_free(msg);
10043
10044 }
10045
10046 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
10047                          struct net_device *netdev, const u8 *bssid,
10048                          const u8 *req_ie, size_t req_ie_len,
10049                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
10050 {
10051         struct sk_buff *msg;
10052         void *hdr;
10053
10054         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10055         if (!msg)
10056                 return;
10057
10058         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
10059         if (!hdr) {
10060                 nlmsg_free(msg);
10061                 return;
10062         }
10063
10064         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10065             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10066             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
10067             (req_ie &&
10068              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
10069             (resp_ie &&
10070              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
10071                 goto nla_put_failure;
10072
10073         genlmsg_end(msg, hdr);
10074
10075         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10076                                 NL80211_MCGRP_MLME, gfp);
10077         return;
10078
10079  nla_put_failure:
10080         genlmsg_cancel(msg, hdr);
10081         nlmsg_free(msg);
10082
10083 }
10084
10085 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
10086                                struct net_device *netdev, u16 reason,
10087                                const u8 *ie, size_t ie_len, bool from_ap)
10088 {
10089         struct sk_buff *msg;
10090         void *hdr;
10091
10092         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10093         if (!msg)
10094                 return;
10095
10096         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
10097         if (!hdr) {
10098                 nlmsg_free(msg);
10099                 return;
10100         }
10101
10102         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10103             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10104             (from_ap && reason &&
10105              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
10106             (from_ap &&
10107              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
10108             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
10109                 goto nla_put_failure;
10110
10111         genlmsg_end(msg, hdr);
10112
10113         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10114                                 NL80211_MCGRP_MLME, GFP_KERNEL);
10115         return;
10116
10117  nla_put_failure:
10118         genlmsg_cancel(msg, hdr);
10119         nlmsg_free(msg);
10120
10121 }
10122
10123 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
10124                              struct net_device *netdev, const u8 *bssid,
10125                              gfp_t gfp)
10126 {
10127         struct sk_buff *msg;
10128         void *hdr;
10129
10130         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10131         if (!msg)
10132                 return;
10133
10134         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
10135         if (!hdr) {
10136                 nlmsg_free(msg);
10137                 return;
10138         }
10139
10140         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10141             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10142             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
10143                 goto nla_put_failure;
10144
10145         genlmsg_end(msg, hdr);
10146
10147         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10148                                 NL80211_MCGRP_MLME, gfp);
10149         return;
10150
10151  nla_put_failure:
10152         genlmsg_cancel(msg, hdr);
10153         nlmsg_free(msg);
10154 }
10155
10156 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
10157                                         const u8* ie, u8 ie_len, gfp_t gfp)
10158 {
10159         struct wireless_dev *wdev = dev->ieee80211_ptr;
10160         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10161         struct sk_buff *msg;
10162         void *hdr;
10163
10164         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
10165                 return;
10166
10167         trace_cfg80211_notify_new_peer_candidate(dev, addr);
10168
10169         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10170         if (!msg)
10171                 return;
10172
10173         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
10174         if (!hdr) {
10175                 nlmsg_free(msg);
10176                 return;
10177         }
10178
10179         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10180             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10181             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
10182             (ie_len && ie &&
10183              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
10184                 goto nla_put_failure;
10185
10186         genlmsg_end(msg, hdr);
10187
10188         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10189                                 NL80211_MCGRP_MLME, gfp);
10190         return;
10191
10192  nla_put_failure:
10193         genlmsg_cancel(msg, hdr);
10194         nlmsg_free(msg);
10195 }
10196 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
10197
10198 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
10199                                  struct net_device *netdev, const u8 *addr,
10200                                  enum nl80211_key_type key_type, int key_id,
10201                                  const u8 *tsc, gfp_t gfp)
10202 {
10203         struct sk_buff *msg;
10204         void *hdr;
10205
10206         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10207         if (!msg)
10208                 return;
10209
10210         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
10211         if (!hdr) {
10212                 nlmsg_free(msg);
10213                 return;
10214         }
10215
