net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  * Copyright 2013-2014  Intel Mobile Communications GmbH
   6  * Copyright 2015-2016  Intel Deutschland GmbH
   7  */
   8
   9 #include <linux/if.h>
  10 #include <linux/module.h>
  11 #include <linux/err.h>
  12 #include <linux/slab.h>
  13 #include <linux/list.h>
  14 #include <linux/if_ether.h>
  15 #include <linux/ieee80211.h>
  16 #include <linux/nl80211.h>
  17 #include <linux/rtnetlink.h>
  18 #include <linux/netlink.h>
  19 #include <linux/nospec.h>
  20 #include <linux/etherdevice.h>
  21 #include <net/net_namespace.h>
  22 #include <net/genetlink.h>
  23 #include <net/cfg80211.h>
  24 #include <net/sock.h>
  25 #include <net/inet_connection_sock.h>
  26 #include "core.h"
  27 #include "nl80211.h"
  28 #include "reg.h"
  29 #include "rdev-ops.h"
  30
  31 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  32                                    struct genl_info *info,
  33                                    struct cfg80211_crypto_settings *settings,
  34                                    int cipher_limit);
  35
  36 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
  37                             struct genl_info *info);
  38 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
  39                               struct genl_info *info);
  40
  41 /* the netlink family */
  42 static struct genl_family nl80211_fam = {
  43         .id = GENL_ID_GENERATE,         /* don't bother with a hardcoded ID */
  44         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
  45         .hdrsize = 0,                   /* no private header */
  46         .version = 1,                   /* no particular meaning now */
  47         .maxattr = NL80211_ATTR_MAX,
  48         .netnsok = true,
  49         .pre_doit = nl80211_pre_doit,
  50         .post_doit = nl80211_post_doit,
  51 };
  52
  53 /* multicast groups */
  54 enum nl80211_multicast_groups {
  55         NL80211_MCGRP_CONFIG,
  56         NL80211_MCGRP_SCAN,
  57         NL80211_MCGRP_REGULATORY,
  58         NL80211_MCGRP_MLME,
  59         NL80211_MCGRP_VENDOR,
  60         NL80211_MCGRP_NAN,
  61         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  62 };
  63
  64 static const struct genl_multicast_group nl80211_mcgrps[] = {
  65         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  66         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  67         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  68         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  69         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  70         [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
  71 #ifdef CONFIG_NL80211_TESTMODE
  72         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  73 #endif
  74 };
  75
  76 /* returns ERR_PTR values */
  77 static struct wireless_dev *
  78 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  79 {
  80         struct cfg80211_registered_device *rdev;
  81         struct wireless_dev *result = NULL;
  82         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  83         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  84         u64 wdev_id;
  85         int wiphy_idx = -1;
  86         int ifidx = -1;
  87
  88         ASSERT_RTNL();
  89
  90         if (!have_ifidx && !have_wdev_id)
  91                 return ERR_PTR(-EINVAL);
  92
  93         if (have_ifidx)
  94                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  95         if (have_wdev_id) {
  96                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  97                 wiphy_idx = wdev_id >> 32;
  98         }
  99
 100         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
 101                 struct wireless_dev *wdev;
 102
 103                 if (wiphy_net(&rdev->wiphy) != netns)
 104                         continue;
 105
 106                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
 107                         continue;
 108
 109                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
 110                         if (have_ifidx && wdev->netdev &&
 111                             wdev->netdev->ifindex == ifidx) {
 112                                 result = wdev;
 113                                 break;
 114                         }
 115                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 116                                 result = wdev;
 117                                 break;
 118                         }
 119                 }
 120
 121                 if (result)
 122                         break;
 123         }
 124
 125         if (result)
 126                 return result;
 127         return ERR_PTR(-ENODEV);
 128 }
 129
 130 static struct cfg80211_registered_device *
 131 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 132 {
 133         struct cfg80211_registered_device *rdev = NULL, *tmp;
 134         struct net_device *netdev;
 135
 136         ASSERT_RTNL();
 137
 138         if (!attrs[NL80211_ATTR_WIPHY] &&
 139             !attrs[NL80211_ATTR_IFINDEX] &&
 140             !attrs[NL80211_ATTR_WDEV])
 141                 return ERR_PTR(-EINVAL);
 142
 143         if (attrs[NL80211_ATTR_WIPHY])
 144                 rdev = cfg80211_rdev_by_wiphy_idx(
 145                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 146
 147         if (attrs[NL80211_ATTR_WDEV]) {
 148                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 149                 struct wireless_dev *wdev;
 150                 bool found = false;
 151
 152                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 153                 if (tmp) {
 154                         /* make sure wdev exists */
 155                         list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
 156                                 if (wdev->identifier != (u32)wdev_id)
 157                                         continue;
 158                                 found = true;
 159                                 break;
 160                         }
 161
 162                         if (!found)
 163                                 tmp = NULL;
 164
 165                         if (rdev && tmp != rdev)
 166                                 return ERR_PTR(-EINVAL);
 167                         rdev = tmp;
 168                 }
 169         }
 170
 171         if (attrs[NL80211_ATTR_IFINDEX]) {
 172                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 173
 174                 netdev = __dev_get_by_index(netns, ifindex);
 175                 if (netdev) {
 176                         if (netdev->ieee80211_ptr)
 177                                 tmp = wiphy_to_rdev(
 178                                         netdev->ieee80211_ptr->wiphy);
 179                         else
 180                                 tmp = NULL;
 181
 182                         /* not wireless device -- return error */
 183                         if (!tmp)
 184                                 return ERR_PTR(-EINVAL);
 185
 186                         /* mismatch -- return error */
 187                         if (rdev && tmp != rdev)
 188                                 return ERR_PTR(-EINVAL);
 189
 190                         rdev = tmp;
 191                 }
 192         }
 193
 194         if (!rdev)
 195                 return ERR_PTR(-ENODEV);
 196
 197         if (netns != wiphy_net(&rdev->wiphy))
 198                 return ERR_PTR(-ENODEV);
 199
 200         return rdev;
 201 }
 202
 203 /*
 204  * This function returns a pointer to the driver
 205  * that the genl_info item that is passed refers to.
 206  *
 207  * The result of this can be a PTR_ERR and hence must
 208  * be checked with IS_ERR() for errors.
 209  */
 210 static struct cfg80211_registered_device *
 211 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 212 {
 213         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 214 }
 215
 216 static int validate_beacon_head(const struct nlattr *attr)
 217 {
 218         const u8 *data = nla_data(attr);
 219         unsigned int len = nla_len(attr);
 220         const struct element *elem;
 221         const struct ieee80211_mgmt *mgmt = (void *)data;
 222         unsigned int fixedlen = offsetof(struct ieee80211_mgmt,
 223                                          u.beacon.variable);
 224
 225         if (len < fixedlen)
 226                 goto err;
 227
 228         if (ieee80211_hdrlen(mgmt->frame_control) !=
 229             offsetof(struct ieee80211_mgmt, u.beacon))
 230                 goto err;
 231
 232         data += fixedlen;
 233         len -= fixedlen;
 234
 235         for_each_element(elem, data, len) {
 236                 /* nothing */
 237         }
 238
 239         if (for_each_element_completed(elem, data, len))
 240                 return 0;
 241
 242 err:
 243         return -EINVAL;
 244 }
 245
 246 /* policy for the attributes */
 247 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 248         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 249         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 250                                       .len = 20-1 },
 251         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 252
 253         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 254         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 255         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 256         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 257         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 258
 259         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 260         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 261         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 262         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 263         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 264         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 265
 266         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 267         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 268         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 269
 270         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 271         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 272
 273         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 274         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 275                                     .len = WLAN_MAX_KEY_LEN },
 276         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 277         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 278         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 279         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 280         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 281
 282         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 283         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 284         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 285                                        .len = IEEE80211_MAX_DATA_LEN },
 286         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 287                                        .len = IEEE80211_MAX_DATA_LEN },
 288         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 289         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 290         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 291         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 292                                                .len = NL80211_MAX_SUPP_RATES },
 293         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 294         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 295         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 296         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 297                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 298         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_BINARY,
 299                                           .len = ETH_ALEN },
 300
 301         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 302         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 303
 304         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 305         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 306         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 307         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 308                                            .len = NL80211_MAX_SUPP_RATES },
 309         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 310
 311         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 312         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 313
 314         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 315
 316         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 317         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 318                               .len = IEEE80211_MAX_DATA_LEN },
 319         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 320         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 321
 322         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 323                                 .len = IEEE80211_MAX_SSID_LEN },
 324         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 325         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 326         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 327         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 328         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 329         [NL80211_ATTR_STA_FLAGS2] = {
 330                 .len = sizeof(struct nl80211_sta_flag_update),
 331         },
 332         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 333         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 334         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 335         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 336         [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 },
 337         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 338         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 339         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 340         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 341         [NL80211_ATTR_PMKID] = { .len = WLAN_PMKID_LEN },
 342         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 343         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 344         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 345         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 346                                  .len = IEEE80211_MAX_DATA_LEN },
 347         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 348         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 349         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 350         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 351         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 352         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 353         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 354         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 355         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 356         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 357         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 358         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 359         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 360         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 361         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 362         [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 },
 363         [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG },
 364         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 365         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 366         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 367         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 368         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 369                                          .len = IEEE80211_MAX_DATA_LEN },
 370         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 371                                          .len = IEEE80211_MAX_DATA_LEN },
 372         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 373         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 374         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 375         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 376         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 377         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 378         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 379         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 380         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 381         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 382         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 383                                       .len = IEEE80211_MAX_DATA_LEN },
 384         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 385         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 386         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 387                 .len = NL80211_HT_CAPABILITY_LEN
 388         },
 389         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 390         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 391         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 392         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 393         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 394         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 395         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 396         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 397         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 398         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 399         [NL80211_ATTR_LOCAL_MESH_POWER_MODE] = {. type = NLA_U32 },
 400         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 401         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 402         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 403         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 404         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 405         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 406         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 407                 .len = NL80211_VHT_CAPABILITY_LEN,
 408         },
 409         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 410         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 411                                   .len = IEEE80211_MAX_DATA_LEN },
 412         [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 },
 413         [NL80211_ATTR_MAX_CRIT_PROT_DURATION] = { .type = NLA_U16 },
 414         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 415         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 416         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 417         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 418         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
 419         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
 420         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 421         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 422         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 423         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 424         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 425         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 426         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 427         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 428                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 429         [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
 430         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 431         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 432         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 433         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 434         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 435         [NL80211_ATTR_TSID] = { .type = NLA_U8 },
 436         [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 },
 437         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 438         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 439         [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 },
 440         [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
 441         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 442         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 443         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 444         [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 445         [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
 446         [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
 447         [NL80211_ATTR_STA_SUPPORT_P2P_PS] = { .type = NLA_U8 },
 448         [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
 449                 .len = VHT_MUMIMO_GROUPS_DATA_LEN
 450         },
 451         [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = { .len = ETH_ALEN },
 452         [NL80211_ATTR_NAN_MASTER_PREF] = { .type = NLA_U8 },
 453         [NL80211_ATTR_NAN_DUAL] = { .type = NLA_U8 },
 454         [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
 455         [NL80211_ATTR_BSSID] = { .len = ETH_ALEN },
 456 };
 457
 458 /* policy for the key attributes */
 459 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 460         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 461         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 462         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 463         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 464         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 465         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 466         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 467         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 468 };
 469
 470 /* policy for the key default flags */
 471 static const struct nla_policy
 472 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 473         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 474         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 475 };
 476
 477 /* policy for WoWLAN attributes */
 478 static const struct nla_policy
 479 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 480         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 481         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 482         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 483         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 484         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 485         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 486         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 487         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 488         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 489         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 490 };
 491
 492 static const struct nla_policy
 493 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 494         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 495         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 496         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 497         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 498         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 499         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 500         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 501                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 502         },
 503         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 504                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 505         },
 506         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 507         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 508         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 509 };
 510
 511 /* policy for coalesce rule attributes */
 512 static const struct nla_policy
 513 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 514         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 515         [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
 516         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 517 };
 518
 519 /* policy for GTK rekey offload attributes */
 520 static const struct nla_policy
 521 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 522         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 523         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 524         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 525 };
 526
 527 static const struct nla_policy
 528 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 529         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 530                                                  .len = IEEE80211_MAX_SSID_LEN },
 531         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 532 };
 533
 534 static const struct nla_policy
 535 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 536         [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 537         [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 538 };
 539
 540 static const struct nla_policy
 541 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
 542         [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
 543         [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
 544         [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
 545                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 546         },
 547 };
 548
 549 /* policy for NAN function attributes */
 550 static const struct nla_policy
 551 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
 552         [NL80211_NAN_FUNC_TYPE] = { .type = NLA_U8 },
 553         [NL80211_NAN_FUNC_SERVICE_ID] = {
 554                                     .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
 555         [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
 556         [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
 557         [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
 558         [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
 559         [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
 560         [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = { .len = ETH_ALEN },
 561         [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
 562         [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
 563         [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
 564                         .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
 565         [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
 566         [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
 567         [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
 568         [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
 569         [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
 570 };
 571
 572 /* policy for Service Response Filter attributes */
 573 static const struct nla_policy
 574 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
 575         [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
 576         [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
 577                                  .len =  NL80211_NAN_FUNC_SRF_MAX_LEN },
 578         [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
 579         [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
 580 };
 581
 582 /* policy for packet pattern attributes */
 583 static const struct nla_policy
 584 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
 585         [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
 586         [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
 587         [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
 588 };
 589
 590 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 591                                      struct netlink_callback *cb,
 592                                      struct cfg80211_registered_device **rdev,
 593                                      struct wireless_dev **wdev)
 594 {
 595         int err;
 596
 597         if (!cb->args[0]) {
 598                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 599                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
 600                                   nl80211_policy);
 601                 if (err)
 602                         return err;
 603
 604                 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
 605                                                    nl80211_fam.attrbuf);
 606                 if (IS_ERR(*wdev))
 607                         return PTR_ERR(*wdev);
 608                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 609                 /* 0 is the first index - add 1 to parse only once */
 610                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 611                 cb->args[1] = (*wdev)->identifier;
 612         } else {
 613                 /* subtract the 1 again here */
 614                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 615                 struct wireless_dev *tmp;
 616
 617                 if (!wiphy)
 618                         return -ENODEV;
 619                 *rdev = wiphy_to_rdev(wiphy);
 620                 *wdev = NULL;
 621
 622                 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
 623                         if (tmp->identifier == cb->args[1]) {
 624                                 *wdev = tmp;
 625                                 break;
 626                         }
 627                 }
 628
 629                 if (!*wdev)
 630                         return -ENODEV;
 631         }
 632
 633         return 0;
 634 }
 635
 636 /* IE validation */
 637 static bool is_valid_ie_attr(const struct nlattr *attr)
 638 {
 639         const u8 *pos;
 640         int len;
 641
 642         if (!attr)
 643                 return true;
 644
 645         pos = nla_data(attr);
 646         len = nla_len(attr);
 647
 648         while (len) {
 649                 u8 elemlen;
 650
 651                 if (len < 2)
 652                         return false;
 653                 len -= 2;
 654
 655                 elemlen = pos[1];
 656                 if (elemlen > len)
 657                         return false;
 658
 659                 len -= elemlen;
 660                 pos += 2 + elemlen;
 661         }
 662
 663         return true;
 664 }
 665
 666 /* message building helper */
 667 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 668                                    int flags, u8 cmd)
 669 {
 670         /* since there is no private header just add the generic one */
 671         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 672 }
 673
 674 static int nl80211_msg_put_channel(struct sk_buff *msg,
 675                                    struct ieee80211_channel *chan,
 676                                    bool large)
 677 {
 678         /* Some channels must be completely excluded from the
 679          * list to protect old user-space tools from breaking
 680          */
 681         if (!large && chan->flags &
 682             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 683                 return 0;
 684
 685         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 686                         chan->center_freq))
 687                 goto nla_put_failure;
 688
 689         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 690             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 691                 goto nla_put_failure;
 692         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 693                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 694                         goto nla_put_failure;
 695                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 696                         goto nla_put_failure;
 697         }
 698         if (chan->flags & IEEE80211_CHAN_RADAR) {
 699                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 700                         goto nla_put_failure;
 701                 if (large) {
 702                         u32 time;
 703
 704                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 705
 706                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 707                                         chan->dfs_state))
 708                                 goto nla_put_failure;
 709                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 710                                         time))
 711                                 goto nla_put_failure;
 712                         if (nla_put_u32(msg,
 713                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 714                                         chan->dfs_cac_ms))
 715                                 goto nla_put_failure;
 716                 }
 717         }
 718
 719         if (large) {
 720                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 721                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 722                         goto nla_put_failure;
 723                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 724                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 725                         goto nla_put_failure;
 726                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 727                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 728                         goto nla_put_failure;
 729                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 730                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 731                         goto nla_put_failure;
 732                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 733                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 734                         goto nla_put_failure;
 735                 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
 736                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
 737                         goto nla_put_failure;
 738                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 739                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 740                         goto nla_put_failure;
 741                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 742                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 743                         goto nla_put_failure;
 744         }
 745
 746         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 747                         DBM_TO_MBM(chan->max_power)))
 748                 goto nla_put_failure;
 749
 750         return 0;
 751
 752  nla_put_failure:
 753         return -ENOBUFS;
 754 }
 755
 756 /* netlink command implementations */
 757
 758 struct key_parse {
 759         struct key_params p;
 760         int idx;
 761         int type;
 762         bool def, defmgmt;
 763         bool def_uni, def_multi;
 764 };
 765
 766 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 767 {
 768         struct nlattr *tb[NL80211_KEY_MAX + 1];
 769         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 770                                    nl80211_key_policy);
 771         if (err)
 772                 return err;
 773
 774         k->def = !!tb[NL80211_KEY_DEFAULT];
 775         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 776
 777         if (k->def) {
 778                 k->def_uni = true;
 779                 k->def_multi = true;
 780         }
 781         if (k->defmgmt)
 782                 k->def_multi = true;
 783
 784         if (tb[NL80211_KEY_IDX])
 785                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 786
 787         if (tb[NL80211_KEY_DATA]) {
 788                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 789                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 790         }
 791
 792         if (tb[NL80211_KEY_SEQ]) {
 793                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 794                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 795         }
 796
 797         if (tb[NL80211_KEY_CIPHER])
 798                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 799
 800         if (tb[NL80211_KEY_TYPE]) {
 801                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 802                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 803                         return -EINVAL;
 804         }
 805
 806         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 807                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 808
 809                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 810                                        tb[NL80211_KEY_DEFAULT_TYPES],
 811                                        nl80211_key_default_policy);
 812                 if (err)
 813                         return err;
 814
 815                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 816                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 817         }
 818
 819         return 0;
 820 }
 821
 822 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 823 {
 824         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 825                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 826                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 827         }
 828
 829         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 830                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 831                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 832         }
 833