10216         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10217             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10218             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
10219             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
10220             (key_id != -1 &&
10221              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
10222             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
10223                 goto nla_put_failure;
10224
10225         genlmsg_end(msg, hdr);
10226
10227         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10228                                 NL80211_MCGRP_MLME, gfp);
10229         return;
10230
10231  nla_put_failure:
10232         genlmsg_cancel(msg, hdr);
10233         nlmsg_free(msg);
10234 }
10235
10236 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
10237                                     struct ieee80211_channel *channel_before,
10238                                     struct ieee80211_channel *channel_after)
10239 {
10240         struct sk_buff *msg;
10241         void *hdr;
10242         struct nlattr *nl_freq;
10243
10244         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
10245         if (!msg)
10246                 return;
10247
10248         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
10249         if (!hdr) {
10250                 nlmsg_free(msg);
10251                 return;
10252         }
10253
10254         /*
10255          * Since we are applying the beacon hint to a wiphy we know its
10256          * wiphy_idx is valid
10257          */
10258         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
10259                 goto nla_put_failure;
10260
10261         /* Before */
10262         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
10263         if (!nl_freq)
10264                 goto nla_put_failure;
10265         if (nl80211_msg_put_channel(msg, channel_before, false))
10266                 goto nla_put_failure;
10267         nla_nest_end(msg, nl_freq);
10268
10269         /* After */
10270         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
10271         if (!nl_freq)
10272                 goto nla_put_failure;
10273         if (nl80211_msg_put_channel(msg, channel_after, false))
10274                 goto nla_put_failure;
10275         nla_nest_end(msg, nl_freq);
10276
10277         genlmsg_end(msg, hdr);
10278
10279         rcu_read_lock();
10280         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
10281                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
10282         rcu_read_unlock();
10283
10284         return;
10285
10286 nla_put_failure:
10287         genlmsg_cancel(msg, hdr);
10288         nlmsg_free(msg);
10289 }
10290
10291 static void nl80211_send_remain_on_chan_event(
10292         int cmd, struct cfg80211_registered_device *rdev,
10293         struct wireless_dev *wdev, u64 cookie,
10294         struct ieee80211_channel *chan,
10295         unsigned int duration, gfp_t gfp)
10296 {
10297         struct sk_buff *msg;
10298         void *hdr;
10299
10300         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10301         if (!msg)
10302                 return;
10303
10304         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10305         if (!hdr) {
10306                 nlmsg_free(msg);
10307                 return;
10308         }
10309
10310         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10311             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10312                                          wdev->netdev->ifindex)) ||
10313             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10314             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
10315             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
10316                         NL80211_CHAN_NO_HT) ||
10317             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
10318                 goto nla_put_failure;
10319
10320         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
10321             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
10322                 goto nla_put_failure;
10323
10324         genlmsg_end(msg, hdr);
10325
10326         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10327                                 NL80211_MCGRP_MLME, gfp);
10328         return;
10329
10330  nla_put_failure:
10331         genlmsg_cancel(msg, hdr);
10332         nlmsg_free(msg);
10333 }
10334
10335 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
10336                                struct ieee80211_channel *chan,
10337                                unsigned int duration, gfp_t gfp)
10338 {
10339         struct wiphy *wiphy = wdev->wiphy;
10340         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10341
10342         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
10343         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
10344                                           rdev, wdev, cookie, chan,
10345                                           duration, gfp);
10346 }
10347 EXPORT_SYMBOL(cfg80211_ready_on_channel);
10348
10349 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
10350                                         struct ieee80211_channel *chan,
10351                                         gfp_t gfp)
10352 {
10353         struct wiphy *wiphy = wdev->wiphy;
10354         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10355
10356         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
10357         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
10358                                           rdev, wdev, cookie, chan, 0, gfp);
10359 }
10360 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
10361
10362 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
10363                       struct station_info *sinfo, gfp_t gfp)
10364 {
10365         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
10366         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10367         struct sk_buff *msg;
10368
10369         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
10370
10371         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10372         if (!msg)
10373                 return;
10374
10375         if (nl80211_send_station(msg, 0, 0, 0,
10376                                  rdev, dev, mac_addr, sinfo) < 0) {
10377                 nlmsg_free(msg);
10378                 return;
10379         }
10380
10381         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10382                                 NL80211_MCGRP_MLME, gfp);
10383 }
10384 EXPORT_SYMBOL(cfg80211_new_sta);
10385
10386 void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
10387 {
10388         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
10389         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10390         struct sk_buff *msg;
10391         void *hdr;
10392
10393         trace_cfg80211_del_sta(dev, mac_addr);
10394
10395         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10396         if (!msg)
10397                 return;
10398
10399         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
10400         if (!hdr) {
10401                 nlmsg_free(msg);
10402                 return;
10403         }
10404
10405         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10406             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
10407                 goto nla_put_failure;
10408
10409         genlmsg_end(msg, hdr);
10410
10411         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10412                                 NL80211_MCGRP_MLME, gfp);
10413         return;
10414
10415  nla_put_failure:
10416         genlmsg_cancel(msg, hdr);
10417         nlmsg_free(msg);
10418 }
10419 EXPORT_SYMBOL(cfg80211_del_sta);
10420
10421 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
10422                           enum nl80211_connect_failed_reason reason,
10423                           gfp_t gfp)
10424 {
10425         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
10426         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10427         struct sk_buff *msg;
10428         void *hdr;
10429
10430         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
10431         if (!msg)
10432                 return;
10433
10434         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
10435         if (!hdr) {
10436                 nlmsg_free(msg);
10437                 return;
10438         }
10439
10440         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10441             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
10442             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
10443                 goto nla_put_failure;
10444
10445         genlmsg_end(msg, hdr);
10446
10447         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10448                                 NL80211_MCGRP_MLME, gfp);
10449         return;
10450
10451  nla_put_failure:
10452         genlmsg_cancel(msg, hdr);
10453         nlmsg_free(msg);
10454 }
10455 EXPORT_SYMBOL(cfg80211_conn_failed);
10456
10457 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
10458                                        const u8 *addr, gfp_t gfp)
10459 {
10460         struct wireless_dev *wdev = dev->ieee80211_ptr;
10461         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10462         struct sk_buff *msg;
10463         void *hdr;
10464         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
10465
10466         if (!nlportid)
10467                 return false;
10468
10469         msg = nlmsg_new(100, gfp);
10470         if (!msg)
10471                 return true;
10472
10473         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10474         if (!hdr) {
10475                 nlmsg_free(msg);
10476                 return true;
10477         }
10478
10479         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10480             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10481             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
10482                 goto nla_put_failure;
10483
10484         genlmsg_end(msg, hdr);
10485         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
10486         return true;
10487
10488  nla_put_failure:
10489         genlmsg_cancel(msg, hdr);
10490         nlmsg_free(msg);
10491         return true;
10492 }
10493
10494 bool cfg80211_rx_spurious_frame(struct net_device *dev,
10495                                 const u8 *addr, gfp_t gfp)
10496 {
10497         struct wireless_dev *wdev = dev->ieee80211_ptr;
10498         bool ret;
10499
10500         trace_cfg80211_rx_spurious_frame(dev, addr);
10501
10502         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
10503                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
10504                 trace_cfg80211_return_bool(false);
10505                 return false;
10506         }
10507         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
10508                                          addr, gfp);
10509         trace_cfg80211_return_bool(ret);
10510         return ret;
10511 }
10512 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
10513
10514 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
10515                                         const u8 *addr, gfp_t gfp)
10516 {
10517         struct wireless_dev *wdev = dev->ieee80211_ptr;
10518         bool ret;
10519
10520         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
10521
10522         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
10523                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
10524                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
10525                 trace_cfg80211_return_bool(false);
10526                 return false;
10527         }
10528         ret = __nl80211_unexpected_frame(dev,
10529                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
10530                                          addr, gfp);
10531         trace_cfg80211_return_bool(ret);
10532         return ret;
10533 }
10534 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
10535
10536 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
10537                       struct wireless_dev *wdev, u32 nlportid,
10538                       int freq, int sig_dbm,
10539                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
10540 {