 834         if (info->attrs[NL80211_ATTR_KEY_IDX])
 835                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 836
 837         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 838                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 839
 840         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 841         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 842
 843         if (k->def) {
 844                 k->def_uni = true;
 845                 k->def_multi = true;
 846         }
 847         if (k->defmgmt)
 848                 k->def_multi = true;
 849
 850         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 851                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 852                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 853                         return -EINVAL;
 854         }
 855
 856         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 857                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 858                 int err = nla_parse_nested(
 859                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 860                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 861                                 nl80211_key_default_policy);
 862                 if (err)
 863                         return err;
 864
 865                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 866                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 867         }
 868
 869         return 0;
 870 }
 871
 872 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 873 {
 874         int err;
 875
 876         memset(k, 0, sizeof(*k));
 877         k->idx = -1;
 878         k->type = -1;
 879
 880         if (info->attrs[NL80211_ATTR_KEY])
 881                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 882         else
 883                 err = nl80211_parse_key_old(info, k);
 884
 885         if (err)
 886                 return err;
 887
 888         if (k->def && k->defmgmt)
 889                 return -EINVAL;
 890
 891         if (k->defmgmt) {
 892                 if (k->def_uni || !k->def_multi)
 893                         return -EINVAL;
 894         }
 895
 896         if (k->idx != -1) {
 897                 if (k->defmgmt) {
 898                         if (k->idx < 4 || k->idx > 5)
 899                                 return -EINVAL;
 900                 } else if (k->def) {
 901                         if (k->idx < 0 || k->idx > 3)
 902                                 return -EINVAL;
 903                 } else {
 904                         if (k->idx < 0 || k->idx > 5)
 905                                 return -EINVAL;
 906                 }
 907         }
 908
 909         return 0;
 910 }
 911
 912 static struct cfg80211_cached_keys *
 913 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 914                        struct nlattr *keys, bool *no_ht)
 915 {
 916         struct key_parse parse;
 917         struct nlattr *key;
 918         struct cfg80211_cached_keys *result;
 919         int rem, err, def = 0;
 920         bool have_key = false;
 921
 922         nla_for_each_nested(key, keys, rem) {
 923                 have_key = true;
 924                 break;
 925         }
 926
 927         if (!have_key)
 928                 return NULL;
 929
 930         result = kzalloc(sizeof(*result), GFP_KERNEL);
 931         if (!result)
 932                 return ERR_PTR(-ENOMEM);
 933
 934         result->def = -1;
 935
 936         nla_for_each_nested(key, keys, rem) {
 937                 memset(&parse, 0, sizeof(parse));
 938                 parse.idx = -1;
 939
 940                 err = nl80211_parse_key_new(key, &parse);
 941                 if (err)
 942                         goto error;
 943                 err = -EINVAL;
 944                 if (!parse.p.key)
 945                         goto error;
 946                 if (parse.idx < 0 || parse.idx > 3)
 947                         goto error;
 948                 if (parse.def) {
 949                         if (def)
 950                                 goto error;
 951                         def = 1;
 952                         result->def = parse.idx;
 953                         if (!parse.def_uni || !parse.def_multi)
 954                                 goto error;
 955                 } else if (parse.defmgmt)
 956                         goto error;
 957                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 958                                                      parse.idx, false, NULL);
 959                 if (err)
 960                         goto error;
 961                 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
 962                     parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
 963                         err = -EINVAL;
 964                         goto error;
 965                 }
 966                 result->params[parse.idx].cipher = parse.p.cipher;
 967                 result->params[parse.idx].key_len = parse.p.key_len;
 968                 result->params[parse.idx].key = result->data[parse.idx];
 969                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 970
 971                 /* must be WEP key if we got here */
 972                 if (no_ht)
 973                         *no_ht = true;
 974         }
 975
 976         if (result->def < 0) {
 977                 err = -EINVAL;
 978                 goto error;
 979         }
 980
 981         return result;
 982  error:
 983         kfree(result);
 984         return ERR_PTR(err);
 985 }
 986
 987 static int nl80211_key_allowed(struct wireless_dev *wdev)
 988 {
 989         ASSERT_WDEV_LOCK(wdev);
 990
 991         switch (wdev->iftype) {
 992         case NL80211_IFTYPE_AP:
 993         case NL80211_IFTYPE_AP_VLAN:
 994         case NL80211_IFTYPE_P2P_GO:
 995         case NL80211_IFTYPE_MESH_POINT:
 996                 break;
 997         case NL80211_IFTYPE_ADHOC:
 998         case NL80211_IFTYPE_STATION:
 999         case NL80211_IFTYPE_P2P_CLIENT:
1000                 if (!wdev->current_bss)
1001                         return -ENOLINK;
1002                 break;
1003         case NL80211_IFTYPE_UNSPECIFIED:
1004         case NL80211_IFTYPE_OCB:
1005         case NL80211_IFTYPE_MONITOR:
1006         case NL80211_IFTYPE_NAN:
1007         case NL80211_IFTYPE_P2P_DEVICE:
1008         case NL80211_IFTYPE_WDS:
1009         case NUM_NL80211_IFTYPES:
1010                 return -EINVAL;
1011         }
1012
1013         return 0;
1014 }
1015
1016 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1017                                                         struct nlattr *tb)
1018 {
1019         struct ieee80211_channel *chan;
1020
1021         if (tb == NULL)
1022                 return NULL;
1023         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
1024         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1025                 return NULL;
1026         return chan;
1027 }
1028
1029 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1030 {
1031         struct nlattr *nl_modes = nla_nest_start(msg, attr);
1032         int i;
1033
1034         if (!nl_modes)
1035                 goto nla_put_failure;
1036
1037         i = 0;
1038         while (ifmodes) {
1039                 if ((ifmodes & 1) && nla_put_flag(msg, i))
1040                         goto nla_put_failure;
1041                 ifmodes >>= 1;
1042                 i++;
1043         }
1044
1045         nla_nest_end(msg, nl_modes);
1046         return 0;
1047
1048 nla_put_failure:
1049         return -ENOBUFS;
1050 }
1051
1052 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1053                                           struct sk_buff *msg,
1054                                           bool large)
1055 {
1056         struct nlattr *nl_combis;
1057         int i, j;
1058
1059         nl_combis = nla_nest_start(msg,
1060                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
1061         if (!nl_combis)
1062                 goto nla_put_failure;
1063
1064         for (i = 0; i < wiphy->n_iface_combinations; i++) {
1065                 const struct ieee80211_iface_combination *c;
1066                 struct nlattr *nl_combi, *nl_limits;
1067
1068                 c = &wiphy->iface_combinations[i];
1069
1070                 nl_combi = nla_nest_start(msg, i + 1);
1071                 if (!nl_combi)
1072                         goto nla_put_failure;
1073
1074                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
1075                 if (!nl_limits)
1076                         goto nla_put_failure;
1077
1078                 for (j = 0; j < c->n_limits; j++) {
1079                         struct nlattr *nl_limit;
1080
1081                         nl_limit = nla_nest_start(msg, j + 1);
1082                         if (!nl_limit)
1083                                 goto nla_put_failure;
1084                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1085                                         c->limits[j].max))
1086                                 goto nla_put_failure;
1087                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1088                                                 c->limits[j].types))
1089                                 goto nla_put_failure;
1090                         nla_nest_end(msg, nl_limit);
1091                 }
1092
1093                 nla_nest_end(msg, nl_limits);
1094
1095                 if (c->beacon_int_infra_match &&
1096                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1097                         goto nla_put_failure;
1098                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1099                                 c->num_different_channels) ||
1100                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1101                                 c->max_interfaces))
1102                         goto nla_put_failure;
1103                 if (large &&
1104                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1105                                 c->radar_detect_widths) ||
1106                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1107                                 c->radar_detect_regions)))
1108                         goto nla_put_failure;
1109
1110                 nla_nest_end(msg, nl_combi);
1111         }
1112
1113         nla_nest_end(msg, nl_combis);
1114
1115         return 0;
1116 nla_put_failure:
1117         return -ENOBUFS;
1118 }
1119
1120 #ifdef CONFIG_PM
1121 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1122                                         struct sk_buff *msg)
1123 {
1124         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1125         struct nlattr *nl_tcp;
1126
1127         if (!tcp)
1128                 return 0;
1129
1130         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1131         if (!nl_tcp)
1132                 return -ENOBUFS;
1133
1134         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1135                         tcp->data_payload_max))
1136                 return -ENOBUFS;
1137
1138         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1139                         tcp->data_payload_max))
1140                 return -ENOBUFS;
1141
1142         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1143                 return -ENOBUFS;
1144
1145         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1146                                 sizeof(*tcp->tok), tcp->tok))
1147                 return -ENOBUFS;
1148
1149         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1150                         tcp->data_interval_max))
1151                 return -ENOBUFS;
1152
1153         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1154                         tcp->wake_payload_max))
1155                 return -ENOBUFS;
1156
1157         nla_nest_end(msg, nl_tcp);
1158         return 0;
1159 }
1160
1161 static int nl80211_send_wowlan(struct sk_buff *msg,
1162                                struct cfg80211_registered_device *rdev,
1163                                bool large)
1164 {
1165         struct nlattr *nl_wowlan;
1166
1167         if (!rdev->wiphy.wowlan)
1168                 return 0;
1169
1170         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1171         if (!nl_wowlan)
1172                 return -ENOBUFS;
1173
1174         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1175              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1176             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1177              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1178             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1179              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1180             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1181              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1182             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1183              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1184             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1185              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1186             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1187              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1188             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1189              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1190                 return -ENOBUFS;
1191
1192         if (rdev->wiphy.wowlan->n_patterns) {
1193                 struct nl80211_pattern_support pat = {
1194                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1195                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1196                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1197                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1198                 };
1199
1200                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1201                             sizeof(pat), &pat))
1202                         return -ENOBUFS;
1203         }
1204
1205         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1206             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1207                         rdev->wiphy.wowlan->max_nd_match_sets))
1208                 return -ENOBUFS;
1209
1210         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1211                 return -ENOBUFS;
1212
1213         nla_nest_end(msg, nl_wowlan);
1214
1215         return 0;
1216 }
1217 #endif
1218
1219 static int nl80211_send_coalesce(struct sk_buff *msg,
1220                                  struct cfg80211_registered_device *rdev)
1221 {
1222         struct nl80211_coalesce_rule_support rule;
1223
1224         if (!rdev->wiphy.coalesce)
1225                 return 0;
1226
1227         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1228         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1229         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1230         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1231         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1232         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1233
1234         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1235                 return -ENOBUFS;
1236
1237         return 0;
1238 }
1239
1240 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1241                                       struct ieee80211_supported_band *sband)
1242 {
1243         struct nlattr *nl_rates, *nl_rate;
1244         struct ieee80211_rate *rate;
1245         int i;
1246
1247         /* add HT info */
1248         if (sband->ht_cap.ht_supported &&
1249             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1250                      sizeof(sband->ht_cap.mcs),
1251                      &sband->ht_cap.mcs) ||
1252              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1253                          sband->ht_cap.cap) ||
1254              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1255                         sband->ht_cap.ampdu_factor) ||
1256              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1257                         sband->ht_cap.ampdu_density)))
1258                 return -ENOBUFS;
1259
1260         /* add VHT info */
1261         if (sband->vht_cap.vht_supported &&
1262             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1263                      sizeof(sband->vht_cap.vht_mcs),
1264                      &sband->vht_cap.vht_mcs) ||
1265              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1266                          sband->vht_cap.cap)))
1267                 return -ENOBUFS;
1268
1269         /* add bitrates */
1270         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1271         if (!nl_rates)
1272                 return -ENOBUFS;
1273
1274         for (i = 0; i < sband->n_bitrates; i++) {
1275                 nl_rate = nla_nest_start(msg, i);
1276                 if (!nl_rate)
1277                         return -ENOBUFS;
1278
1279                 rate = &sband->bitrates[i];
1280                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1281                                 rate->bitrate))
1282                         return -ENOBUFS;
1283                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1284                     nla_put_flag(msg,
1285                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1286                         return -ENOBUFS;
1287
1288                 nla_nest_end(msg, nl_rate);
1289         }
1290
1291         nla_nest_end(msg, nl_rates);
1292
1293         return 0;
1294 }
1295
1296 static int
1297 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1298                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1299 {
1300         u16 stypes;
1301         struct nlattr *nl_ftypes, *nl_ifs;
1302         enum nl80211_iftype ift;
1303         int i;
1304
1305         if (!mgmt_stypes)
1306                 return 0;
1307
1308         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1309         if (!nl_ifs)
1310                 return -ENOBUFS;
1311
1312         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1313                 nl_ftypes = nla_nest_start(msg, ift);
1314                 if (!nl_ftypes)
1315                         return -ENOBUFS;
1316                 i = 0;
1317                 stypes = mgmt_stypes[ift].tx;
1318                 while (stypes) {
1319                         if ((stypes & 1) &&
1320                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1321                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1322                                 return -ENOBUFS;
1323                         stypes >>= 1;
1324                         i++;
1325                 }
1326                 nla_nest_end(msg, nl_ftypes);
1327         }
1328
1329         nla_nest_end(msg, nl_ifs);
1330
1331         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1332         if (!nl_ifs)
1333                 return -ENOBUFS;
1334
1335         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1336                 nl_ftypes = nla_nest_start(msg, ift);
1337                 if (!nl_ftypes)
1338                         return -ENOBUFS;
1339                 i = 0;
1340                 stypes = mgmt_stypes[ift].rx;
1341                 while (stypes) {
1342                         if ((stypes & 1) &&
1343                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1344                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1345                                 return -ENOBUFS;
1346                         stypes >>= 1;
1347                         i++;
1348                 }
1349                 nla_nest_end(msg, nl_ftypes);
1350         }
1351         nla_nest_end(msg, nl_ifs);
1352
1353         return 0;
1354 }
1355
1356 struct nl80211_dump_wiphy_state {
1357         s64 filter_wiphy;
1358         long start;
1359         long split_start, band_start, chan_start, capa_start;
1360         bool split;
1361 };
1362
1363 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1364                               enum nl80211_commands cmd,
1365                               struct sk_buff *msg, u32 portid, u32 seq,
1366                               int flags, struct nl80211_dump_wiphy_state *state)
1367 {
1368         void *hdr;
1369         struct nlattr *nl_bands, *nl_band;
1370         struct nlattr *nl_freqs, *nl_freq;
1371         struct nlattr *nl_cmds;
1372         enum nl80211_band band;
1373         struct ieee80211_channel *chan;
1374         int i;
1375         const struct ieee80211_txrx_stypes *mgmt_stypes =
1376                                 rdev->wiphy.mgmt_stypes;
1377         u32 features;
1378
1379         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1380         if (!hdr)
1381                 return -ENOBUFS;
1382
1383         if (WARN_ON(!state))
1384                 return -EINVAL;
1385
1386         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1387             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1388                            wiphy_name(&rdev->wiphy)) ||
1389             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1390                         cfg80211_rdev_list_generation))
1391                 goto nla_put_failure;
1392
1393         if (cmd != NL80211_CMD_NEW_WIPHY)
1394                 goto finish;
1395
1396         switch (state->split_start) {
1397         case 0:
1398                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1399                                rdev->wiphy.retry_short) ||
1400                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1401                                rdev->wiphy.retry_long) ||
1402                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1403                                 rdev->wiphy.frag_threshold) ||
1404                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1405                                 rdev->wiphy.rts_threshold) ||
1406                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1407                                rdev->wiphy.coverage_class) ||
1408                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1409                                rdev->wiphy.max_scan_ssids) ||
1410                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1411                                rdev->wiphy.max_sched_scan_ssids) ||
1412                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1413                                 rdev->wiphy.max_scan_ie_len) ||
1414                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1415                                 rdev->wiphy.max_sched_scan_ie_len) ||
1416                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1417                                rdev->wiphy.max_match_sets) ||
1418                     nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
1419                                 rdev->wiphy.max_sched_scan_plans) ||
1420                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
1421                                 rdev->wiphy.max_sched_scan_plan_interval) ||
1422                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
1423                                 rdev->wiphy.max_sched_scan_plan_iterations))
1424                         goto nla_put_failure;
1425
1426                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1427                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1428                         goto nla_put_failure;
1429                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1430                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1431                         goto nla_put_failure;
1432                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1433                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1434                         goto nla_put_failure;
1435                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1436                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1437                         goto nla_put_failure;
1438                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1439                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1440                         goto nla_put_failure;
1441                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1442                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1443                         goto nla_put_failure;
1444                 state->split_start++;
1445                 if (state->split)
1446                         break;
1447         case 1:
1448                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1449                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1450                             rdev->wiphy.cipher_suites))
1451                         goto nla_put_failure;
1452
1453                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1454                                rdev->wiphy.max_num_pmkids))
1455                         goto nla_put_failure;
1456
1457                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1458                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1459                         goto nla_put_failure;
1460
1461                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1462                                 rdev->wiphy.available_antennas_tx) ||
1463                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1464                                 rdev->wiphy.available_antennas_rx))
1465                         goto nla_put_failure;
1466
1467                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1468                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1469                                 rdev->wiphy.probe_resp_offload))
1470                         goto nla_put_failure;
1471
1472                 if ((rdev->wiphy.available_antennas_tx ||
1473                      rdev->wiphy.available_antennas_rx) &&
1474                     rdev->ops->get_antenna) {
1475                         u32 tx_ant = 0, rx_ant = 0;
1476                         int res;
1477
1478                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1479                         if (!res) {
1480                                 if (nla_put_u32(msg,
1481                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1482                                                 tx_ant) ||
1483                                     nla_put_u32(msg,
1484                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1485                                                 rx_ant))
1486                                         goto nla_put_failure;
1487                         }
1488                 }
1489
1490                 state->split_start++;
1491                 if (state->split)
1492                         break;
1493         case 2:
1494                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1495                                         rdev->wiphy.interface_modes))
1496                                 goto nla_put_failure;
1497                 state->split_start++;
1498                 if (state->split)
1499                         break;
1500         case 3:
1501                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1502                 if (!nl_bands)
1503                         goto nla_put_failure;
1504
1505                 for (band = state->band_start;
1506                      band < NUM_NL80211_BANDS; band++) {
1507                         struct ieee80211_supported_band *sband;
1508
1509                         sband = rdev->wiphy.bands[band];
1510
1511                         if (!sband)
1512                                 continue;
1513
1514                         nl_band = nla_nest_start(msg, band);
1515                         if (!nl_band)
1516                                 goto nla_put_failure;
1517
1518                         switch (state->chan_start) {
1519                         case 0:
1520                                 if (nl80211_send_band_rateinfo(msg, sband))
1521                                         goto nla_put_failure;
1522                                 state->chan_start++;
1523                                 if (state->split)
1524                                         break;
1525                         default:
1526                                 /* add frequencies */
1527                                 nl_freqs = nla_nest_start(
1528                                         msg, NL80211_BAND_ATTR_FREQS);
1529                                 if (!nl_freqs)
1530                                         goto nla_put_failure;
1531
1532                                 for (i = state->chan_start - 1;
1533                                      i < sband->n_channels;
1534                                      i++) {
1535                                         nl_freq = nla_nest_start(msg, i);
1536                                         if (!nl_freq)
1537                                                 goto nla_put_failure;
1538
1539                                         chan = &sband->channels[i];
1540
1541                                         if (nl80211_msg_put_channel(
1542                                                         msg, chan,
1543                                                         state->split))
1544                                                 goto nla_put_failure;
1545
1546                                         nla_nest_end(msg, nl_freq);
1547                                         if (state->split)
1548                                                 break;
1549                                 }
1550                                 if (i < sband->n_channels)
1551                                         state->chan_start = i + 2;
1552                                 else
1553                                         state->chan_start = 0;
1554                                 nla_nest_end(msg, nl_freqs);
1555                         }
1556
1557                         nla_nest_end(msg, nl_band);
1558
1559                         if (state->split) {
1560                                 /* start again here */
1561                                 if (state->chan_start)
1562                                         band--;
1563                                 break;
1564                         }
1565                 }
1566                 nla_nest_end(msg, nl_bands);
1567
1568                 if (band < NUM_NL80211_BANDS)
1569                         state->band_start = band + 1;
1570                 else
1571                         state->band_start = 0;
1572
1573                 /* if bands & channels are done, continue outside */
1574                 if (state->band_start == 0 && state->chan_start == 0)
1575                         state->split_start++;
1576                 if (state->split)
1577                         break;
1578         case 4:
1579                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1580                 if (!nl_cmds)
1581                         goto nla_put_failure;
1582
1583                 i = 0;
1584 #define CMD(op, n)                                                      \
1585                  do {                                                   \
1586                         if (rdev->ops->op) {                            \
1587                                 i++;                                    \
1588                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1589                                         goto nla_put_failure;           \
1590                         }                                               \
1591                 } while (0)
1592
1593                 CMD(add_virtual_intf, NEW_INTERFACE);
1594                 CMD(change_virtual_intf, SET_INTERFACE);
1595                 CMD(add_key, NEW_KEY);
1596                 CMD(start_ap, START_AP);
1597                 CMD(add_station, NEW_STATION);
1598                 CMD(add_mpath, NEW_MPATH);
1599                 CMD(update_mesh_config, SET_MESH_CONFIG);
1600                 CMD(change_bss, SET_BSS);
1601                 CMD(auth, AUTHENTICATE);
1602                 CMD(assoc, ASSOCIATE);
1603                 CMD(deauth, DEAUTHENTICATE);
1604                 CMD(disassoc, DISASSOCIATE);
1605                 CMD(join_ibss, JOIN_IBSS);
1606                 CMD(join_mesh, JOIN_MESH);
1607                 CMD(set_pmksa, SET_PMKSA);
1608                 CMD(del_pmksa, DEL_PMKSA);
1609                 CMD(flush_pmksa, FLUSH_PMKSA);
1610                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1611                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1612                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1613                 CMD(mgmt_tx, FRAME);
1614                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1615                 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1616                         i++;
1617                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1618                                 goto nla_put_failure;
1619                 }
1620                 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1621                     rdev->ops->join_mesh) {
1622                         i++;
1623                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1624                                 goto nla_put_failure;
1625                 }
1626                 CMD(set_wds_peer, SET_WDS_PEER);
1627                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1628                         CMD(tdls_mgmt, TDLS_MGMT);
1629                         CMD(tdls_oper, TDLS_OPER);
1630                 }
1631                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1632                         CMD(sched_scan_start, START_SCHED_SCAN);
1633                 CMD(probe_client, PROBE_CLIENT);
1634                 CMD(set_noack_map, SET_NOACK_MAP);
1635                 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1636                         i++;
1637                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1638                                 goto nla_put_failure;
1639                 }
1640                 CMD(start_p2p_device, START_P2P_DEVICE);
1641                 CMD(set_mcast_rate, SET_MCAST_RATE);
1642 #ifdef CONFIG_NL80211_TESTMODE
1643                 CMD(testmode_cmd, TESTMODE);
1644 #endif
1645                 if (state->split) {
1646                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1647                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1648                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1649                                 CMD(channel_switch, CHANNEL_SWITCH);
1650                         CMD(set_qos_map, SET_QOS_MAP);
1651                         if (rdev->wiphy.features &
1652                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
1653                                 CMD(add_tx_ts, ADD_TX_TS);
1654                 }
1655                 /* add into the if now */
1656 #undef CMD
1657
1658                 if (rdev->ops->connect || rdev->ops->auth) {
1659                         i++;
1660                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1661                                 goto nla_put_failure;
1662                 }
1663
1664                 if (rdev->ops->disconnect || rdev->ops->deauth) {
1665                         i++;
1666                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1667                                 goto nla_put_failure;
1668                 }
1669
1670                 nla_nest_end(msg, nl_cmds);
1671                 state->split_start++;
1672                 if (state->split)
1673                         break;
1674         case 5:
1675                 if (rdev->ops->remain_on_channel &&
1676                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1677                     nla_put_u32(msg,
1678                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1679                                 rdev->wiphy.max_remain_on_channel_duration))
1680                         goto nla_put_failure;
1681
1682                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1683                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1684                         goto nla_put_failure;
1685
1686                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1687                         goto nla_put_failure;
1688                 state->split_start++;
1689                 if (state->split)
1690                         break;
1691         case 6:
1692 #ifdef CONFIG_PM
1693                 if (nl80211_send_wowlan(msg, rdev, state->split))
1694                         goto nla_put_failure;
1695                 state->split_start++;
1696                 if (state->split)
1697                         break;
1698 #else
1699                 state->split_start++;
1700 #endif
1701         case 7:
1702                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1703                                         rdev->wiphy.software_iftypes))
1704                         goto nla_put_failure;
1705
1706                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1707                                                    state->split))
1708                         goto nla_put_failure;
1709
1710                 state->split_start++;
1711                 if (state->split)
1712                         break;
1713         case 8:
1714                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1715                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1716                                 rdev->wiphy.ap_sme_capa))
1717                         goto nla_put_failure;
1718
1719                 features = rdev->wiphy.features;
1720                 /*
1721                  * We can only add the per-channel limit information if the
1722                  * dump is split, otherwise it makes it too big. Therefore
1723                  * only advertise it in that case.