10541         struct net_device *netdev = wdev->netdev;
10542         struct sk_buff *msg;
10543         void *hdr;
10544
10545         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10546         if (!msg)
10547                 return -ENOMEM;
10548
10549         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
10550         if (!hdr) {
10551                 nlmsg_free(msg);
10552                 return -ENOMEM;
10553         }
10554
10555         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10556             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10557                                         netdev->ifindex)) ||
10558             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10559             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
10560             (sig_dbm &&
10561              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
10562             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
10563             (flags &&
10564              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
10565                 goto nla_put_failure;
10566
10567         genlmsg_end(msg, hdr);
10568
10569         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
10570
10571  nla_put_failure:
10572         genlmsg_cancel(msg, hdr);
10573         nlmsg_free(msg);
10574         return -ENOBUFS;
10575 }
10576
10577 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
10578                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
10579 {
10580         struct wiphy *wiphy = wdev->wiphy;
10581         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10582         struct net_device *netdev = wdev->netdev;
10583         struct sk_buff *msg;
10584         void *hdr;
10585
10586         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
10587
10588         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10589         if (!msg)
10590                 return;
10591
10592         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
10593         if (!hdr) {
10594                 nlmsg_free(msg);
10595                 return;
10596         }
10597
10598         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10599             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10600                                    netdev->ifindex)) ||
10601             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10602             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
10603             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
10604             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
10605                 goto nla_put_failure;
10606
10607         genlmsg_end(msg, hdr);
10608
10609         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10610                                 NL80211_MCGRP_MLME, gfp);
10611         return;
10612
10613  nla_put_failure:
10614         genlmsg_cancel(msg, hdr);
10615         nlmsg_free(msg);
10616 }
10617 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
10618
10619 void cfg80211_cqm_rssi_notify(struct net_device *dev,
10620                               enum nl80211_cqm_rssi_threshold_event rssi_event,
10621                               gfp_t gfp)
10622 {
10623         struct wireless_dev *wdev = dev->ieee80211_ptr;
10624         struct wiphy *wiphy = wdev->wiphy;
10625         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10626         struct sk_buff *msg;
10627         struct nlattr *pinfoattr;
10628         void *hdr;
10629
10630         trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
10631
10632         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10633         if (!msg)
10634                 return;
10635
10636         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10637         if (!hdr) {
10638                 nlmsg_free(msg);
10639                 return;
10640         }
10641
10642         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10643             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
10644                 goto nla_put_failure;
10645
10646         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10647         if (!pinfoattr)
10648                 goto nla_put_failure;
10649
10650         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
10651                         rssi_event))
10652                 goto nla_put_failure;
10653
10654         nla_nest_end(msg, pinfoattr);
10655
10656         genlmsg_end(msg, hdr);
10657
10658         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10659                                 NL80211_MCGRP_MLME, gfp);
10660         return;
10661
10662  nla_put_failure:
10663         genlmsg_cancel(msg, hdr);
10664         nlmsg_free(msg);
10665 }
10666 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
10667
10668 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
10669                                      struct net_device *netdev, const u8 *bssid,
10670                                      const u8 *replay_ctr, gfp_t gfp)
10671 {
10672         struct sk_buff *msg;
10673         struct nlattr *rekey_attr;
10674         void *hdr;
10675
10676         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10677         if (!msg)
10678                 return;
10679
10680         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
10681         if (!hdr) {
10682                 nlmsg_free(msg);
10683                 return;
10684         }
10685
10686         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10687             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10688             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
10689                 goto nla_put_failure;
10690
10691         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
10692         if (!rekey_attr)
10693                 goto nla_put_failure;
10694
10695         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
10696                     NL80211_REPLAY_CTR_LEN, replay_ctr))
10697                 goto nla_put_failure;
10698
10699         nla_nest_end(msg, rekey_attr);
10700
10701         genlmsg_end(msg, hdr);
10702
10703         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10704                                 NL80211_MCGRP_MLME, gfp);