1724                  */
1725                 if (state->split)
1726                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1727                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1728                         goto nla_put_failure;
1729
1730                 if (rdev->wiphy.ht_capa_mod_mask &&
1731                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1732                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
1733                             rdev->wiphy.ht_capa_mod_mask))
1734                         goto nla_put_failure;
1735
1736                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1737                     rdev->wiphy.max_acl_mac_addrs &&
1738                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1739                                 rdev->wiphy.max_acl_mac_addrs))
1740                         goto nla_put_failure;
1741
1742                 /*
1743                  * Any information below this point is only available to
1744                  * applications that can deal with it being split. This
1745                  * helps ensure that newly added capabilities don't break
1746                  * older tools by overrunning their buffers.
1747                  *
1748                  * We still increment split_start so that in the split
1749                  * case we'll continue with more data in the next round,
1750                  * but break unconditionally so unsplit data stops here.
1751                  */
1752                 if (state->split)
1753                         state->split_start++;
1754                 else
1755                         state->split_start = 0;
1756                 break;
1757         case 9:
1758                 if (rdev->wiphy.extended_capabilities &&
1759                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1760                              rdev->wiphy.extended_capabilities_len,
1761                              rdev->wiphy.extended_capabilities) ||
1762                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1763                              rdev->wiphy.extended_capabilities_len,
1764                              rdev->wiphy.extended_capabilities_mask)))
1765                         goto nla_put_failure;
1766
1767                 if (rdev->wiphy.vht_capa_mod_mask &&
1768                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1769                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
1770                             rdev->wiphy.vht_capa_mod_mask))
1771                         goto nla_put_failure;
1772
1773                 state->split_start++;
1774                 break;
1775         case 10:
1776                 if (nl80211_send_coalesce(msg, rdev))
1777                         goto nla_put_failure;
1778
1779                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1780                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1781                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1782                         goto nla_put_failure;
1783
1784                 if (rdev->wiphy.max_ap_assoc_sta &&
1785                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1786                                 rdev->wiphy.max_ap_assoc_sta))
1787                         goto nla_put_failure;
1788
1789                 state->split_start++;
1790                 break;
1791         case 11:
1792                 if (rdev->wiphy.n_vendor_commands) {
1793                         const struct nl80211_vendor_cmd_info *info;
1794                         struct nlattr *nested;
1795
1796                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1797                         if (!nested)
1798                                 goto nla_put_failure;
1799
1800                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1801                                 info = &rdev->wiphy.vendor_commands[i].info;
1802                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1803                                         goto nla_put_failure;
1804                         }
1805                         nla_nest_end(msg, nested);
1806                 }
1807
1808                 if (rdev->wiphy.n_vendor_events) {
1809                         const struct nl80211_vendor_cmd_info *info;
1810                         struct nlattr *nested;
1811
1812                         nested = nla_nest_start(msg,
1813                                                 NL80211_ATTR_VENDOR_EVENTS);
1814                         if (!nested)
1815                                 goto nla_put_failure;
1816
1817                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
1818                                 info = &rdev->wiphy.vendor_events[i];
1819                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1820                                         goto nla_put_failure;
1821                         }
1822                         nla_nest_end(msg, nested);
1823                 }
1824                 state->split_start++;
1825                 break;
1826         case 12:
1827                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
1828                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
1829                                rdev->wiphy.max_num_csa_counters))
1830                         goto nla_put_failure;
1831
1832                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
1833                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
1834                         goto nla_put_failure;
1835
1836                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
1837                             sizeof(rdev->wiphy.ext_features),
1838                             rdev->wiphy.ext_features))
1839                         goto nla_put_failure;
1840
1841                 if (rdev->wiphy.bss_select_support) {
1842                         struct nlattr *nested;
1843                         u32 bss_select_support = rdev->wiphy.bss_select_support;
1844
1845                         nested = nla_nest_start(msg, NL80211_ATTR_BSS_SELECT);
1846                         if (!nested)
1847                                 goto nla_put_failure;
1848
1849                         i = 0;
1850                         while (bss_select_support) {
1851                                 if ((bss_select_support & 1) &&
1852                                     nla_put_flag(msg, i))
1853                                         goto nla_put_failure;
1854                                 i++;
1855                                 bss_select_support >>= 1;
1856                         }
1857                         nla_nest_end(msg, nested);
1858                 }
1859
1860                 state->split_start++;
1861                 break;
1862         case 13:
1863                 if (rdev->wiphy.num_iftype_ext_capab &&
1864                     rdev->wiphy.iftype_ext_capab) {
1865                         struct nlattr *nested_ext_capab, *nested;
1866
1867                         nested = nla_nest_start(msg,
1868                                                 NL80211_ATTR_IFTYPE_EXT_CAPA);
1869                         if (!nested)
1870                                 goto nla_put_failure;
1871
1872                         for (i = state->capa_start;
1873                              i < rdev->wiphy.num_iftype_ext_capab; i++) {
1874                                 const struct wiphy_iftype_ext_capab *capab;
1875
1876                                 capab = &rdev->wiphy.iftype_ext_capab[i];
1877
1878                                 nested_ext_capab = nla_nest_start(msg, i);
1879                                 if (!nested_ext_capab ||
1880                                     nla_put_u32(msg, NL80211_ATTR_IFTYPE,
1881                                                 capab->iftype) ||
1882                                     nla_put(msg, NL80211_ATTR_EXT_CAPA,
1883                                             capab->extended_capabilities_len,
1884                                             capab->extended_capabilities) ||
1885                                     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1886                                             capab->extended_capabilities_len,
1887                                             capab->extended_capabilities_mask))
1888                                         goto nla_put_failure;
1889
1890                                 nla_nest_end(msg, nested_ext_capab);
1891                                 if (state->split)
1892                                         break;
1893                         }
1894                         nla_nest_end(msg, nested);
1895                         if (i < rdev->wiphy.num_iftype_ext_capab) {
1896                                 state->capa_start = i + 1;
1897                                 break;
1898                         }
1899                 }
1900
1901                 /* done */
1902                 state->split_start = 0;
1903                 break;
1904         }
1905  finish:
1906         genlmsg_end(msg, hdr);
1907         return 0;
1908
1909  nla_put_failure:
1910         genlmsg_cancel(msg, hdr);
1911         return -EMSGSIZE;
1912 }
1913
1914 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1915                                     struct netlink_callback *cb,
1916                                     struct nl80211_dump_wiphy_state *state)
1917 {
1918         struct nlattr **tb = nl80211_fam.attrbuf;
1919         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1920                               tb, nl80211_fam.maxattr, nl80211_policy);
1921         /* ignore parse errors for backward compatibility */
1922         if (ret)
1923                 return 0;
1924
1925         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1926         if (tb[NL80211_ATTR_WIPHY])
1927                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1928         if (tb[NL80211_ATTR_WDEV])
1929                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1930         if (tb[NL80211_ATTR_IFINDEX]) {
1931                 struct net_device *netdev;
1932                 struct cfg80211_registered_device *rdev;
1933                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1934
1935                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1936                 if (!netdev)
1937                         return -ENODEV;
1938                 if (netdev->ieee80211_ptr) {
1939                         rdev = wiphy_to_rdev(
1940                                 netdev->ieee80211_ptr->wiphy);
1941                         state->filter_wiphy = rdev->wiphy_idx;
1942                 }
1943         }
1944
1945         return 0;
1946 }
1947
1948 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1949 {
1950         int idx = 0, ret;
1951         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1952         struct cfg80211_registered_device *rdev;
1953
1954         rtnl_lock();
1955         if (!state) {
1956                 state = kzalloc(sizeof(*state), GFP_KERNEL);
1957                 if (!state) {
1958                         rtnl_unlock();
1959                         return -ENOMEM;
1960                 }
1961                 state->filter_wiphy = -1;
1962                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1963                 if (ret) {
1964                         kfree(state);
1965                         rtnl_unlock();
1966                         return ret;
1967                 }
1968                 cb->args[0] = (long)state;
1969         }
1970
1971         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1972                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1973                         continue;
1974                 if (++idx <= state->start)
1975                         continue;
1976                 if (state->filter_wiphy != -1 &&
1977                     state->filter_wiphy != rdev->wiphy_idx)
1978                         continue;
1979                 /* attempt to fit multiple wiphy data chunks into the skb */
1980                 do {
1981                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
1982                                                  skb,
1983                                                  NETLINK_CB(cb->skb).portid,
1984                                                  cb->nlh->nlmsg_seq,
1985                                                  NLM_F_MULTI, state);
1986                         if (ret < 0) {
1987                                 /*
1988                                  * If sending the wiphy data didn't fit (ENOBUFS
1989                                  * or EMSGSIZE returned), this SKB is still
1990                                  * empty (so it's not too big because another
1991                                  * wiphy dataset is already in the skb) and
1992                                  * we've not tried to adjust the dump allocation
1993                                  * yet ... then adjust the alloc size to be
1994                                  * bigger, and return 1 but with the empty skb.
1995                                  * This results in an empty message being RX'ed
1996                                  * in userspace, but that is ignored.
1997                                  *
1998                                  * We can then retry with the larger buffer.
1999                                  */
2000                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
2001                                     !skb->len && !state->split &&
2002                                     cb->min_dump_alloc < 4096) {
2003                                         cb->min_dump_alloc = 4096;
2004                                         state->split_start = 0;
2005                                         rtnl_unlock();
2006                                         return 1;
2007                                 }
2008                                 idx--;
2009                                 break;
2010                         }
2011                 } while (state->split_start > 0);
2012                 break;
2013         }
2014         rtnl_unlock();
2015
2016         state->start = idx;
2017
2018         return skb->len;
2019 }
2020
2021 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
2022 {
2023         kfree((void *)cb->args[0]);
2024         return 0;
2025 }
2026
2027 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
2028 {
2029         struct sk_buff *msg;
2030         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2031         struct nl80211_dump_wiphy_state state = {};
2032
2033         msg = nlmsg_new(4096, GFP_KERNEL);
2034         if (!msg)
2035                 return -ENOMEM;
2036
2037         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
2038                                info->snd_portid, info->snd_seq, 0,
2039                                &state) < 0) {
2040                 nlmsg_free(msg);
2041                 return -ENOBUFS;
2042         }
2043
2044         return genlmsg_reply(msg, info);
2045 }
2046
2047 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
2048         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
2049         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
2050         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
2051         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
2052         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
2053 };
2054
2055 static int parse_txq_params(struct nlattr *tb[],
2056                             struct ieee80211_txq_params *txq_params)
2057 {
2058         u8 ac;
2059
2060         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
2061             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
2062             !tb[NL80211_TXQ_ATTR_AIFS])
2063                 return -EINVAL;
2064
2065         ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
2066         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
2067         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
2068         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
2069         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
2070
2071         if (ac >= NL80211_NUM_ACS)
2072                 return -EINVAL;
2073         txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
2074         return 0;
2075 }
2076
2077 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
2078 {
2079         /*
2080          * You can only set the channel explicitly for WDS interfaces,
2081          * all others have their channel managed via their respective
2082          * "establish a connection" command (connect, join, ...)
2083          *
2084          * For AP/GO and mesh mode, the channel can be set with the
2085          * channel userspace API, but is only stored and passed to the
2086          * low-level driver when the AP starts or the mesh is joined.
2087          * This is for backward compatibility, userspace can also give
2088          * the channel in the start-ap or join-mesh commands instead.
2089          *
2090          * Monitors are special as they are normally slaved to
2091          * whatever else is going on, so they have their own special
2092          * operation to set the monitor channel if possible.
2093          */
2094         return !wdev ||
2095                 wdev->iftype == NL80211_IFTYPE_AP ||
2096                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
2097                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
2098                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
2099 }
2100
2101 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
2102                                  struct genl_info *info,
2103                                  struct cfg80211_chan_def *chandef)
2104 {
2105         u32 control_freq;
2106
2107         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
2108                 return -EINVAL;
2109
2110         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
2111
2112         memset(chandef, 0, sizeof(*chandef));
2113
2114         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
2115         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
2116         chandef->center_freq1 = control_freq;
2117         chandef->center_freq2 = 0;
2118
2119         /* Primary channel not allowed */
2120         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
2121                 return -EINVAL;
2122
2123         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2124                 enum nl80211_channel_type chantype;
2125
2126                 chantype = nla_get_u32(
2127                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2128
2129                 switch (chantype) {
2130                 case NL80211_CHAN_NO_HT:
2131                 case NL80211_CHAN_HT20:
2132                 case NL80211_CHAN_HT40PLUS:
2133                 case NL80211_CHAN_HT40MINUS:
2134                         cfg80211_chandef_create(chandef, chandef->chan,
2135                                                 chantype);
2136                         break;
2137                 default:
2138                         return -EINVAL;
2139                 }
2140         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
2141                 chandef->width =
2142                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
2143                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
2144                         chandef->center_freq1 =
2145                                 nla_get_u32(
2146                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
2147                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
2148                         chandef->center_freq2 =
2149                                 nla_get_u32(
2150                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
2151         }
2152
2153         if (!cfg80211_chandef_valid(chandef))
2154                 return -EINVAL;
2155
2156         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
2157                                      IEEE80211_CHAN_DISABLED))
2158                 return -EINVAL;
2159
2160         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
2161              chandef->width == NL80211_CHAN_WIDTH_10) &&
2162             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
2163                 return -EINVAL;
2164
2165         return 0;
2166 }
2167
2168 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
2169                                  struct net_device *dev,
2170                                  struct genl_info *info)
2171 {
2172         struct cfg80211_chan_def chandef;
2173         int result;
2174         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
2175         struct wireless_dev *wdev = NULL;
2176
2177         if (dev)
2178                 wdev = dev->ieee80211_ptr;
2179         if (!nl80211_can_set_dev_channel(wdev))
2180                 return -EOPNOTSUPP;
2181         if (wdev)
2182                 iftype = wdev->iftype;
2183
2184         result = nl80211_parse_chandef(rdev, info, &chandef);
2185         if (result)
2186                 return result;
2187
2188         switch (iftype) {
2189         case NL80211_IFTYPE_AP:
2190         case NL80211_IFTYPE_P2P_GO:
2191                 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
2192                                                    iftype)) {
2193                         result = -EINVAL;
2194                         break;
2195                 }
2196                 if (wdev->beacon_interval) {
2197                         if (!dev || !rdev->ops->set_ap_chanwidth ||
2198                             !(rdev->wiphy.features &
2199                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2200                                 result = -EBUSY;
2201                                 break;
2202                         }
2203
2204                         /* Only allow dynamic channel width changes */
2205                         if (chandef.chan != wdev->preset_chandef.chan) {
2206                                 result = -EBUSY;
2207                                 break;
2208                         }
2209                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2210                         if (result)
2211                                 break;
2212                 }
2213                 wdev->preset_chandef = chandef;
2214                 result = 0;
2215                 break;
2216         case NL80211_IFTYPE_MESH_POINT:
2217                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2218                 break;
2219         case NL80211_IFTYPE_MONITOR:
2220                 result = cfg80211_set_monitor_channel(rdev, &chandef);
2221                 break;
2222         default:
2223                 result = -EINVAL;
2224         }
2225
2226         return result;
2227 }
2228
2229 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2230 {
2231         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2232         struct net_device *netdev = info->user_ptr[1];
2233
2234         return __nl80211_set_channel(rdev, netdev, info);
2235 }
2236
2237 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2238 {
2239         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2240         struct net_device *dev = info->user_ptr[1];
2241         struct wireless_dev *wdev = dev->ieee80211_ptr;
2242         const u8 *bssid;
2243
2244         if (!info->attrs[NL80211_ATTR_MAC])
2245                 return -EINVAL;
2246
2247         if (netif_running(dev))
2248                 return -EBUSY;
2249
2250         if (!rdev->ops->set_wds_peer)
2251                 return -EOPNOTSUPP;
2252
2253         if (wdev->iftype != NL80211_IFTYPE_WDS)
2254                 return -EOPNOTSUPP;
2255
2256         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2257         return rdev_set_wds_peer(rdev, dev, bssid);
2258 }
2259
2260 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2261 {
2262         struct cfg80211_registered_device *rdev;
2263         struct net_device *netdev = NULL;
2264         struct wireless_dev *wdev;
2265         int result = 0, rem_txq_params = 0;
2266         struct nlattr *nl_txq_params;
2267         u32 changed;
2268         u8 retry_short = 0, retry_long = 0;
2269         u32 frag_threshold = 0, rts_threshold = 0;
2270         u8 coverage_class = 0;
2271
2272         ASSERT_RTNL();
2273
2274         /*
2275          * Try to find the wiphy and netdev. Normally this
2276          * function shouldn't need the netdev, but this is
2277          * done for backward compatibility -- previously
2278          * setting the channel was done per wiphy, but now
2279          * it is per netdev. Previous userland like hostapd
2280          * also passed a netdev to set_wiphy, so that it is
2281          * possible to let that go to the right netdev!
2282          */
2283
2284         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2285                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2286
2287                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2288                 if (netdev && netdev->ieee80211_ptr)
2289                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2290                 else
2291                         netdev = NULL;
2292         }
2293
2294         if (!netdev) {
2295                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2296                                                   info->attrs);
2297                 if (IS_ERR(rdev))
2298                         return PTR_ERR(rdev);
2299                 wdev = NULL;
2300                 netdev = NULL;
2301                 result = 0;
2302         } else
2303                 wdev = netdev->ieee80211_ptr;
2304
2305         /*
2306          * end workaround code, by now the rdev is available
2307          * and locked, and wdev may or may not be NULL.
2308          */
2309
2310         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2311                 result = cfg80211_dev_rename(
2312                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2313
2314         if (result)
2315                 return result;
2316
2317         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2318                 struct ieee80211_txq_params txq_params;
2319                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2320
2321                 if (!rdev->ops->set_txq_params)
2322                         return -EOPNOTSUPP;
2323
2324                 if (!netdev)
2325                         return -EINVAL;
2326
2327                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2328                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2329                         return -EINVAL;
2330
2331                 if (!netif_running(netdev))
2332                         return -ENETDOWN;
2333
2334                 nla_for_each_nested(nl_txq_params,
2335                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2336                                     rem_txq_params) {
2337                         result = nla_parse(tb, NL80211_TXQ_ATTR_MAX,
2338                                            nla_data(nl_txq_params),
2339                                            nla_len(nl_txq_params),
2340                                            txq_params_policy);
2341                         if (result)
2342                                 return result;
2343                         result = parse_txq_params(tb, &txq_params);
2344                         if (result)
2345                                 return result;
2346
2347                         result = rdev_set_txq_params(rdev, netdev,
2348                                                      &txq_params);
2349                         if (result)
2350                                 return result;
2351                 }
2352         }
2353
2354         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2355                 result = __nl80211_set_channel(
2356                         rdev,
2357                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2358                         info);
2359                 if (result)
2360                         return result;
2361         }
2362
2363         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2364                 struct wireless_dev *txp_wdev = wdev;
2365                 enum nl80211_tx_power_setting type;
2366                 int idx, mbm = 0;
2367
2368                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2369                         txp_wdev = NULL;
2370
2371                 if (!rdev->ops->set_tx_power)
2372                         return -EOPNOTSUPP;
2373
2374                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2375                 type = nla_get_u32(info->attrs[idx]);
2376
2377                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2378                     (type != NL80211_TX_POWER_AUTOMATIC))
2379                         return -EINVAL;
2380
2381                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2382                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2383                         mbm = nla_get_u32(info->attrs[idx]);
2384                 }
2385
2386                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2387                 if (result)
2388                         return result;
2389         }
2390
2391         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2392             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2393                 u32 tx_ant, rx_ant;
2394
2395                 if ((!rdev->wiphy.available_antennas_tx &&
2396                      !rdev->wiphy.available_antennas_rx) ||
2397                     !rdev->ops->set_antenna)
2398                         return -EOPNOTSUPP;
2399
2400                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2401                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2402
2403                 /* reject antenna configurations which don't match the
2404                  * available antenna masks, except for the "all" mask */
2405                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2406                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2407                         return -EINVAL;
2408
2409                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2410                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2411
2412                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2413                 if (result)
2414                         return result;
2415         }
2416
2417         changed = 0;
2418
2419         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2420                 retry_short = nla_get_u8(
2421                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2422                 if (retry_short == 0)
2423                         return -EINVAL;
2424
2425                 changed |= WIPHY_PARAM_RETRY_SHORT;
2426         }
2427
2428         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2429                 retry_long = nla_get_u8(
2430                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2431                 if (retry_long == 0)
2432                         return -EINVAL;
2433
2434                 changed |= WIPHY_PARAM_RETRY_LONG;
2435         }
2436
2437         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2438                 frag_threshold = nla_get_u32(
2439                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2440                 if (frag_threshold < 256)
2441                         return -EINVAL;
2442
2443                 if (frag_threshold != (u32) -1) {
2444                         /*
2445                          * Fragments (apart from the last one) are required to
2446                          * have even length. Make the fragmentation code
2447                          * simpler by stripping LSB should someone try to use
2448                          * odd threshold value.
2449                          */
2450                         frag_threshold &= ~0x1;
2451                 }
2452                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2453         }
2454
2455         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2456                 rts_threshold = nla_get_u32(
2457                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2458                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2459         }
2460
2461         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2462                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2463                         return -EINVAL;
2464
2465                 coverage_class = nla_get_u8(
2466                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2467                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2468         }
2469
2470         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2471                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2472                         return -EOPNOTSUPP;
2473
2474                 changed |= WIPHY_PARAM_DYN_ACK;
2475         }
2476
2477         if (changed) {
2478                 u8 old_retry_short, old_retry_long;
2479                 u32 old_frag_threshold, old_rts_threshold;
2480                 u8 old_coverage_class;
2481
2482                 if (!rdev->ops->set_wiphy_params)
2483                         return -EOPNOTSUPP;
2484
2485                 old_retry_short = rdev->wiphy.retry_short;
2486                 old_retry_long = rdev->wiphy.retry_long;
2487                 old_frag_threshold = rdev->wiphy.frag_threshold;
2488                 old_rts_threshold = rdev->wiphy.rts_threshold;
2489                 old_coverage_class = rdev->wiphy.coverage_class;
2490
2491                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2492                         rdev->wiphy.retry_short = retry_short;
2493                 if (changed & WIPHY_PARAM_RETRY_LONG)
2494                         rdev->wiphy.retry_long = retry_long;
2495                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2496                         rdev->wiphy.frag_threshold = frag_threshold;
2497                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2498                         rdev->wiphy.rts_threshold = rts_threshold;
2499                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2500                         rdev->wiphy.coverage_class = coverage_class;
2501
2502                 result = rdev_set_wiphy_params(rdev, changed);
2503                 if (result) {
2504                         rdev->wiphy.retry_short = old_retry_short;
2505                         rdev->wiphy.retry_long = old_retry_long;
2506                         rdev->wiphy.frag_threshold = old_frag_threshold;
2507                         rdev->wiphy.rts_threshold = old_rts_threshold;
2508                         rdev->wiphy.coverage_class = old_coverage_class;
2509                         return result;
2510                 }
2511         }
2512         return 0;
2513 }
2514
2515 static inline u64 wdev_id(struct wireless_dev *wdev)
2516 {
2517         return (u64)wdev->identifier |
2518                ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2519 }
2520
2521 static int nl80211_send_chandef(struct sk_buff *msg,
2522                                 const struct cfg80211_chan_def *chandef)
2523 {
2524         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
2525                 return -EINVAL;
2526
2527         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2528                         chandef->chan->center_freq))
2529                 return -ENOBUFS;
2530         switch (chandef->width) {
2531         case NL80211_CHAN_WIDTH_20_NOHT:
2532         case NL80211_CHAN_WIDTH_20:
2533         case NL80211_CHAN_WIDTH_40:
2534                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2535                                 cfg80211_get_chandef_type(chandef)))
2536                         return -ENOBUFS;
2537                 break;
2538         default:
2539                 break;
2540         }
2541         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2542                 return -ENOBUFS;
2543         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2544                 return -ENOBUFS;
2545         if (chandef->center_freq2 &&
2546             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2547                 return -ENOBUFS;
2548         return 0;
2549 }
2550
2551 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2552                               struct cfg80211_registered_device *rdev,
2553                               struct wireless_dev *wdev, bool removal)
2554 {
2555         struct net_device *dev = wdev->netdev;
2556         u8 cmd = NL80211_CMD_NEW_INTERFACE;
2557         void *hdr;
2558
2559         if (removal)
2560                 cmd = NL80211_CMD_DEL_INTERFACE;
2561
2562         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2563         if (!hdr)
2564                 return -1;
2565
2566         if (dev &&
2567             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2568              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2569                 goto nla_put_failure;
2570
2571         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2572             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2573             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
2574                               NL80211_ATTR_PAD) ||
2575             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2576             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2577                         rdev->devlist_generation ^
2578                         (cfg80211_rdev_list_generation << 2)))
2579                 goto nla_put_failure;
2580
2581         if (rdev->ops->get_channel) {
2582                 int ret;
2583                 struct cfg80211_chan_def chandef = {};
2584
2585                 ret = rdev_get_channel(rdev, wdev, &chandef);
2586                 if (ret == 0) {
2587                         if (nl80211_send_chandef(msg, &chandef))
2588                                 goto nla_put_failure;
2589                 }
2590         }
2591
2592         if (rdev->ops->get_tx_power) {
2593                 int dbm, ret;
2594
2595                 ret = rdev_get_tx_power(rdev, wdev, &dbm);
2596                 if (ret == 0 &&
2597                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
2598                                 DBM_TO_MBM(dbm)))
2599                         goto nla_put_failure;
2600         }
2601
2602         if (wdev->ssid_len) {
2603                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2604                         goto nla_put_failure;
2605         }
2606
2607         genlmsg_end(msg, hdr);
2608         return 0;
2609
2610  nla_put_failure:
2611         genlmsg_cancel(msg, hdr);
2612         return -EMSGSIZE;
2613 }
2614
2615 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2616 {
2617         int wp_idx = 0;
2618         int if_idx = 0;
2619         int wp_start = cb->args[0];
2620         int if_start = cb->args[1];
2621         int filter_wiphy = -1;
2622         struct cfg80211_registered_device *rdev;
2623         struct wireless_dev *wdev;
2624         int ret;
2625
2626         rtnl_lock();
2627         if (!cb->args[2]) {
2628                 struct nl80211_dump_wiphy_state state = {
2629                         .filter_wiphy = -1,
2630                 };
2631
2632                 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
2633                 if (ret)
2634                         goto out_unlock;
2635
2636                 filter_wiphy = state.filter_wiphy;
2637
2638                 /*
2639                  * if filtering, set cb->args[2] to +1 since 0 is the default
2640                  * value needed to determine that parsing is necessary.
2641                  */
2642                 if (filter_wiphy >= 0)
2643                         cb->args[2] = filter_wiphy + 1;
2644                 else
2645                         cb->args[2] = -1;
2646         } else if (cb->args[2] > 0) {
2647                 filter_wiphy = cb->args[2] - 1;
2648         }
2649
2650         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2651                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2652                         continue;
2653                 if (wp_idx < wp_start) {
2654                         wp_idx++;
2655                         continue;
2656                 }
2657
2658                 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
2659                         continue;
2660
2661                 if_idx = 0;
2662
2663                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
2664                         if (if_idx < if_start) {
2665                                 if_idx++;
2666                                 continue;
2667                         }
2668                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2669                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2670                                                rdev, wdev, false) < 0) {
2671                                 goto out;
2672                         }
2673                         if_idx++;
2674                 }
2675
2676                 wp_idx++;
2677         }
2678  out:
2679         cb->args[0] = wp_idx;
2680         cb->args[1] = if_idx;
2681
2682         ret = skb->len;
2683  out_unlock:
2684         rtnl_unlock();
2685
2686         return ret;
2687 }
2688
2689 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2690 {
2691         struct sk_buff *msg;
2692         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2693         struct wireless_dev *wdev = info->user_ptr[1];
2694
2695         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2696         if (!msg)
2697                 return -ENOMEM;
2698
2699         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2700                                rdev, wdev, false) < 0) {
2701                 nlmsg_free(msg);
2702                 return -ENOBUFS;
2703         }
2704
2705         return genlmsg_reply(msg, info);
2706 }
2707
2708 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2709         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2710         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2711         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2712         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2713         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2714         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2715 };
2716
2717 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2718 {
2719         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2720         int flag;
2721
2722         *mntrflags = 0;
2723
2724         if (!nla)
2725                 return -EINVAL;
2726
2727         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2728                              nla, mntr_flags_policy))
2729                 return -EINVAL;
2730
2731         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2732                 if (flags[flag])
2733                         *mntrflags |= (1<<flag);
2734
2735         return 0;
2736 }
2737
2738 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2739                                struct net_device *netdev, u8 use_4addr,
2740                                enum nl80211_iftype iftype)
2741 {
2742         if (!use_4addr) {
2743                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2744                         return -EBUSY;
2745                 return 0;
2746         }
2747
2748         switch (iftype) {
2749         case NL80211_IFTYPE_AP_VLAN:
2750                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2751                         return 0;
2752                 break;
2753         case NL80211_IFTYPE_STATION:
2754                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2755                         return 0;
2756                 break;
2757         default:
2758                 break;
2759         }
2760
2761         return -EOPNOTSUPP;
2762 }
2763
2764 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2765 {
2766         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2767         struct vif_params params;
2768         int err;
2769         enum nl80211_iftype otype, ntype;
2770         struct net_device *dev = info->user_ptr[1];
2771         u32 _flags, *flags = NULL;
2772         bool change = false;
2773
2774         memset(&params, 0, sizeof(params));
2775
2776         otype = ntype = dev->ieee80211_ptr->iftype;
2777
2778         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2779                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2780                 if (otype != ntype)
2781                         change = true;
2782                 if (ntype > NL80211_IFTYPE_MAX)
2783                         return -EINVAL;
2784         }
2785
2786         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2787                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2788
2789                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2790                         return -EINVAL;
2791                 if (netif_running(dev))
2792                         return -EBUSY;
2793
2794                 wdev_lock(wdev);
2795                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2796                              IEEE80211_MAX_MESH_ID_LEN);
2797                 wdev->mesh_id_up_len =
2798                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2799                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2800                        wdev->mesh_id_up_len);
2801                 wdev_unlock(wdev);
2802         }
2803
2804         if (info->attrs[NL80211_ATTR_4ADDR]) {
2805                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2806                 change = true;
2807                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2808                 if (err)
2809                         return err;
2810         } else {
2811                 params.use_4addr = -1;
2812         }
2813
2814         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2815                 if (ntype != NL80211_IFTYPE_MONITOR)
2816                         return -EINVAL;
2817                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2818                                           &_flags);
2819                 if (err)
2820                         return err;
2821
2822                 flags = &_flags;
2823                 change = true;
2824         }
2825
2826         if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
2827                 const u8 *mumimo_groups;
2828                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
2829
2830                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
2831                         return -EOPNOTSUPP;
2832
2833                 mumimo_groups =
2834                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
2835
2836                 /* bits 0 and 63 are reserved and must be zero */
2837                 if ((mumimo_groups[0] & BIT(7)) ||
2838                     (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(0)))
2839                         return -EINVAL;
2840
2841                 memcpy(params.vht_mumimo_groups, mumimo_groups,
2842                        VHT_MUMIMO_GROUPS_DATA_LEN);
2843                 change = true;
2844         }
2845
2846         if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
2847                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
2848
2849                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
2850                         return -EOPNOTSUPP;
2851
2852                 nla_memcpy(params.macaddr,
2853                            info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR],
2854                            ETH_ALEN);
2855                 change = true;
2856         }
2857
2858         if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
2859             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2860                 return -EOPNOTSUPP;
2861
2862         if (change)
2863                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2864         else
2865                 err = 0;
2866
2867         if (!err && params.use_4addr != -1)
2868                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2869
2870         return err;
2871 }
2872
2873 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2874 {
2875         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2876         struct vif_params params;
2877         struct wireless_dev *wdev;
2878         struct sk_buff *msg;
2879         int err;
2880         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2881         u32 flags;
2882
2883         /* to avoid failing a new interface creation due to pending removal */
2884         cfg80211_destroy_ifaces(rdev);
2885
2886         memset(&params, 0, sizeof(params));
2887
2888         if (!info->attrs[NL80211_ATTR_IFNAME])
2889                 return -EINVAL;
2890
2891         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2892                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2893                 if (type > NL80211_IFTYPE_MAX)
2894                         return -EINVAL;
2895         }
2896
2897         if (!rdev->ops->add_virtual_intf ||
2898             !(rdev->wiphy.interface_modes & (1 << type)))
2899                 return -EOPNOTSUPP;
2900
2901         if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
2902              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
2903             info->attrs[NL80211_ATTR_MAC]) {
2904                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2905                            ETH_ALEN);
2906                 if (!is_valid_ether_addr(params.macaddr))
2907                         return -EADDRNOTAVAIL;
2908         }
2909
2910         if (info->attrs[NL80211_ATTR_4ADDR]) {
2911                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2912                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2913                 if (err)
2914                         return err;
2915         }
2916
2917         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2918                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2919                                   &flags);
2920
2921         if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
2922             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2923                 return -EOPNOTSUPP;
2924
2925         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2926         if (!msg)
2927                 return -ENOMEM;
2928
2929         wdev = rdev_add_virtual_intf(rdev,
2930                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2931                                 NET_NAME_USER, type, err ? NULL : &flags,
2932                                 &params);
2933         if (WARN_ON(!wdev)) {
2934                 nlmsg_free(msg);
2935                 return -EPROTO;
2936         } else if (IS_ERR(wdev)) {
2937                 nlmsg_free(msg);
2938                 return PTR_ERR(wdev);
2939         }
2940
2941         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
2942                 wdev->owner_nlportid = info->snd_portid;
2943
2944         switch (type) {
2945         case NL80211_IFTYPE_MESH_POINT:
2946                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2947                         break;
2948                 wdev_lock(wdev);
2949                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2950                              IEEE80211_MAX_MESH_ID_LEN);
2951                 wdev->mesh_id_up_len =
2952                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2953                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2954                        wdev->mesh_id_up_len);
2955                 wdev_unlock(wdev);
2956                 break;
2957         case NL80211_IFTYPE_NAN:
2958         case NL80211_IFTYPE_P2P_DEVICE:
2959                 /*
2960                  * P2P Device and NAN do not have a netdev, so don't go
2961                  * through the netdev notifier and must be added here
2962                  */
2963                 mutex_init(&wdev->mtx);
2964                 INIT_LIST_HEAD(&wdev->event_list);
2965                 spin_lock_init(&wdev->event_lock);
2966                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2967                 spin_lock_init(&wdev->mgmt_registrations_lock);
2968
2969                 wdev->identifier = ++rdev->wdev_id;
2970                 list_add_rcu(&wdev->list, &rdev->wiphy.wdev_list);
2971                 rdev->devlist_generation++;
2972                 break;
2973         default:
2974                 break;
2975         }
2976
2977         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2978                                rdev, wdev, false) < 0) {
2979                 nlmsg_free(msg);
2980                 return -ENOBUFS;
2981         }
2982
2983         /*
2984          * For wdevs which have no associated netdev object (e.g. of type
2985          * NL80211_IFTYPE_P2P_DEVICE), emit the NEW_INTERFACE event here.