10705         return;
10706
10707  nla_put_failure:
10708         genlmsg_cancel(msg, hdr);
10709         nlmsg_free(msg);
10710 }
10711
10712 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
10713                                const u8 *replay_ctr, gfp_t gfp)
10714 {
10715         struct wireless_dev *wdev = dev->ieee80211_ptr;
10716         struct wiphy *wiphy = wdev->wiphy;
10717         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10718
10719         trace_cfg80211_gtk_rekey_notify(dev, bssid);
10720         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
10721 }
10722 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
10723
10724 static void
10725 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
10726                                struct net_device *netdev, int index,
10727                                const u8 *bssid, bool preauth, gfp_t gfp)
10728 {
10729         struct sk_buff *msg;
10730         struct nlattr *attr;
10731         void *hdr;
10732
10733         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10734         if (!msg)
10735                 return;
10736
10737         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
10738         if (!hdr) {
10739                 nlmsg_free(msg);
10740                 return;
10741         }
10742
10743         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10744             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
10745                 goto nla_put_failure;
10746
10747         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
10748         if (!attr)
10749                 goto nla_put_failure;
10750
10751         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
10752             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
10753             (preauth &&
10754              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
10755                 goto nla_put_failure;
10756
10757         nla_nest_end(msg, attr);
10758
10759         genlmsg_end(msg, hdr);
10760
10761         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10762                                 NL80211_MCGRP_MLME, gfp);
10763         return;
10764
10765  nla_put_failure:
10766         genlmsg_cancel(msg, hdr);
10767         nlmsg_free(msg);
10768 }
10769
10770 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
10771                                      const u8 *bssid, bool preauth, gfp_t gfp)
10772 {
10773         struct wireless_dev *wdev = dev->ieee80211_ptr;
10774         struct wiphy *wiphy = wdev->wiphy;
10775         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10776
10777         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
10778         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
10779 }
10780 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
10781
10782 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
10783                                      struct net_device *netdev,
10784                                      struct cfg80211_chan_def *chandef,
10785                                      gfp_t gfp)
10786 {
10787         struct sk_buff *msg;
10788         void *hdr;
10789
10790         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10791         if (!msg)
10792                 return;
10793
10794         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
10795         if (!hdr) {
10796                 nlmsg_free(msg);
10797                 return;
10798         }
10799
10800         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
10801                 goto nla_put_failure;
10802
10803         if (nl80211_send_chandef(msg, chandef))
10804                 goto nla_put_failure;
10805
10806         genlmsg_end(msg, hdr);
10807
10808         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10809                                 NL80211_MCGRP_MLME, gfp);
10810         return;
10811
10812  nla_put_failure:
10813         genlmsg_cancel(msg, hdr);
10814         nlmsg_free(msg);
10815 }
10816
10817 void cfg80211_ch_switch_notify(struct net_device *dev,
10818                                struct cfg80211_chan_def *chandef)
10819 {
10820         struct wireless_dev *wdev = dev->ieee80211_ptr;
10821         struct wiphy *wiphy = wdev->wiphy;
10822         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10823
10824         ASSERT_WDEV_LOCK(wdev);
10825
10826         trace_cfg80211_ch_switch_notify(dev, chandef);
10827
10828         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
10829                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
10830                     wdev->iftype != NL80211_IFTYPE_ADHOC &&
10831                     wdev->iftype != NL80211_IFTYPE_MESH_POINT))
10832                 return;
10833
10834         wdev->channel = chandef->chan;
10835         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL);
10836 }
10837 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
10838
10839 void cfg80211_cqm_txe_notify(struct net_device *dev,
10840                              const u8 *peer, u32 num_packets,
10841                              u32 rate, u32 intvl, gfp_t gfp)
10842 {
10843         struct wireless_dev *wdev = dev->ieee80211_ptr;
10844         struct wiphy *wiphy = wdev->wiphy;
10845         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10846         struct sk_buff *msg;
10847         struct nlattr *pinfoattr;
10848         void *hdr;
10849
10850         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
10851         if (!msg)
10852                 return;
10853
10854         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10855         if (!hdr) {
10856                 nlmsg_free(msg);
10857                 return;
10858         }
10859
10860         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10861             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10862             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
10863                 goto nla_put_failure;
10864
10865         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10866         if (!pinfoattr)
10867                 goto nla_put_failure;
10868
10869         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
10870                 goto nla_put_failure;