2986          * For all other types, the event will be generated from the
2987          * netdev notifier
2988          */
2989         if (!wdev->netdev)
2990                 nl80211_notify_iface(rdev, wdev, NL80211_CMD_NEW_INTERFACE);
2991
2992         return genlmsg_reply(msg, info);
2993 }
2994
2995 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2996 {
2997         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2998         struct wireless_dev *wdev = info->user_ptr[1];
2999
3000         if (!rdev->ops->del_virtual_intf)
3001                 return -EOPNOTSUPP;
3002
3003         /*
3004          * If we remove a wireless device without a netdev then clear
3005          * user_ptr[1] so that nl80211_post_doit won't dereference it
3006          * to check if it needs to do dev_put(). Otherwise it crashes
3007          * since the wdev has been freed, unlike with a netdev where
3008          * we need the dev_put() for the netdev to really be freed.
3009          */
3010         if (!wdev->netdev)
3011                 info->user_ptr[1] = NULL;
3012
3013         return rdev_del_virtual_intf(rdev, wdev);
3014 }
3015
3016 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
3017 {
3018         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3019         struct net_device *dev = info->user_ptr[1];
3020         u16 noack_map;
3021
3022         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
3023                 return -EINVAL;
3024
3025         if (!rdev->ops->set_noack_map)
3026                 return -EOPNOTSUPP;
3027
3028         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
3029
3030         return rdev_set_noack_map(rdev, dev, noack_map);
3031 }
3032
3033 struct get_key_cookie {
3034         struct sk_buff *msg;
3035         int error;
3036         int idx;
3037 };
3038
3039 static void get_key_callback(void *c, struct key_params *params)
3040 {
3041         struct nlattr *key;
3042         struct get_key_cookie *cookie = c;
3043
3044         if ((params->key &&
3045              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
3046                      params->key_len, params->key)) ||
3047             (params->seq &&
3048              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
3049                      params->seq_len, params->seq)) ||
3050             (params->cipher &&
3051              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
3052                          params->cipher)))
3053                 goto nla_put_failure;
3054
3055         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
3056         if (!key)
3057                 goto nla_put_failure;
3058
3059         if ((params->key &&
3060              nla_put(cookie->msg, NL80211_KEY_DATA,
3061                      params->key_len, params->key)) ||
3062             (params->seq &&
3063              nla_put(cookie->msg, NL80211_KEY_SEQ,
3064                      params->seq_len, params->seq)) ||
3065             (params->cipher &&
3066              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
3067                          params->cipher)))
3068                 goto nla_put_failure;
3069
3070         if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
3071                 goto nla_put_failure;
3072
3073         nla_nest_end(cookie->msg, key);
3074
3075         return;
3076  nla_put_failure:
3077         cookie->error = 1;
3078 }
3079
3080 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
3081 {
3082         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3083         int err;
3084         struct net_device *dev = info->user_ptr[1];
3085         u8 key_idx = 0;
3086         const u8 *mac_addr = NULL;
3087         bool pairwise;
3088         struct get_key_cookie cookie = {
3089                 .error = 0,
3090         };
3091         void *hdr;
3092         struct sk_buff *msg;
3093
3094         if (info->attrs[NL80211_ATTR_KEY_IDX])
3095                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
3096
3097         if (key_idx > 5)
3098                 return -EINVAL;
3099
3100         if (info->attrs[NL80211_ATTR_MAC])
3101                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3102
3103         pairwise = !!mac_addr;
3104         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
3105                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
3106
3107                 if (kt >= NUM_NL80211_KEYTYPES)
3108                         return -EINVAL;
3109                 if (kt != NL80211_KEYTYPE_GROUP &&
3110                     kt != NL80211_KEYTYPE_PAIRWISE)
3111                         return -EINVAL;
3112                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
3113         }
3114
3115         if (!rdev->ops->get_key)
3116                 return -EOPNOTSUPP;
3117
3118         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3119                 return -ENOENT;
3120
3121         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3122         if (!msg)
3123                 return -ENOMEM;
3124
3125         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
3126                              NL80211_CMD_NEW_KEY);
3127         if (!hdr)
3128                 goto nla_put_failure;
3129
3130         cookie.msg = msg;
3131         cookie.idx = key_idx;
3132
3133         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3134             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
3135                 goto nla_put_failure;
3136         if (mac_addr &&
3137             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
3138                 goto nla_put_failure;
3139
3140         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
3141                            get_key_callback);
3142
3143         if (err)
3144                 goto free_msg;
3145
3146         if (cookie.error)
3147                 goto nla_put_failure;
3148
3149         genlmsg_end(msg, hdr);
3150         return genlmsg_reply(msg, info);
3151
3152  nla_put_failure:
3153         err = -ENOBUFS;
3154  free_msg:
3155         nlmsg_free(msg);
3156         return err;
3157 }
3158
3159 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
3160 {
3161         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3162         struct key_parse key;
3163         int err;
3164         struct net_device *dev = info->user_ptr[1];
3165
3166         err = nl80211_parse_key(info, &key);
3167         if (err)
3168                 return err;
3169
3170         if (key.idx < 0)
3171                 return -EINVAL;
3172
3173         /* only support setting default key */
3174         if (!key.def && !key.defmgmt)
3175                 return -EINVAL;
3176
3177         wdev_lock(dev->ieee80211_ptr);
3178
3179         if (key.def) {
3180                 if (!rdev->ops->set_default_key) {
3181                         err = -EOPNOTSUPP;
3182                         goto out;
3183                 }
3184
3185                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3186                 if (err)
3187                         goto out;
3188
3189                 err = rdev_set_default_key(rdev, dev, key.idx,
3190                                                  key.def_uni, key.def_multi);
3191
3192                 if (err)
3193                         goto out;
3194
3195 #ifdef CONFIG_CFG80211_WEXT
3196                 dev->ieee80211_ptr->wext.default_key = key.idx;
3197 #endif
3198         } else {
3199                 if (key.def_uni || !key.def_multi) {
3200                         err = -EINVAL;
3201                         goto out;
3202                 }
3203
3204                 if (!rdev->ops->set_default_mgmt_key) {
3205                         err = -EOPNOTSUPP;
3206                         goto out;
3207                 }
3208
3209                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3210                 if (err)
3211                         goto out;
3212
3213                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
3214                 if (err)
3215                         goto out;
3216
3217 #ifdef CONFIG_CFG80211_WEXT
3218                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
3219 #endif
3220         }
3221
3222  out:
3223         wdev_unlock(dev->ieee80211_ptr);
3224
3225         return err;
3226 }
3227
3228 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
3229 {
3230         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3231         int err;
3232         struct net_device *dev = info->user_ptr[1];
3233         struct key_parse key;
3234         const u8 *mac_addr = NULL;
3235
3236         err = nl80211_parse_key(info, &key);
3237         if (err)
3238                 return err;
3239
3240         if (!key.p.key)
3241                 return -EINVAL;
3242
3243         if (info->attrs[NL80211_ATTR_MAC])
3244                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3245
3246         if (key.type == -1) {
3247                 if (mac_addr)
3248                         key.type = NL80211_KEYTYPE_PAIRWISE;
3249                 else
3250                         key.type = NL80211_KEYTYPE_GROUP;
3251         }
3252
3253         /* for now */
3254         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3255             key.type != NL80211_KEYTYPE_GROUP)
3256                 return -EINVAL;
3257
3258         if (!rdev->ops->add_key)
3259                 return -EOPNOTSUPP;
3260
3261         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3262                                            key.type == NL80211_KEYTYPE_PAIRWISE,
3263                                            mac_addr))
3264                 return -EINVAL;
3265
3266         wdev_lock(dev->ieee80211_ptr);
3267         err = nl80211_key_allowed(dev->ieee80211_ptr);
3268         if (!err)
3269                 err = rdev_add_key(rdev, dev, key.idx,
3270                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3271                                     mac_addr, &key.p);
3272         wdev_unlock(dev->ieee80211_ptr);
3273
3274         return err;
3275 }
3276
3277 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3278 {
3279         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3280         int err;
3281         struct net_device *dev = info->user_ptr[1];
3282         u8 *mac_addr = NULL;
3283         struct key_parse key;
3284
3285         err = nl80211_parse_key(info, &key);
3286         if (err)
3287                 return err;
3288
3289         if (key.idx < 0)
3290                 return -EINVAL;
3291
3292         if (info->attrs[NL80211_ATTR_MAC])
3293                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3294
3295         if (key.type == -1) {
3296                 if (mac_addr)
3297                         key.type = NL80211_KEYTYPE_PAIRWISE;
3298                 else
3299                         key.type = NL80211_KEYTYPE_GROUP;
3300         }
3301
3302         /* for now */
3303         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3304             key.type != NL80211_KEYTYPE_GROUP)
3305                 return -EINVAL;
3306
3307         if (!rdev->ops->del_key)
3308                 return -EOPNOTSUPP;
3309
3310         wdev_lock(dev->ieee80211_ptr);
3311         err = nl80211_key_allowed(dev->ieee80211_ptr);
3312
3313         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
3314             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3315                 err = -ENOENT;
3316
3317         if (!err)
3318                 err = rdev_del_key(rdev, dev, key.idx,
3319                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3320                                    mac_addr);
3321
3322 #ifdef CONFIG_CFG80211_WEXT
3323         if (!err) {
3324                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
3325                         dev->ieee80211_ptr->wext.default_key = -1;
3326                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3327                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3328         }
3329 #endif
3330         wdev_unlock(dev->ieee80211_ptr);
3331
3332         return err;
3333 }
3334
3335 /* This function returns an error or the number of nested attributes */
3336 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3337 {
3338         struct nlattr *attr;
3339         int n_entries = 0, tmp;
3340
3341         nla_for_each_nested(attr, nl_attr, tmp) {
3342                 if (nla_len(attr) != ETH_ALEN)
3343                         return -EINVAL;
3344
3345                 n_entries++;
3346         }
3347
3348         return n_entries;
3349 }
3350
3351 /*
3352  * This function parses ACL information and allocates memory for ACL data.
3353  * On successful return, the calling function is responsible to free the
3354  * ACL buffer returned by this function.
3355  */
3356 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3357                                                 struct genl_info *info)
3358 {
3359         enum nl80211_acl_policy acl_policy;
3360         struct nlattr *attr;
3361         struct cfg80211_acl_data *acl;
3362         int i = 0, n_entries, tmp;
3363
3364         if (!wiphy->max_acl_mac_addrs)
3365                 return ERR_PTR(-EOPNOTSUPP);
3366
3367         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3368                 return ERR_PTR(-EINVAL);
3369
3370         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3371         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3372             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3373                 return ERR_PTR(-EINVAL);
3374
3375         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3376                 return ERR_PTR(-EINVAL);
3377
3378         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3379         if (n_entries < 0)
3380                 return ERR_PTR(n_entries);
3381
3382         if (n_entries > wiphy->max_acl_mac_addrs)
3383                 return ERR_PTR(-ENOTSUPP);
3384
3385         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3386                       GFP_KERNEL);
3387         if (!acl)
3388                 return ERR_PTR(-ENOMEM);
3389
3390         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3391                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3392                 i++;
3393         }
3394
3395         acl->n_acl_entries = n_entries;
3396         acl->acl_policy = acl_policy;
3397
3398         return acl;
3399 }
3400
3401 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3402 {
3403         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3404         struct net_device *dev = info->user_ptr[1];
3405         struct cfg80211_acl_data *acl;
3406         int err;
3407
3408         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3409             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3410                 return -EOPNOTSUPP;
3411
3412         if (!dev->ieee80211_ptr->beacon_interval)
3413                 return -EINVAL;
3414
3415         acl = parse_acl_data(&rdev->wiphy, info);
3416         if (IS_ERR(acl))
3417                 return PTR_ERR(acl);
3418
3419         err = rdev_set_mac_acl(rdev, dev, acl);
3420
3421         kfree(acl);
3422
3423         return err;
3424 }
3425
3426 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
3427                            u8 *rates, u8 rates_len)
3428 {
3429         u8 i;
3430         u32 mask = 0;
3431
3432         for (i = 0; i < rates_len; i++) {
3433                 int rate = (rates[i] & 0x7f) * 5;
3434                 int ridx;
3435
3436                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
3437                         struct ieee80211_rate *srate =
3438                                 &sband->bitrates[ridx];
3439                         if (rate == srate->bitrate) {
3440                                 mask |= 1 << ridx;
3441                                 break;
3442                         }
3443                 }
3444                 if (ridx == sband->n_bitrates)
3445                         return 0; /* rate not found */
3446         }
3447
3448         return mask;
3449 }
3450
3451 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
3452                                u8 *rates, u8 rates_len,
3453                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
3454 {
3455         u8 i;
3456
3457         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
3458
3459         for (i = 0; i < rates_len; i++) {
3460                 int ridx, rbit;
3461
3462                 ridx = rates[i] / 8;
3463                 rbit = BIT(rates[i] % 8);
3464
3465                 /* check validity */
3466                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
3467                         return false;
3468
3469                 /* check availability */
3470                 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
3471                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
3472                         mcs[ridx] |= rbit;
3473                 else
3474                         return false;
3475         }
3476
3477         return true;
3478 }
3479
3480 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
3481 {
3482         u16 mcs_mask = 0;
3483
3484         switch (vht_mcs_map) {
3485         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
3486                 break;
3487         case IEEE80211_VHT_MCS_SUPPORT_0_7:
3488                 mcs_mask = 0x00FF;
3489                 break;
3490         case IEEE80211_VHT_MCS_SUPPORT_0_8:
3491                 mcs_mask = 0x01FF;
3492                 break;
3493         case IEEE80211_VHT_MCS_SUPPORT_0_9:
3494                 mcs_mask = 0x03FF;
3495                 break;
3496         default:
3497                 break;
3498         }
3499
3500         return mcs_mask;
3501 }
3502
3503 static void vht_build_mcs_mask(u16 vht_mcs_map,
3504                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
3505 {
3506         u8 nss;
3507
3508         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
3509                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
3510                 vht_mcs_map >>= 2;
3511         }
3512 }
3513
3514 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
3515                              struct nl80211_txrate_vht *txrate,
3516                              u16 mcs[NL80211_VHT_NSS_MAX])
3517 {
3518         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3519         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
3520         u8 i;
3521
3522         if (!sband->vht_cap.vht_supported)
3523                 return false;
3524
3525         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
3526
3527         /* Build vht_mcs_mask from VHT capabilities */
3528         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
3529
3530         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
3531                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
3532                         mcs[i] = txrate->mcs[i];
3533                 else
3534                         return false;
3535         }
3536
3537         return true;
3538 }
3539
3540 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
3541         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
3542                                     .len = NL80211_MAX_SUPP_RATES },
3543         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
3544                                 .len = NL80211_MAX_SUPP_HT_RATES },
3545         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
3546         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
3547 };
3548
3549 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
3550                                          struct cfg80211_bitrate_mask *mask)
3551 {
3552         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
3553         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3554         int rem, i;
3555         struct nlattr *tx_rates;
3556         struct ieee80211_supported_band *sband;
3557         u16 vht_tx_mcs_map;
3558
3559         memset(mask, 0, sizeof(*mask));
3560         /* Default to all rates enabled */
3561         for (i = 0; i < NUM_NL80211_BANDS; i++) {
3562                 sband = rdev->wiphy.bands[i];
3563
3564                 if (!sband)
3565                         continue;
3566
3567                 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
3568                 memcpy(mask->control[i].ht_mcs,
3569                        sband->ht_cap.mcs.rx_mask,
3570                        sizeof(mask->control[i].ht_mcs));
3571
3572                 if (!sband->vht_cap.vht_supported)
3573                         continue;
3574
3575                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3576                 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
3577         }
3578
3579         /* if no rates are given set it back to the defaults */
3580         if (!info->attrs[NL80211_ATTR_TX_RATES])
3581                 goto out;
3582
3583         /* The nested attribute uses enum nl80211_band as the index. This maps
3584          * directly to the enum nl80211_band values used in cfg80211.
3585          */
3586         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
3587         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
3588                 enum nl80211_band band = nla_type(tx_rates);
3589                 int err;
3590
3591                 if (band < 0 || band >= NUM_NL80211_BANDS)
3592                         return -EINVAL;
3593                 sband = rdev->wiphy.bands[band];
3594                 if (sband == NULL)
3595                         return -EINVAL;
3596                 err = nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
3597                                 nla_len(tx_rates), nl80211_txattr_policy);
3598                 if (err)
3599                         return err;
3600                 if (tb[NL80211_TXRATE_LEGACY]) {
3601                         mask->control[band].legacy = rateset_to_mask(
3602                                 sband,
3603                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
3604                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
3605                         if ((mask->control[band].legacy == 0) &&
3606                             nla_len(tb[NL80211_TXRATE_LEGACY]))
3607                                 return -EINVAL;
3608                 }
3609                 if (tb[NL80211_TXRATE_HT]) {
3610                         if (!ht_rateset_to_mask(
3611                                         sband,
3612                                         nla_data(tb[NL80211_TXRATE_HT]),
3613                                         nla_len(tb[NL80211_TXRATE_HT]),
3614                                         mask->control[band].ht_mcs))
3615                                 return -EINVAL;
3616                 }
3617                 if (tb[NL80211_TXRATE_VHT]) {
3618                         if (!vht_set_mcs_mask(
3619                                         sband,
3620                                         nla_data(tb[NL80211_TXRATE_VHT]),
3621                                         mask->control[band].vht_mcs))
3622                                 return -EINVAL;
3623                 }
3624                 if (tb[NL80211_TXRATE_GI]) {
3625                         mask->control[band].gi =
3626                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
3627                         if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
3628                                 return -EINVAL;
3629                 }
3630
3631                 if (mask->control[band].legacy == 0) {
3632                         /* don't allow empty legacy rates if HT or VHT
3633                          * are not even supported.
3634                          */
3635                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
3636                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
3637                                 return -EINVAL;
3638
3639                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
3640                                 if (mask->control[band].ht_mcs[i])
3641                                         goto out;
3642
3643                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
3644                                 if (mask->control[band].vht_mcs[i])
3645                                         goto out;
3646
3647                         /* legacy and mcs rates may not be both empty */
3648                         return -EINVAL;
3649                 }
3650         }
3651
3652 out:
3653         return 0;
3654 }
3655
3656 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
3657                                    enum nl80211_band band,
3658                                    struct cfg80211_bitrate_mask *beacon_rate)
3659 {
3660         u32 count_ht, count_vht, i;
3661         u32 rate = beacon_rate->control[band].legacy;
3662
3663         /* Allow only one rate */
3664         if (hweight32(rate) > 1)
3665                 return -EINVAL;
3666
3667         count_ht = 0;
3668         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3669                 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
3670                         return -EINVAL;
3671                 } else if (beacon_rate->control[band].ht_mcs[i]) {
3672                         count_ht++;
3673                         if (count_ht > 1)
3674                                 return -EINVAL;
3675                 }
3676                 if (count_ht && rate)
3677                         return -EINVAL;
3678         }
3679
3680         count_vht = 0;
3681         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
3682                 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
3683                         return -EINVAL;
3684                 } else if (beacon_rate->control[band].vht_mcs[i]) {
3685                         count_vht++;
3686                         if (count_vht > 1)
3687                                 return -EINVAL;
3688                 }
3689                 if (count_vht && rate)
3690                         return -EINVAL;
3691         }
3692
3693         if ((count_ht && count_vht) || (!rate && !count_ht && !count_vht))
3694                 return -EINVAL;
3695
3696         if (rate &&
3697             !wiphy_ext_feature_isset(&rdev->wiphy,
3698                                      NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
3699                 return -EINVAL;
3700         if (count_ht &&
3701             !wiphy_ext_feature_isset(&rdev->wiphy,
3702                                      NL80211_EXT_FEATURE_BEACON_RATE_HT))
3703                 return -EINVAL;
3704         if (count_vht &&
3705             !wiphy_ext_feature_isset(&rdev->wiphy,
3706                                      NL80211_EXT_FEATURE_BEACON_RATE_VHT))
3707                 return -EINVAL;
3708
3709         return 0;
3710 }
3711
3712 static int nl80211_parse_beacon(struct nlattr *attrs[],
3713                                 struct cfg80211_beacon_data *bcn)
3714 {
3715         bool haveinfo = false;
3716
3717         if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
3718             !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
3719             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
3720             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
3721                 return -EINVAL;
3722
3723         memset(bcn, 0, sizeof(*bcn));
3724
3725         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
3726                 int ret = validate_beacon_head(attrs[NL80211_ATTR_BEACON_HEAD]);
3727
3728                 if (ret)
3729                         return ret;
3730
3731                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
3732                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
3733                 if (!bcn->head_len)
3734                         return -EINVAL;
3735                 haveinfo = true;
3736         }
3737
3738         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
3739                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
3740                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
3741                 haveinfo = true;
3742         }
3743
3744         if (!haveinfo)
3745                 return -EINVAL;
3746
3747         if (attrs[NL80211_ATTR_IE]) {
3748                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
3749                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3750         }
3751
3752         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3753                 bcn->proberesp_ies =
3754                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3755                 bcn->proberesp_ies_len =
3756                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3757         }
3758
3759         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3760                 bcn->assocresp_ies =
3761                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3762                 bcn->assocresp_ies_len =
3763                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3764         }
3765
3766         if (attrs[NL80211_ATTR_PROBE_RESP]) {
3767                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
3768                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3769         }
3770
3771         return 0;
3772 }
3773
3774 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
3775                                    struct cfg80211_ap_settings *params)
3776 {
3777         struct wireless_dev *wdev;
3778         bool ret = false;
3779
3780         list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
3781                 if (wdev->iftype != NL80211_IFTYPE_AP &&
3782                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
3783                         continue;
3784
3785                 if (!wdev->preset_chandef.chan)
3786                         continue;
3787
3788                 params->chandef = wdev->preset_chandef;
3789                 ret = true;
3790                 break;
3791         }
3792
3793         return ret;
3794 }
3795
3796 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3797                                     enum nl80211_auth_type auth_type,
3798                                     enum nl80211_commands cmd)
3799 {
3800         if (auth_type > NL80211_AUTHTYPE_MAX)
3801                 return false;
3802
3803         switch (cmd) {
3804         case NL80211_CMD_AUTHENTICATE:
3805                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3806                     auth_type == NL80211_AUTHTYPE_SAE)
3807                         return false;
3808                 return true;
3809         case NL80211_CMD_CONNECT:
3810         case NL80211_CMD_START_AP:
3811                 /* SAE not supported yet */
3812                 if (auth_type == NL80211_AUTHTYPE_SAE)
3813                         return false;
3814                 return true;
3815         default:
3816                 return false;
3817         }
3818 }
3819
3820 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3821 {
3822         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3823         struct net_device *dev = info->user_ptr[1];
3824         struct wireless_dev *wdev = dev->ieee80211_ptr;
3825         struct cfg80211_ap_settings params;
3826         int err;
3827
3828         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3829             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3830                 return -EOPNOTSUPP;
3831
3832         if (!rdev->ops->start_ap)
3833                 return -EOPNOTSUPP;
3834
3835         if (wdev->beacon_interval)
3836                 return -EALREADY;
3837
3838         memset(&params, 0, sizeof(params));
3839
3840         /* these are required for START_AP */
3841         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3842             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3843             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3844                 return -EINVAL;
3845
3846         err = nl80211_parse_beacon(info->attrs, &params.beacon);
3847         if (err)
3848                 return err;
3849
3850         params.beacon_interval =
3851                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3852         params.dtim_period =
3853                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3854
3855         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
3856         if (err)
3857                 return err;
3858
3859         /*
3860          * In theory, some of these attributes should be required here
3861          * but since they were not used when the command was originally
3862          * added, keep them optional for old user space programs to let
3863          * them continue to work with drivers that do not need the
3864          * additional information -- drivers must check!
3865          */
3866         if (info->attrs[NL80211_ATTR_SSID]) {
3867                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3868                 params.ssid_len =
3869                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3870                 if (params.ssid_len == 0 ||
3871                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3872                         return -EINVAL;
3873         }
3874
3875         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3876                 params.hidden_ssid = nla_get_u32(
3877                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3878                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3879                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3880                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3881                         return -EINVAL;
3882         }
3883
3884         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3885
3886         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3887                 params.auth_type = nla_get_u32(
3888                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3889                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3890                                              NL80211_CMD_START_AP))
3891                         return -EINVAL;
3892         } else
3893                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3894
3895         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3896                                       NL80211_MAX_NR_CIPHER_SUITES);
3897         if (err)
3898                 return err;
3899
3900         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3901                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3902                         return -EOPNOTSUPP;
3903                 params.inactivity_timeout = nla_get_u16(
3904                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3905         }
3906
3907         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3908                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3909                         return -EINVAL;
3910                 params.p2p_ctwindow =
3911                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3912                 if (params.p2p_ctwindow > 127)
3913                         return -EINVAL;
3914                 if (params.p2p_ctwindow != 0 &&
3915                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3916                         return -EINVAL;
3917         }
3918
3919         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3920                 u8 tmp;
3921
3922                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3923                         return -EINVAL;
3924                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3925                 if (tmp > 1)
3926                         return -EINVAL;
3927                 params.p2p_opp_ps = tmp;
3928                 if (params.p2p_opp_ps != 0 &&
3929                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3930                         return -EINVAL;
3931         }
3932
3933         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3934                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
3935                 if (err)
3936                         return err;
3937         } else if (wdev->preset_chandef.chan) {
3938                 params.chandef = wdev->preset_chandef;
3939         } else if (!nl80211_get_ap_channel(rdev, &params))
3940                 return -EINVAL;
3941
3942         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
3943                                            wdev->iftype))
3944                 return -EINVAL;
3945
3946         if (info->attrs[NL80211_ATTR_TX_RATES]) {
3947                 err = nl80211_parse_tx_bitrate_mask(info, &params.beacon_rate);
3948                 if (err)
3949                         return err;
3950
3951                 err = validate_beacon_tx_rate(rdev, params.chandef.chan->band,
3952                                               &params.beacon_rate);
3953                 if (err)
3954                         return err;
3955         }
3956
3957         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
3958                 params.smps_mode =
3959                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
3960                 switch (params.smps_mode) {
3961                 case NL80211_SMPS_OFF:
3962                         break;
3963                 case NL80211_SMPS_STATIC:
3964                         if (!(rdev->wiphy.features &
3965                               NL80211_FEATURE_STATIC_SMPS))
3966                                 return -EINVAL;
3967                         break;
3968                 case NL80211_SMPS_DYNAMIC:
3969                         if (!(rdev->wiphy.features &
3970                               NL80211_FEATURE_DYNAMIC_SMPS))
3971                                 return -EINVAL;
3972                         break;
3973                 default:
3974                         return -EINVAL;
3975                 }
3976         } else {
3977                 params.smps_mode = NL80211_SMPS_OFF;
3978         }
3979
3980         params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
3981         if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
3982                 return -EOPNOTSUPP;
3983
3984         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3985                 params.acl = parse_acl_data(&rdev->wiphy, info);
3986                 if (IS_ERR(params.acl))
3987                         return PTR_ERR(params.acl);
3988         }
3989
3990         wdev_lock(wdev);
3991         err = rdev_start_ap(rdev, dev, &params);
3992         if (!err) {
3993                 wdev->preset_chandef = params.chandef;
3994                 wdev->beacon_interval = params.beacon_interval;
3995                 wdev->chandef = params.chandef;
3996                 wdev->ssid_len = params.ssid_len;
3997                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3998         }
3999         wdev_unlock(wdev);
4000
4001         kfree(params.acl);
4002
4003         return err;
4004 }
4005
4006 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
4007 {
4008         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4009         struct net_device *dev = info->user_ptr[1];
4010         struct wireless_dev *wdev = dev->ieee80211_ptr;
4011         struct cfg80211_beacon_data params;
4012         int err;
4013
4014         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4015             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4016                 return -EOPNOTSUPP;
4017
4018         if (!rdev->ops->change_beacon)
4019                 return -EOPNOTSUPP;
4020
4021         if (!wdev->beacon_interval)
4022                 return -EINVAL;
4023
4024         err = nl80211_parse_beacon(info->attrs, &params);
4025         if (err)
4026                 return err;
4027
4028         wdev_lock(wdev);
4029         err = rdev_change_beacon(rdev, dev, &params);
4030         wdev_unlock(wdev);
4031
4032         return err;
4033 }
4034
4035 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
4036 {
4037         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4038         struct net_device *dev = info->user_ptr[1];
4039
4040         return cfg80211_stop_ap(rdev, dev, false);
4041 }
4042
4043 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
4044         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
4045         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
4046         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
4047         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
4048         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
4049         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
4050 };
4051
4052 static int parse_station_flags(struct genl_info *info,
4053                                enum nl80211_iftype iftype,
4054                                struct station_parameters *params)
4055 {
4056         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
4057         struct nlattr *nla;
4058         int flag;
4059
4060         /*
4061          * Try parsing the new attribute first so userspace
4062          * can specify both for older kernels.
4063          */
4064         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
4065         if (nla) {
4066                 struct nl80211_sta_flag_update *sta_flags;
4067
4068                 sta_flags = nla_data(nla);
4069                 params->sta_flags_mask = sta_flags->mask;
4070                 params->sta_flags_set = sta_flags->set;
4071                 params->sta_flags_set &= params->sta_flags_mask;
4072                 if ((params->sta_flags_mask |
4073                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
4074                         return -EINVAL;
4075                 return 0;
4076         }
4077
4078         /* if present, parse the old attribute */
4079
4080         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
4081         if (!nla)
4082                 return 0;
4083
4084         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
4085                              nla, sta_flags_policy))
4086                 return -EINVAL;
4087
4088         /*
4089          * Only allow certain flags for interface types so that
4090          * other attributes are silently ignored. Remember that
4091          * this is backward compatibility code with old userspace
4092          * and shouldn't be hit in other cases anyway.
4093          */
4094         switch (iftype) {
4095         case NL80211_IFTYPE_AP:
4096         case NL80211_IFTYPE_AP_VLAN:
4097         case NL80211_IFTYPE_P2P_GO:
4098                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4099                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4100                                          BIT(NL80211_STA_FLAG_WME) |
4101                                          BIT(NL80211_STA_FLAG_MFP);
4102                 break;
4103         case NL80211_IFTYPE_P2P_CLIENT:
4104         case NL80211_IFTYPE_STATION:
4105                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4106                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
4107                 break;
4108         case NL80211_IFTYPE_MESH_POINT:
4109                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4110                                          BIT(NL80211_STA_FLAG_MFP) |
4111                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
4112                 break;
4113         default:
4114                 return -EINVAL;
4115         }
4116
4117         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
4118                 if (flags[flag]) {
4119                         params->sta_flags_set |= (1<<flag);
4120
4121                         /* no longer support new API additions in old API */
4122                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
4123                                 return -EINVAL;
4124                 }
4125         }
4126
4127         return 0;
4128 }
4129
4130 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
4131                                  int attr)
4132 {
4133         struct nlattr *rate;
4134         u32 bitrate;
4135         u16 bitrate_compat;
4136         enum nl80211_rate_info rate_flg;
4137
4138         rate = nla_nest_start(msg, attr);
4139         if (!rate)
4140                 return false;
4141
4142         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
4143         bitrate = cfg80211_calculate_bitrate(info);
4144         /* report 16-bit bitrate only if we can */
4145         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
4146         if (bitrate > 0 &&
4147             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
4148                 return false;
4149         if (bitrate_compat > 0 &&
4150             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
4151                 return false;
4152
4153         switch (info->bw) {
4154         case RATE_INFO_BW_5:
4155                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
4156                 break;
4157         case RATE_INFO_BW_10:
4158                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
4159                 break;
4160         default:
4161                 WARN_ON(1);
4162                 /* fall through */
4163         case RATE_INFO_BW_20:
4164                 rate_flg = 0;
4165                 break;
4166         case RATE_INFO_BW_40:
4167                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
4168                 break;
4169         case RATE_INFO_BW_80:
4170                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
4171                 break;
4172         case RATE_INFO_BW_160:
4173                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
4174                 break;
4175         }
4176
4177         if (rate_flg && nla_put_flag(msg, rate_flg))
4178                 return false;
4179
4180         if (info->flags & RATE_INFO_FLAGS_MCS) {
4181                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
4182                         return false;
4183                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4184                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4185                         return false;
4186         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
4187                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
4188                         return false;
4189                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
4190                         return false;
4191                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4192                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4193                         return false;
4194         }
4195
4196         nla_nest_end(msg, rate);
4197         return true;
4198 }
4199
4200 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
4201                                int id)
4202 {
4203         void *attr;
4204         int i = 0;
4205
4206         if (!mask)
4207                 return true;
4208
4209         attr = nla_nest_start(msg, id);
4210         if (!attr)
4211                 return false;
4212
4213         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
4214                 if (!(mask & BIT(i)))
4215                         continue;
4216
4217                 if (nla_put_u8(msg, i, signal[i]))
4218                         return false;
4219         }
4220
4221         nla_nest_end(msg, attr);
4222
4223         return true;
4224 }
4225
4226 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
4227                                 u32 seq, int flags,
4228                                 struct cfg80211_registered_device *rdev,
4229                                 struct net_device *dev,
4230                                 const u8 *mac_addr, struct station_info *sinfo)
4231 {
4232         void *hdr;
4233         struct nlattr *sinfoattr, *bss_param;
4234
4235         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
4236         if (!hdr)
4237                 return -1;
4238
4239         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4240             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
4241             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
4242                 goto nla_put_failure;
4243
4244         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
4245         if (!sinfoattr)
4246                 goto nla_put_failure;
4247
4248 #define PUT_SINFO(attr, memb, type) do {                                \
4249         BUILD_BUG_ON(sizeof(type) == sizeof(u64));                      \
4250         if (sinfo->filled & (1ULL << NL80211_STA_INFO_ ## attr) &&      \
4251             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
4252                              sinfo->memb))                              \
4253                 goto nla_put_failure;                                   \
4254         } while (0)
4255 #define PUT_SINFO_U64(attr, memb) do {                                  \
4256         if (sinfo->filled & (1ULL << NL80211_STA_INFO_ ## attr) &&      \
4257             nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,           \
4258                               sinfo->memb, NL80211_STA_INFO_PAD))       \
4259                 goto nla_put_failure;                                   \
4260         } while (0)
4261
4262         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
4263         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
4264
4265         if (sinfo->filled & (BIT(NL80211_STA_INFO_RX_BYTES) |
4266                              BIT(NL80211_STA_INFO_RX_BYTES64)) &&
4267             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
4268                         (u32)sinfo->rx_bytes))
4269                 goto nla_put_failure;
4270
4271         if (sinfo->filled & (BIT(NL80211_STA_INFO_TX_BYTES) |
4272                              BIT(NL80211_STA_INFO_TX_BYTES64)) &&
4273             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
4274                         (u32)sinfo->tx_bytes))
4275                 goto nla_put_failure;
4276
4277         PUT_SINFO_U64(RX_BYTES64, rx_bytes);
4278         PUT_SINFO_U64(TX_BYTES64, tx_bytes);
4279         PUT_SINFO(LLID, llid, u16);
4280         PUT_SINFO(PLID, plid, u16);
4281         PUT_SINFO(PLINK_STATE, plink_state, u8);
4282         PUT_SINFO_U64(RX_DURATION, rx_duration);
4283
4284         switch (rdev->wiphy.signal_type) {
4285         case CFG80211_SIGNAL_TYPE_MBM:
4286                 PUT_SINFO(SIGNAL, signal, u8);
4287                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
4288                 break;
4289         default:
4290                 break;
4291         }
4292         if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL)) {
4293                 if (!nl80211_put_signal(msg, sinfo->chains,
4294                                         sinfo->chain_signal,
4295                                         NL80211_STA_INFO_CHAIN_SIGNAL))
4296                         goto nla_put_failure;
4297         }
4298         if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
4299                 if (!nl80211_put_signal(msg, sinfo->chains,
4300                                         sinfo->chain_signal_avg,
4301                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
4302                         goto nla_put_failure;
4303         }
4304         if (sinfo->filled & BIT(NL80211_STA_INFO_TX_BITRATE)) {
4305                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
4306                                           NL80211_STA_INFO_TX_BITRATE))
4307                         goto nla_put_failure;
4308         }
4309         if (sinfo->filled & BIT(NL80211_STA_INFO_RX_BITRATE)) {
4310                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
4311                                           NL80211_STA_INFO_RX_BITRATE))
4312                         goto nla_put_failure;
4313         }
4314
4315         PUT_SINFO(RX_PACKETS, rx_packets, u32);
4316         PUT_SINFO(TX_PACKETS, tx_packets, u32);
4317         PUT_SINFO(TX_RETRIES, tx_retries, u32);
4318         PUT_SINFO(TX_FAILED, tx_failed, u32);
4319         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
4320         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
4321         PUT_SINFO(LOCAL_PM, local_pm, u32);
4322         PUT_SINFO(PEER_PM, peer_pm, u32);
4323         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
4324
4325         if (sinfo->filled & BIT(NL80211_STA_INFO_BSS_PARAM)) {
4326                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
4327                 if (!bss_param)
4328                         goto nla_put_failure;
4329
4330                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
4331                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
4332                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
4333                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
4334                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
4335                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
4336                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
4337                                sinfo->bss_param.dtim_period) ||
4338                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
4339                                 sinfo->bss_param.beacon_interval))
4340                         goto nla_put_failure;
4341
4342                 nla_nest_end(msg, bss_param);
4343         }
4344         if ((sinfo->filled & BIT(NL80211_STA_INFO_STA_FLAGS)) &&
4345             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
4346                     sizeof(struct nl80211_sta_flag_update),
4347                     &sinfo->sta_flags))
4348                 goto nla_put_failure;
4349
4350         PUT_SINFO_U64(T_OFFSET, t_offset);
4351         PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
4352         PUT_SINFO_U64(BEACON_RX, rx_beacon);
4353         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
4354
4355 #undef PUT_SINFO
4356 #undef PUT_SINFO_U64
4357
4358         if (sinfo->filled & BIT(NL80211_STA_INFO_TID_STATS)) {
4359                 struct nlattr *tidsattr;
4360                 int tid;
4361
4362                 tidsattr = nla_nest_start(msg, NL80211_STA_INFO_TID_STATS);
4363                 if (!tidsattr)
4364                         goto nla_put_failure;
4365
4366                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
4367                         struct cfg80211_tid_stats *tidstats;
4368                         struct nlattr *tidattr;
4369
4370                         tidstats = &sinfo->pertid[tid];
4371
4372                         if (!tidstats->filled)
4373                                 continue;
4374
4375                         tidattr = nla_nest_start(msg, tid + 1);
4376                         if (!tidattr)
4377                                 goto nla_put_failure;
4378
4379 #define PUT_TIDVAL_U64(attr, memb) do {                                 \
4380         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
4381             nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr,          \
4382                               tidstats->memb, NL80211_TID_STATS_PAD))   \
4383                 goto nla_put_failure;                                   \
4384         } while (0)
4385
4386                         PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
4387                         PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
4388                         PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
4389                         PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
4390
4391 #undef PUT_TIDVAL_U64
4392                         nla_nest_end(msg, tidattr);
4393                 }
4394
4395                 nla_nest_end(msg, tidsattr);
4396         }
4397
4398         nla_nest_end(msg, sinfoattr);
4399
4400         if (sinfo->assoc_req_ies_len &&
4401             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
4402                     sinfo->assoc_req_ies))
4403                 goto nla_put_failure;
4404
4405         genlmsg_end(msg, hdr);
4406         return 0;
4407
4408  nla_put_failure:
4409         genlmsg_cancel(msg, hdr);
4410         return -EMSGSIZE;
4411 }
4412
4413 static int nl80211_dump_station(struct sk_buff *skb,
4414                                 struct netlink_callback *cb)
4415 {
4416         struct station_info sinfo;
4417         struct cfg80211_registered_device *rdev;
4418         struct wireless_dev *wdev;
4419         u8 mac_addr[ETH_ALEN];
4420         int sta_idx = cb->args[2];
4421         int err;
4422
4423         rtnl_lock();
4424         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4425         if (err)
4426                 goto out_err;
4427
4428         if (!wdev->netdev) {
4429                 err = -EINVAL;
4430                 goto out_err;
4431         }
4432
4433         if (!rdev->ops->dump_station) {
4434                 err = -EOPNOTSUPP;
4435                 goto out_err;
4436         }
4437
4438         while (1) {
4439                 memset(&sinfo, 0, sizeof(sinfo));
4440                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
4441                                         mac_addr, &sinfo);
4442                 if (err == -ENOENT)
4443                         break;
4444                 if (err)
4445                         goto out_err;
4446
4447                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
4448                                 NETLINK_CB(cb->skb).portid,
4449                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4450                                 rdev, wdev->netdev, mac_addr,
4451                                 &sinfo) < 0)
4452                         goto out;
4453
4454                 sta_idx++;
4455         }
4456
4457  out:
4458         cb->args[2] = sta_idx;
4459         err = skb->len;
4460  out_err:
4461         rtnl_unlock();
4462
4463         return err;
4464 }
4465
4466 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
4467 {
4468         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4469         struct net_device *dev = info->user_ptr[1];
4470         struct station_info sinfo;
4471         struct sk_buff *msg;
4472         u8 *mac_addr = NULL;
4473         int err;
4474
4475         memset(&sinfo, 0, sizeof(sinfo));
4476
4477         if (!info->attrs[NL80211_ATTR_MAC])
4478                 return -EINVAL;
4479
4480         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4481
4482         if (!rdev->ops->get_station)
4483                 return -EOPNOTSUPP;
4484
4485         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
4486         if (err)
4487                 return err;
4488
4489         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4490         if (!msg)
4491                 return -ENOMEM;
4492
4493         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
4494                                  info->snd_portid, info->snd_seq, 0,
4495                                  rdev, dev, mac_addr, &sinfo) < 0) {
4496                 nlmsg_free(msg);
4497                 return -ENOBUFS;
4498         }
4499
4500         return genlmsg_reply(msg, info);
4501 }
4502
4503 int cfg80211_check_station_change(struct wiphy *wiphy,
4504                                   struct station_parameters *params,
4505                                   enum cfg80211_station_type statype)
4506 {
4507         if (params->listen_interval != -1 &&
4508             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4509                 return -EINVAL;
4510
4511         if (params->support_p2p_ps != -1 &&
4512             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4513                 return -EINVAL;
4514
4515         if (params->aid &&
4516             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
4517             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4518                 return -EINVAL;
4519
4520         /* When you run into this, adjust the code below for the new flag */
4521         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4522
4523         switch (statype) {
4524         case CFG80211_STA_MESH_PEER_KERNEL:
4525         case CFG80211_STA_MESH_PEER_USER:
4526                 /*
4527                  * No ignoring the TDLS flag here -- the userspace mesh
4528                  * code doesn't have the bug of including TDLS in the
4529                  * mask everywhere.