10871
10872         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
10873                 goto nla_put_failure;
10874
10875         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
10876                 goto nla_put_failure;
10877
10878         nla_nest_end(msg, pinfoattr);
10879
10880         genlmsg_end(msg, hdr);
10881
10882         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10883                                 NL80211_MCGRP_MLME, gfp);
10884         return;
10885
10886  nla_put_failure:
10887         genlmsg_cancel(msg, hdr);
10888         nlmsg_free(msg);
10889 }
10890 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
10891
10892 void
10893 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
10894                      const struct cfg80211_chan_def *chandef,
10895                      enum nl80211_radar_event event,
10896                      struct net_device *netdev, gfp_t gfp)
10897 {
10898         struct sk_buff *msg;
10899         void *hdr;
10900
10901         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10902         if (!msg)
10903                 return;
10904
10905         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
10906         if (!hdr) {
10907                 nlmsg_free(msg);
10908                 return;
10909         }
10910
10911         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
10912                 goto nla_put_failure;
10913
10914         /* NOP and radar events don't need a netdev parameter */
10915         if (netdev) {
10916                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
10917
10918                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10919                     nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10920                         goto nla_put_failure;
10921         }
10922
10923         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
10924                 goto nla_put_failure;
10925
10926         if (nl80211_send_chandef(msg, chandef))
10927                 goto nla_put_failure;
10928
10929         genlmsg_end(msg, hdr);
10930
10931         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10932                                 NL80211_MCGRP_MLME, gfp);
10933         return;
10934
10935  nla_put_failure:
10936         genlmsg_cancel(msg, hdr);
10937         nlmsg_free(msg);
10938 }
10939
10940 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
10941                                  const u8 *peer, u32 num_packets, gfp_t gfp)
10942 {
10943         struct wireless_dev *wdev = dev->ieee80211_ptr;
10944         struct wiphy *wiphy = wdev->wiphy;
10945         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10946         struct sk_buff *msg;
10947         struct nlattr *pinfoattr;
10948         void *hdr;
10949
10950         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
10951
10952         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10953         if (!msg)
10954                 return;
10955
10956         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10957         if (!hdr) {
10958                 nlmsg_free(msg);
10959                 return;
10960         }
10961
10962         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10963             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10964             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
10965                 goto nla_put_failure;
10966
10967         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10968         if (!pinfoattr)
10969                 goto nla_put_failure;
10970
10971         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
10972                 goto nla_put_failure;
10973
10974         nla_nest_end(msg, pinfoattr);
10975
10976         genlmsg_end(msg, hdr);
10977
10978         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10979                                 NL80211_MCGRP_MLME, gfp);
10980         return;
10981
10982  nla_put_failure:
10983         genlmsg_cancel(msg, hdr);
10984         nlmsg_free(msg);
10985 }
10986 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
10987
10988 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
10989                            u64 cookie, bool acked, gfp_t gfp)
10990 {
10991         struct wireless_dev *wdev = dev->ieee80211_ptr;
10992         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10993         struct sk_buff *msg;
10994         void *hdr;
10995
10996         trace_cfg80211_probe_status(dev, addr, cookie, acked);
10997
10998         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10999
11000         if (!msg)
11001                 return;
11002
11003         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
11004         if (!hdr) {
11005                 nlmsg_free(msg);
11006                 return;
11007         }
11008
11009         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11010             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11011             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
11012             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
11013             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
11014                 goto nla_put_failure;
11015
11016         genlmsg_end(msg, hdr);
11017
11018         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11019                                 NL80211_MCGRP_MLME, gfp);
11020         return;
11021
11022  nla_put_failure:
11023         genlmsg_cancel(msg, hdr);
11024         nlmsg_free(msg);
11025 }
11026 EXPORT_SYMBOL(cfg80211_probe_status);
11027
11028 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
11029                                  const u8 *frame, size_t len,
11030                                  int freq, int sig_dbm)
11031 {
11032         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
11033         struct sk_buff *msg;
11034         void *hdr;
11035         struct cfg80211_beacon_registration *reg;
11036
11037         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
11038
11039         spin_lock_bh(&rdev->beacon_registrations_lock);
11040         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
11041                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