4530                  */
4531                 if (params->sta_flags_mask &
4532                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4533                                   BIT(NL80211_STA_FLAG_MFP) |
4534                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
4535                         return -EINVAL;
4536                 break;
4537         case CFG80211_STA_TDLS_PEER_SETUP:
4538         case CFG80211_STA_TDLS_PEER_ACTIVE:
4539                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4540                         return -EINVAL;
4541                 /* ignore since it can't change */
4542                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4543                 break;
4544         default:
4545                 /* disallow mesh-specific things */
4546                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
4547                         return -EINVAL;
4548                 if (params->local_pm)
4549                         return -EINVAL;
4550                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4551                         return -EINVAL;
4552         }
4553
4554         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4555             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
4556                 /* TDLS can't be set, ... */
4557                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4558                         return -EINVAL;
4559                 /*
4560                  * ... but don't bother the driver with it. This works around
4561                  * a hostapd/wpa_supplicant issue -- it always includes the
4562                  * TLDS_PEER flag in the mask even for AP mode.
4563                  */
4564                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4565         }
4566
4567         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4568             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4569                 /* reject other things that can't change */
4570                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
4571                         return -EINVAL;
4572                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
4573                         return -EINVAL;
4574                 if (params->supported_rates)
4575                         return -EINVAL;
4576                 if (params->ext_capab || params->ht_capa || params->vht_capa)
4577                         return -EINVAL;
4578         }
4579
4580         if (statype != CFG80211_STA_AP_CLIENT &&
4581             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4582                 if (params->vlan)
4583                         return -EINVAL;
4584         }
4585
4586         switch (statype) {
4587         case CFG80211_STA_AP_MLME_CLIENT:
4588                 /* Use this only for authorizing/unauthorizing a station */
4589                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
4590                         return -EOPNOTSUPP;
4591                 break;
4592         case CFG80211_STA_AP_CLIENT:
4593         case CFG80211_STA_AP_CLIENT_UNASSOC:
4594                 /* accept only the listed bits */
4595                 if (params->sta_flags_mask &
4596                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4597                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4598                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
4599                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4600                                   BIT(NL80211_STA_FLAG_WME) |
4601                                   BIT(NL80211_STA_FLAG_MFP)))
4602                         return -EINVAL;
4603
4604                 /* but authenticated/associated only if driver handles it */
4605                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4606                     params->sta_flags_mask &
4607                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4608                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4609                         return -EINVAL;
4610                 break;
4611         case CFG80211_STA_IBSS:
4612         case CFG80211_STA_AP_STA:
4613                 /* reject any changes other than AUTHORIZED */
4614                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
4615                         return -EINVAL;
4616                 break;
4617         case CFG80211_STA_TDLS_PEER_SETUP:
4618                 /* reject any changes other than AUTHORIZED or WME */
4619                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4620                                                BIT(NL80211_STA_FLAG_WME)))
4621                         return -EINVAL;
4622                 /* force (at least) rates when authorizing */
4623                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
4624                     !params->supported_rates)
4625                         return -EINVAL;
4626                 break;
4627         case CFG80211_STA_TDLS_PEER_ACTIVE:
4628                 /* reject any changes */
4629                 return -EINVAL;
4630         case CFG80211_STA_MESH_PEER_KERNEL:
4631                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4632                         return -EINVAL;
4633                 break;
4634         case CFG80211_STA_MESH_PEER_USER:
4635                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
4636                     params->plink_action != NL80211_PLINK_ACTION_BLOCK)
4637                         return -EINVAL;
4638                 break;
4639         }
4640
4641         return 0;
4642 }
4643 EXPORT_SYMBOL(cfg80211_check_station_change);
4644
4645 /*
4646  * Get vlan interface making sure it is running and on the right wiphy.
4647  */
4648 static struct net_device *get_vlan(struct genl_info *info,
4649                                    struct cfg80211_registered_device *rdev)
4650 {
4651         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
4652         struct net_device *v;
4653         int ret;
4654
4655         if (!vlanattr)
4656                 return NULL;
4657
4658         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
4659         if (!v)
4660                 return ERR_PTR(-ENODEV);
4661
4662         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
4663                 ret = -EINVAL;
4664                 goto error;
4665         }
4666
4667         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4668             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4669             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
4670                 ret = -EINVAL;
4671                 goto error;
4672         }
4673
4674         if (!netif_running(v)) {
4675                 ret = -ENETDOWN;
4676                 goto error;
4677         }
4678
4679         return v;
4680  error:
4681         dev_put(v);
4682         return ERR_PTR(ret);
4683 }
4684
4685 static const struct nla_policy
4686 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
4687         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
4688         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
4689 };
4690
4691 static int nl80211_parse_sta_wme(struct genl_info *info,
4692                                  struct station_parameters *params)
4693 {
4694         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
4695         struct nlattr *nla;
4696         int err;
4697
4698         /* parse WME attributes if present */
4699         if (!info->attrs[NL80211_ATTR_STA_WME])
4700                 return 0;
4701
4702         nla = info->attrs[NL80211_ATTR_STA_WME];
4703         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
4704                                nl80211_sta_wme_policy);
4705         if (err)
4706                 return err;
4707
4708         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
4709                 params->uapsd_queues = nla_get_u8(
4710                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
4711         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
4712                 return -EINVAL;
4713
4714         if (tb[NL80211_STA_WME_MAX_SP])
4715                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
4716
4717         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
4718                 return -EINVAL;
4719
4720         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
4721
4722         return 0;
4723 }
4724
4725 static int nl80211_parse_sta_channel_info(struct genl_info *info,
4726                                       struct station_parameters *params)
4727 {
4728         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
4729                 params->supported_channels =
4730                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4731                 params->supported_channels_len =
4732                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4733                 /*
4734                  * Need to include at least one (first channel, number of
4735                  * channels) tuple for each subband, and must have proper
4736                  * tuples for the rest of the data as well.
4737                  */
4738                 if (params->supported_channels_len < 2)
4739                         return -EINVAL;
4740                 if (params->supported_channels_len % 2)
4741                         return -EINVAL;
4742         }
4743
4744         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
4745                 params->supported_oper_classes =
4746                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4747                 params->supported_oper_classes_len =
4748                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4749                 /*
4750                  * The value of the Length field of the Supported Operating
4751                  * Classes element is between 2 and 253.
4752                  */
4753                 if (params->supported_oper_classes_len < 2 ||
4754                     params->supported_oper_classes_len > 253)
4755                         return -EINVAL;
4756         }
4757         return 0;
4758 }
4759
4760 static int nl80211_set_station_tdls(struct genl_info *info,
4761                                     struct station_parameters *params)
4762 {
4763         int err;
4764         /* Dummy STA entry gets updated once the peer capabilities are known */
4765         if (info->attrs[NL80211_ATTR_PEER_AID])
4766                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4767         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4768                 params->ht_capa =
4769                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4770         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4771                 params->vht_capa =
4772                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4773
4774         err = nl80211_parse_sta_channel_info(info, params);
4775         if (err)
4776                 return err;
4777
4778         return nl80211_parse_sta_wme(info, params);
4779 }
4780
4781 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
4782 {
4783         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4784         struct net_device *dev = info->user_ptr[1];
4785         struct station_parameters params;
4786         u8 *mac_addr;
4787         int err;
4788
4789         memset(&params, 0, sizeof(params));
4790
4791         if (!rdev->ops->change_station)
4792                 return -EOPNOTSUPP;
4793
4794         /*
4795          * AID and listen_interval properties can be set only for unassociated
4796          * station. Include these parameters here and will check them in
4797          * cfg80211_check_station_change().
4798          */
4799         if (info->attrs[NL80211_ATTR_STA_AID])
4800                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4801
4802         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4803                 params.listen_interval =
4804                      nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4805         else
4806                 params.listen_interval = -1;
4807
4808         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
4809                 u8 tmp;
4810
4811                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
4812                 if (tmp >= NUM_NL80211_P2P_PS_STATUS)
4813                         return -EINVAL;
4814
4815                 params.support_p2p_ps = tmp;
4816         } else {
4817                 params.support_p2p_ps = -1;
4818         }
4819
4820         if (!info->attrs[NL80211_ATTR_MAC])
4821                 return -EINVAL;
4822
4823         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4824
4825         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
4826                 params.supported_rates =
4827                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4828                 params.supported_rates_len =
4829                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4830         }
4831
4832         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4833                 params.capability =
4834                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4835                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4836         }
4837
4838         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4839                 params.ext_capab =
4840                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4841                 params.ext_capab_len =
4842                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4843         }
4844
4845         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4846                 return -EINVAL;
4847
4848         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4849                 params.plink_action =
4850                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4851                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4852                         return -EINVAL;
4853         }
4854
4855         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
4856                 params.plink_state =
4857                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
4858                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
4859                         return -EINVAL;
4860                 if (info->attrs[NL80211_ATTR_MESH_PEER_AID]) {
4861                         params.peer_aid = nla_get_u16(
4862                                 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
4863                         if (params.peer_aid > IEEE80211_MAX_AID)
4864                                 return -EINVAL;
4865                 }
4866                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
4867         }
4868
4869         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
4870                 enum nl80211_mesh_power_mode pm = nla_get_u32(
4871                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
4872
4873                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
4874                     pm > NL80211_MESH_POWER_MAX)
4875                         return -EINVAL;
4876
4877                 params.local_pm = pm;
4878         }
4879
4880         /* Include parameters for TDLS peer (will check later) */
4881         err = nl80211_set_station_tdls(info, &params);
4882         if (err)
4883                 return err;
4884
4885         params.vlan = get_vlan(info, rdev);
4886         if (IS_ERR(params.vlan))
4887                 return PTR_ERR(params.vlan);
4888
4889         switch (dev->ieee80211_ptr->iftype) {
4890         case NL80211_IFTYPE_AP:
4891         case NL80211_IFTYPE_AP_VLAN:
4892         case NL80211_IFTYPE_P2P_GO:
4893         case NL80211_IFTYPE_P2P_CLIENT:
4894         case NL80211_IFTYPE_STATION:
4895         case NL80211_IFTYPE_ADHOC:
4896         case NL80211_IFTYPE_MESH_POINT:
4897                 break;
4898         default:
4899                 err = -EOPNOTSUPP;
4900                 goto out_put_vlan;
4901         }
4902
4903         /* driver will call cfg80211_check_station_change() */
4904         err = rdev_change_station(rdev, dev, mac_addr, &params);
4905
4906  out_put_vlan:
4907         if (params.vlan)
4908                 dev_put(params.vlan);
4909
4910         return err;
4911 }
4912
4913 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
4914 {
4915         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4916         int err;
4917         struct net_device *dev = info->user_ptr[1];
4918         struct station_parameters params;
4919         u8 *mac_addr = NULL;
4920         u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4921                          BIT(NL80211_STA_FLAG_ASSOCIATED);
4922
4923         memset(&params, 0, sizeof(params));
4924
4925         if (!rdev->ops->add_station)
4926                 return -EOPNOTSUPP;
4927
4928         if (!info->attrs[NL80211_ATTR_MAC])
4929                 return -EINVAL;
4930
4931         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4932                 return -EINVAL;
4933
4934         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
4935                 return -EINVAL;
4936
4937         if (!info->attrs[NL80211_ATTR_STA_AID] &&
4938             !info->attrs[NL80211_ATTR_PEER_AID])
4939                 return -EINVAL;
4940
4941         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4942         params.supported_rates =
4943                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4944         params.supported_rates_len =
4945                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4946         params.listen_interval =
4947                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4948
4949         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
4950                 u8 tmp;
4951
4952                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
4953                 if (tmp >= NUM_NL80211_P2P_PS_STATUS)
4954                         return -EINVAL;
4955
4956                 params.support_p2p_ps = tmp;
4957         } else {
4958                 /*
4959                  * if not specified, assume it's supported for P2P GO interface,
4960                  * and is NOT supported for AP interface
4961                  */
4962                 params.support_p2p_ps =
4963                         dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
4964         }
4965
4966         if (info->attrs[NL80211_ATTR_PEER_AID])
4967                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4968         else
4969                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4970         if (!params.aid || params.aid > IEEE80211_MAX_AID)
4971                 return -EINVAL;
4972
4973         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4974                 params.capability =
4975                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4976                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4977         }
4978
4979         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4980                 params.ext_capab =
4981                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4982                 params.ext_capab_len =
4983                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4984         }
4985
4986         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4987                 params.ht_capa =
4988                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4989
4990         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4991                 params.vht_capa =
4992                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4993
4994         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
4995                 params.opmode_notif_used = true;
4996                 params.opmode_notif =
4997                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
4998         }
4999
5000         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
5001                 params.plink_action =
5002                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
5003                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
5004                         return -EINVAL;
5005         }
5006
5007         err = nl80211_parse_sta_channel_info(info, &params);
5008         if (err)
5009                 return err;
5010
5011         err = nl80211_parse_sta_wme(info, &params);
5012         if (err)
5013                 return err;
5014
5015         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
5016                 return -EINVAL;
5017
5018         /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
5019          * as userspace might just pass through the capabilities from the IEs
5020          * directly, rather than enforcing this restriction and returning an
5021          * error in this case.
5022          */
5023         if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
5024                 params.ht_capa = NULL;
5025                 params.vht_capa = NULL;
5026         }
5027
5028         /* When you run into this, adjust the code below for the new flag */
5029         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
5030
5031         switch (dev->ieee80211_ptr->iftype) {
5032         case NL80211_IFTYPE_AP:
5033         case NL80211_IFTYPE_AP_VLAN:
5034         case NL80211_IFTYPE_P2P_GO:
5035                 /* ignore WME attributes if iface/sta is not capable */
5036                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
5037                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
5038                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5039
5040                 /* TDLS peers cannot be added */
5041                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5042                     info->attrs[NL80211_ATTR_PEER_AID])
5043                         return -EINVAL;
5044                 /* but don't bother the driver with it */
5045                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5046
5047                 /* allow authenticated/associated only if driver handles it */
5048                 if (!(rdev->wiphy.features &
5049                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
5050                     params.sta_flags_mask & auth_assoc)
5051                         return -EINVAL;
5052
5053                 /* Older userspace, or userspace wanting to be compatible with
5054                  * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
5055                  * and assoc flags in the mask, but assumes the station will be
5056                  * added as associated anyway since this was the required driver
5057                  * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
5058                  * introduced.