11042                 if (!msg) {
11043                         spin_unlock_bh(&rdev->beacon_registrations_lock);
11044                         return;
11045                 }
11046
11047                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
11048                 if (!hdr)
11049                         goto nla_put_failure;
11050
11051                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11052                     (freq &&
11053                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
11054                     (sig_dbm &&
11055                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
11056                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
11057                         goto nla_put_failure;
11058
11059                 genlmsg_end(msg, hdr);
11060
11061                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
11062         }
11063         spin_unlock_bh(&rdev->beacon_registrations_lock);
11064         return;
11065
11066  nla_put_failure:
11067         spin_unlock_bh(&rdev->beacon_registrations_lock);
11068         if (hdr)
11069                 genlmsg_cancel(msg, hdr);
11070         nlmsg_free(msg);
11071 }
11072 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
11073
11074 #ifdef CONFIG_PM
11075 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
11076                                    struct cfg80211_wowlan_wakeup *wakeup,
11077                                    gfp_t gfp)
11078 {
11079         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
11080         struct sk_buff *msg;
11081         void *hdr;
11082         int size = 200;
11083
11084         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
11085
11086         if (wakeup)
11087                 size += wakeup->packet_present_len;
11088
11089         msg = nlmsg_new(size, gfp);
11090         if (!msg)
11091                 return;
11092
11093         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
11094         if (!hdr)
11095                 goto free_msg;
11096
11097         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11098             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11099                 goto free_msg;
11100
11101         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11102                                         wdev->netdev->ifindex))
11103                 goto free_msg;
11104
11105         if (wakeup) {
11106                 struct nlattr *reasons;
11107
11108                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
11109
11110                 if (wakeup->disconnect &&
11111                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
11112                         goto free_msg;
11113                 if (wakeup->magic_pkt &&
11114                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
11115                         goto free_msg;
11116                 if (wakeup->gtk_rekey_failure &&
11117                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
11118                         goto free_msg;
11119                 if (wakeup->eap_identity_req &&
11120                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
11121                         goto free_msg;
11122                 if (wakeup->four_way_handshake &&
11123                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
11124                         goto free_msg;
11125                 if (wakeup->rfkill_release &&
11126                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
11127                         goto free_msg;
11128
11129                 if (wakeup->pattern_idx >= 0 &&
11130                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
11131                                 wakeup->pattern_idx))
11132                         goto free_msg;
11133
11134                 if (wakeup->tcp_match)
11135                         nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH);
11136
11137                 if (wakeup->tcp_connlost)
11138                         nla_put_flag(msg,
11139                                      NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST);
11140
11141                 if (wakeup->tcp_nomoretokens)
11142                         nla_put_flag(msg,
11143                                 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS);
11144
11145                 if (wakeup->packet) {
11146                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
11147                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
11148
11149                         if (!wakeup->packet_80211) {
11150                                 pkt_attr =
11151                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
11152                                 len_attr =
11153                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
11154                         }
11155
11156                         if (wakeup->packet_len &&
11157                             nla_put_u32(msg, len_attr, wakeup->packet_len))
11158                                 goto free_msg;
11159
11160                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
11161                                     wakeup->packet))
11162                                 goto free_msg;
11163                 }
11164
11165                 nla_nest_end(msg, reasons);
11166         }
11167
11168         genlmsg_end(msg, hdr);
11169
11170         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11171                                 NL80211_MCGRP_MLME, gfp);
11172         return;
11173
11174  free_msg:
11175         nlmsg_free(msg);
11176 }
11177 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
11178 #endif
11179
11180 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
11181                                 enum nl80211_tdls_operation oper,
11182                                 u16 reason_code, gfp_t gfp)
11183 {
11184         struct wireless_dev *wdev = dev->ieee80211_ptr;
11185         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
11186         struct sk_buff *msg;
11187         void *hdr;
11188
11189         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
11190                                          reason_code);
11191
11192         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11193         if (!msg)
11194                 return;
11195
11196         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
11197         if (!hdr) {
11198                 nlmsg_free(msg);
11199                 return;
11200         }
11201
11202         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11203             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11204             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
11205             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
11206             (reason_code > 0 &&
11207              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
11208                 goto nla_put_failure;
11209
11210         genlmsg_end(msg, hdr);
11211
11212         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11213                                 NL80211_MCGRP_MLME, gfp);
11214         return;
11215
11216  nla_put_failure:
11217         genlmsg_cancel(msg, hdr);
11218         nlmsg_free(msg);
11219 }
11220 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
11221
11222 static int nl80211_netlink_notify(struct notifier_block * nb,
11223                                   unsigned long state,
11224                                   void *_notify)
11225 {
11226         struct netlink_notify *notify = _notify;
11227         struct cfg80211_registered_device *rdev;
11228         struct wireless_dev *wdev;
11229         struct cfg80211_beacon_registration *reg, *tmp;
11230
11231         if (state != NETLINK_URELEASE)
11232                 return NOTIFY_DONE;
11233
11234         rcu_read_lock();
11235
11236         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
11237                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list)
11238                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
11239
11240                 spin_lock_bh(&rdev->beacon_registrations_lock);
11241                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
11242                                          list) {
11243                         if (reg->nlportid == notify->portid) {
11244                                 list_del(&reg->list);
11245                                 kfree(reg);
11246                                 break;
11247                         }
11248                 }
11249                 spin_unlock_bh(&rdev->beacon_registrations_lock);
11250         }
11251
11252         rcu_read_unlock();
11253
11254         return NOTIFY_DONE;
11255 }
11256
11257 static struct notifier_block nl80211_netlink_notifier = {
11258         .notifier_call = nl80211_netlink_notify,
11259 };
11260
11261 void cfg80211_ft_event(struct net_device *netdev,
11262                        struct cfg80211_ft_event_params *ft_event)
11263 {
11264         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
11265         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
11266         struct sk_buff *msg;
11267         void *hdr;
11268
11269         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
11270
11271         if (!ft_event->target_ap)
11272                 return;
11273
11274         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11275         if (!msg)
11276                 return;
11277
11278         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
11279         if (!hdr) {
11280                 nlmsg_free(msg);
11281                 return;
11282         }
11283
11284         nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
11285         nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
11286         nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap);
11287         if (ft_event->ies)
11288                 nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies);
11289         if (ft_event->ric_ies)
11290                 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
11291                         ft_event->ric_ies);
11292
11293         genlmsg_end(msg, hdr);
11294
11295         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11296                                 NL80211_MCGRP_MLME, GFP_KERNEL);
11297 }
11298 EXPORT_SYMBOL(cfg80211_ft_event);
11299
11300 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
11301 {
11302         struct cfg80211_registered_device *rdev;
11303         struct sk_buff *msg;
11304         void *hdr;
11305         u32 nlportid;
11306
11307         rdev = wiphy_to_dev(wdev->wiphy);
11308         if (!rdev->crit_proto_nlportid)
11309                 return;
11310
11311         nlportid = rdev->crit_proto_nlportid;
11312         rdev->crit_proto_nlportid = 0;
11313
11314         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11315         if (!msg)
11316                 return;
11317
11318         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
11319         if (!hdr)
11320                 goto nla_put_failure;
11321
11322         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11323             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11324                 goto nla_put_failure;
11325
11326         genlmsg_end(msg, hdr);
11327
11328         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
11329         return;
11330
11331  nla_put_failure:
11332         if (hdr)
11333                 genlmsg_cancel(msg, hdr);
11334         nlmsg_free(msg);
11335
11336 }
11337 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
11338
11339 /* initialisation/exit functions */
11340
11341 int nl80211_init(void)
11342 {
11343         int err;
11344
11345         err = genl_register_family_with_ops_groups(&nl80211_fam, nl80211_ops,
11346                                                    nl80211_mcgrps);
11347         if (err)
11348                 return err;
11349
11350         err = netlink_register_notifier(&nl80211_netlink_notifier);
11351         if (err)
11352                 goto err_out;
11353
11354         return 0;
11355  err_out:
11356         genl_unregister_family(&nl80211_fam);
11357         return err;
11358 }
11359
11360 void nl80211_exit(void)
11361 {
11362         netlink_unregister_notifier(&nl80211_netlink_notifier);
11363         genl_unregister_family(&nl80211_fam);
11364 }