5059                  * In order to not bother drivers with this quirk in the API
5060                  * set the flags in both the mask and set for new stations in
5061                  * this case.
5062                  */
5063                 if (!(params.sta_flags_mask & auth_assoc)) {
5064                         params.sta_flags_mask |= auth_assoc;
5065                         params.sta_flags_set |= auth_assoc;
5066                 }
5067
5068                 /* must be last in here for error handling */
5069                 params.vlan = get_vlan(info, rdev);
5070                 if (IS_ERR(params.vlan))
5071                         return PTR_ERR(params.vlan);
5072                 break;
5073         case NL80211_IFTYPE_MESH_POINT:
5074                 /* ignore uAPSD data */
5075                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5076
5077                 /* associated is disallowed */
5078                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
5079                         return -EINVAL;
5080                 /* TDLS peers cannot be added */
5081                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5082                     info->attrs[NL80211_ATTR_PEER_AID])
5083                         return -EINVAL;
5084                 break;
5085         case NL80211_IFTYPE_STATION:
5086         case NL80211_IFTYPE_P2P_CLIENT:
5087                 /* ignore uAPSD data */
5088                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5089
5090                 /* these are disallowed */
5091                 if (params.sta_flags_mask &
5092                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
5093                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
5094                         return -EINVAL;
5095                 /* Only TDLS peers can be added */
5096                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
5097                         return -EINVAL;
5098                 /* Can only add if TDLS ... */
5099                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
5100                         return -EOPNOTSUPP;
5101                 /* ... with external setup is supported */
5102                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
5103                         return -EOPNOTSUPP;
5104                 /*
5105                  * Older wpa_supplicant versions always mark the TDLS peer
5106                  * as authorized, but it shouldn't yet be.
5107                  */
5108                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
5109                 break;
5110         default:
5111                 return -EOPNOTSUPP;
5112         }
5113
5114         /* be aware of params.vlan when changing code here */
5115
5116         err = rdev_add_station(rdev, dev, mac_addr, &params);
5117
5118         if (params.vlan)
5119                 dev_put(params.vlan);
5120         return err;
5121 }
5122
5123 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
5124 {
5125         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5126         struct net_device *dev = info->user_ptr[1];
5127         struct station_del_parameters params;
5128
5129         memset(&params, 0, sizeof(params));
5130
5131         if (info->attrs[NL80211_ATTR_MAC])
5132                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
5133
5134         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5135             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5136             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5137             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5138                 return -EINVAL;
5139
5140         if (!rdev->ops->del_station)
5141                 return -EOPNOTSUPP;
5142
5143         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
5144                 params.subtype =
5145                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
5146                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
5147                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
5148                         return -EINVAL;
5149         } else {
5150                 /* Default to Deauthentication frame */
5151                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
5152         }
5153
5154         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
5155                 params.reason_code =
5156                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5157                 if (params.reason_code == 0)
5158                         return -EINVAL; /* 0 is reserved */
5159         } else {
5160                 /* Default to reason code 2 */
5161                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
5162         }
5163
5164         return rdev_del_station(rdev, dev, &params);
5165 }
5166
5167 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
5168                                 int flags, struct net_device *dev,
5169                                 u8 *dst, u8 *next_hop,
5170                                 struct mpath_info *pinfo)
5171 {
5172         void *hdr;
5173         struct nlattr *pinfoattr;
5174
5175         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
5176         if (!hdr)
5177                 return -1;
5178
5179         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5180             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
5181             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
5182             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
5183                 goto nla_put_failure;
5184
5185         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
5186         if (!pinfoattr)
5187                 goto nla_put_failure;
5188         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
5189             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
5190                         pinfo->frame_qlen))
5191                 goto nla_put_failure;
5192         if (((pinfo->filled & MPATH_INFO_SN) &&
5193              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
5194             ((pinfo->filled & MPATH_INFO_METRIC) &&
5195              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
5196                          pinfo->metric)) ||
5197             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
5198              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
5199                          pinfo->exptime)) ||
5200             ((pinfo->filled & MPATH_INFO_FLAGS) &&
5201              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
5202                         pinfo->flags)) ||
5203             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
5204              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
5205                          pinfo->discovery_timeout)) ||
5206             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
5207              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
5208                         pinfo->discovery_retries)))
5209                 goto nla_put_failure;
5210
5211         nla_nest_end(msg, pinfoattr);
5212
5213         genlmsg_end(msg, hdr);
5214         return 0;
5215
5216  nla_put_failure:
5217         genlmsg_cancel(msg, hdr);
5218         return -EMSGSIZE;
5219 }
5220
5221 static int nl80211_dump_mpath(struct sk_buff *skb,
5222                               struct netlink_callback *cb)
5223 {
5224         struct mpath_info pinfo;
5225         struct cfg80211_registered_device *rdev;
5226         struct wireless_dev *wdev;
5227         u8 dst[ETH_ALEN];
5228         u8 next_hop[ETH_ALEN];
5229         int path_idx = cb->args[2];
5230         int err;
5231
5232         rtnl_lock();
5233         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5234         if (err)
5235                 goto out_err;
5236
5237         if (!rdev->ops->dump_mpath) {
5238                 err = -EOPNOTSUPP;
5239                 goto out_err;
5240         }
5241
5242         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5243                 err = -EOPNOTSUPP;
5244                 goto out_err;
5245         }
5246
5247         while (1) {
5248                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
5249                                       next_hop, &pinfo);
5250                 if (err == -ENOENT)
5251                         break;
5252                 if (err)
5253                         goto out_err;
5254
5255                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5256                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
5257                                        wdev->netdev, dst, next_hop,
5258                                        &pinfo) < 0)
5259                         goto out;
5260
5261                 path_idx++;
5262         }
5263
5264  out:
5265         cb->args[2] = path_idx;
5266         err = skb->len;
5267  out_err:
5268         rtnl_unlock();
5269         return err;
5270 }
5271
5272 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
5273 {
5274         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5275         int err;
5276         struct net_device *dev = info->user_ptr[1];
5277         struct mpath_info pinfo;
5278         struct sk_buff *msg;
5279         u8 *dst = NULL;
5280         u8 next_hop[ETH_ALEN];
5281
5282         memset(&pinfo, 0, sizeof(pinfo));
5283
5284         if (!info->attrs[NL80211_ATTR_MAC])
5285                 return -EINVAL;
5286
5287         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5288
5289         if (!rdev->ops->get_mpath)
5290                 return -EOPNOTSUPP;
5291
5292         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5293                 return -EOPNOTSUPP;
5294
5295         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
5296         if (err)
5297                 return err;
5298
5299         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5300         if (!msg)
5301                 return -ENOMEM;
5302
5303         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5304                                  dev, dst, next_hop, &pinfo) < 0) {
5305                 nlmsg_free(msg);
5306                 return -ENOBUFS;
5307         }
5308
5309         return genlmsg_reply(msg, info);
5310 }
5311
5312 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
5313 {
5314         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5315         struct net_device *dev = info->user_ptr[1];
5316         u8 *dst = NULL;
5317         u8 *next_hop = NULL;
5318
5319         if (!info->attrs[NL80211_ATTR_MAC])
5320                 return -EINVAL;
5321
5322         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5323                 return -EINVAL;
5324
5325         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5326         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5327
5328         if (!rdev->ops->change_mpath)
5329                 return -EOPNOTSUPP;
5330
5331         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5332                 return -EOPNOTSUPP;
5333
5334         return rdev_change_mpath(rdev, dev, dst, next_hop);
5335 }
5336
5337 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
5338 {
5339         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5340         struct net_device *dev = info->user_ptr[1];
5341         u8 *dst = NULL;
5342         u8 *next_hop = NULL;
5343
5344         if (!info->attrs[NL80211_ATTR_MAC])
5345                 return -EINVAL;
5346
5347         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5348                 return -EINVAL;
5349
5350         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5351         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5352
5353         if (!rdev->ops->add_mpath)
5354                 return -EOPNOTSUPP;
5355
5356         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5357                 return -EOPNOTSUPP;
5358
5359         return rdev_add_mpath(rdev, dev, dst, next_hop);
5360 }
5361
5362 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
5363 {
5364         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5365         struct net_device *dev = info->user_ptr[1];
5366         u8 *dst = NULL;
5367
5368         if (info->attrs[NL80211_ATTR_MAC])
5369                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5370
5371         if (!rdev->ops->del_mpath)
5372                 return -EOPNOTSUPP;
5373
5374         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5375                 return -EOPNOTSUPP;
5376
5377         return rdev_del_mpath(rdev, dev, dst);
5378 }
5379
5380 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
5381 {
5382         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5383         int err;
5384         struct net_device *dev = info->user_ptr[1];
5385         struct mpath_info pinfo;
5386         struct sk_buff *msg;
5387         u8 *dst = NULL;
5388         u8 mpp[ETH_ALEN];
5389
5390         memset(&pinfo, 0, sizeof(pinfo));
5391
5392         if (!info->attrs[NL80211_ATTR_MAC])
5393                 return -EINVAL;
5394
5395         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5396
5397         if (!rdev->ops->get_mpp)
5398                 return -EOPNOTSUPP;
5399
5400         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5401                 return -EOPNOTSUPP;
5402
5403         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
5404         if (err)
5405                 return err;
5406
5407         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5408         if (!msg)
5409                 return -ENOMEM;
5410
5411         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5412                                dev, dst, mpp, &pinfo) < 0) {
5413                 nlmsg_free(msg);
5414                 return -ENOBUFS;
5415         }
5416
5417         return genlmsg_reply(msg, info);
5418 }
5419
5420 static int nl80211_dump_mpp(struct sk_buff *skb,
5421                             struct netlink_callback *cb)
5422 {
5423         struct mpath_info pinfo;
5424         struct cfg80211_registered_device *rdev;
5425         struct wireless_dev *wdev;
5426         u8 dst[ETH_ALEN];
5427         u8 mpp[ETH_ALEN];
5428         int path_idx = cb->args[2];
5429         int err;
5430
5431         rtnl_lock();
5432         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5433         if (err)
5434                 goto out_err;
5435
5436         if (!rdev->ops->dump_mpp) {
5437                 err = -EOPNOTSUPP;
5438                 goto out_err;
5439         }
5440
5441         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5442                 err = -EOPNOTSUPP;
5443                 goto out_err;
5444         }
5445
5446         while (1) {
5447                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
5448                                     mpp, &pinfo);
5449                 if (err == -ENOENT)
5450                         break;
5451                 if (err)
5452                         goto out_err;
5453
5454                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5455                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
5456                                        wdev->netdev, dst, mpp,
5457                                        &pinfo) < 0)
5458                         goto out;
5459
5460                 path_idx++;
5461         }
5462
5463  out:
5464         cb->args[2] = path_idx;
5465         err = skb->len;
5466  out_err:
5467         rtnl_unlock();
5468         return err;
5469 }
5470
5471 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
5472 {
5473         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5474         struct net_device *dev = info->user_ptr[1];
5475         struct wireless_dev *wdev = dev->ieee80211_ptr;
5476         struct bss_parameters params;
5477         int err;
5478
5479         memset(&params, 0, sizeof(params));
5480         /* default to not changing parameters */
5481         params.use_cts_prot = -1;
5482         params.use_short_preamble = -1;
5483         params.use_short_slot_time = -1;
5484         params.ap_isolate = -1;
5485         params.ht_opmode = -1;
5486         params.p2p_ctwindow = -1;
5487         params.p2p_opp_ps = -1;
5488
5489         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
5490                 params.use_cts_prot =
5491                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
5492         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
5493                 params.use_short_preamble =
5494                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
5495         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
5496                 params.use_short_slot_time =
5497                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
5498         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
5499                 params.basic_rates =
5500                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5501                 params.basic_rates_len =
5502                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5503         }
5504         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
5505                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
5506         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
5507                 params.ht_opmode =
5508                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
5509
5510         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
5511                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5512                         return -EINVAL;
5513                 params.p2p_ctwindow =
5514                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
5515                 if (params.p2p_ctwindow < 0)
5516                         return -EINVAL;
5517                 if (params.p2p_ctwindow != 0 &&
5518                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
5519                         return -EINVAL;
5520         }
5521
5522         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
5523                 u8 tmp;
5524
5525                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5526                         return -EINVAL;
5527                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
5528                 if (tmp > 1)
5529                         return -EINVAL;
5530                 params.p2p_opp_ps = tmp;
5531                 if (params.p2p_opp_ps &&
5532                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
5533                         return -EINVAL;
5534         }
5535
5536         if (!rdev->ops->change_bss)
5537                 return -EOPNOTSUPP;
5538
5539         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5540             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5541                 return -EOPNOTSUPP;
5542
5543         wdev_lock(wdev);
5544         err = rdev_change_bss(rdev, dev, &params);
5545         wdev_unlock(wdev);
5546
5547         return err;
5548 }
5549
5550 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
5551 {
5552         char *data = NULL;
5553         bool is_indoor;
5554         enum nl80211_user_reg_hint_type user_reg_hint_type;
5555         u32 owner_nlportid;
5556
5557         /*
5558          * You should only get this when cfg80211 hasn't yet initialized
5559          * completely when built-in to the kernel right between the time
5560          * window between nl80211_init() and regulatory_init(), if that is
5561          * even possible.
5562          */
5563         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
5564                 return -EINPROGRESS;
5565
5566         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
5567                 user_reg_hint_type =
5568                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
5569         else
5570                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
5571
5572         switch (user_reg_hint_type) {
5573         case NL80211_USER_REG_HINT_USER:
5574         case NL80211_USER_REG_HINT_CELL_BASE:
5575                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5576                         return -EINVAL;
5577
5578                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5579                 return regulatory_hint_user(data, user_reg_hint_type);
5580         case NL80211_USER_REG_HINT_INDOOR:
5581                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
5582                         owner_nlportid = info->snd_portid;
5583                         is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
5584                 } else {
5585                         owner_nlportid = 0;
5586                         is_indoor = true;
5587                 }
5588
5589                 return regulatory_hint_indoor(is_indoor, owner_nlportid);
5590         default:
5591                 return -EINVAL;
5592         }
5593 }
5594
5595 static int nl80211_get_mesh_config(struct sk_buff *skb,
5596                                    struct genl_info *info)
5597 {
5598         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5599         struct net_device *dev = info->user_ptr[1];
5600         struct wireless_dev *wdev = dev->ieee80211_ptr;
5601         struct mesh_config cur_params;
5602         int err = 0;
5603         void *hdr;
5604         struct nlattr *pinfoattr;
5605         struct sk_buff *msg;
5606
5607         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5608                 return -EOPNOTSUPP;
5609
5610         if (!rdev->ops->get_mesh_config)
5611                 return -EOPNOTSUPP;
5612
5613         wdev_lock(wdev);
5614         /* If not connected, get default parameters */
5615         if (!wdev->mesh_id_len)
5616                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
5617         else
5618                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
5619         wdev_unlock(wdev);
5620
5621         if (err)
5622                 return err;
5623
5624         /* Draw up a netlink message to send back */
5625         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5626         if (!msg)
5627                 return -ENOMEM;
5628         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5629                              NL80211_CMD_GET_MESH_CONFIG);
5630         if (!hdr)
5631                 goto out;
5632         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
5633         if (!pinfoattr)
5634                 goto nla_put_failure;
5635         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5636             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
5637                         cur_params.dot11MeshRetryTimeout) ||
5638             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5639                         cur_params.dot11MeshConfirmTimeout) ||
5640             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
5641                         cur_params.dot11MeshHoldingTimeout) ||
5642             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
5643                         cur_params.dot11MeshMaxPeerLinks) ||
5644             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
5645                        cur_params.dot11MeshMaxRetries) ||
5646             nla_put_u8(msg, NL80211_MESHCONF_TTL,
5647                        cur_params.dot11MeshTTL) ||
5648             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
5649                        cur_params.element_ttl) ||
5650             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5651                        cur_params.auto_open_plinks) ||
5652             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5653                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
5654             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5655                        cur_params.dot11MeshHWMPmaxPREQretries) ||
5656             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
5657                         cur_params.path_refresh_time) ||
5658             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5659                         cur_params.min_discovery_timeout) ||
5660             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5661                         cur_params.dot11MeshHWMPactivePathTimeout) ||
5662             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5663                         cur_params.dot11MeshHWMPpreqMinInterval) ||
5664             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5665                         cur_params.dot11MeshHWMPperrMinInterval) ||
5666             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5667                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
5668             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
5669                        cur_params.dot11MeshHWMPRootMode) ||
5670             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5671                         cur_params.dot11MeshHWMPRannInterval) ||
5672             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5673                        cur_params.dot11MeshGateAnnouncementProtocol) ||
5674             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
5675                        cur_params.dot11MeshForwarding) ||
5676             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
5677                         cur_params.rssi_threshold) ||
5678             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
5679                         cur_params.ht_opmode) ||
5680             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5681                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
5682             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5683                         cur_params.dot11MeshHWMProotInterval) ||
5684             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5685                         cur_params.dot11MeshHWMPconfirmationInterval) ||
5686             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
5687                         cur_params.power_mode) ||
5688             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
5689                         cur_params.dot11MeshAwakeWindowDuration) ||
5690             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
5691                         cur_params.plink_timeout))
5692                 goto nla_put_failure;
5693         nla_nest_end(msg, pinfoattr);
5694         genlmsg_end(msg, hdr);
5695         return genlmsg_reply(msg, info);
5696
5697  nla_put_failure:
5698         genlmsg_cancel(msg, hdr);
5699  out:
5700         nlmsg_free(msg);
5701         return -ENOBUFS;
5702 }
5703
5704 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
5705         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
5706         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
5707         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
5708         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
5709         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
5710         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
5711         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
5712         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
5713         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
5714         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
5715         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
5716         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
5717         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
5718         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
5719         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
5720         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
5721         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
5722         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
5723         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
5724         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
5725         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
5726         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
5727         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
5728         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
5729         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
5730         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
5731         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
5732         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
5733 };
5734
5735 static const struct nla_policy
5736         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
5737         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
5738         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
5739         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
5740         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
5741         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
5742         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
5743         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
5744                                     .len = IEEE80211_MAX_DATA_LEN },
5745         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
5746 };
5747
5748 static int nl80211_check_bool(const struct nlattr *nla, u8 min, u8 max, bool *out)
5749 {
5750         u8 val = nla_get_u8(nla);
5751         if (val < min || val > max)
5752                 return -EINVAL;
5753         *out = val;
5754         return 0;
5755 }
5756
5757 static int nl80211_check_u8(const struct nlattr *nla, u8 min, u8 max, u8 *out)
5758 {
5759         u8 val = nla_get_u8(nla);
5760         if (val < min || val > max)
5761                 return -EINVAL;
5762         *out = val;
5763         return 0;
5764 }
5765
5766 static int nl80211_check_u16(const struct nlattr *nla, u16 min, u16 max, u16 *out)
5767 {
5768         u16 val = nla_get_u16(nla);
5769         if (val < min || val > max)
5770                 return -EINVAL;
5771         *out = val;
5772         return 0;
5773 }
5774
5775 static int nl80211_check_u32(const struct nlattr *nla, u32 min, u32 max, u32 *out)
5776 {
5777         u32 val = nla_get_u32(nla);
5778         if (val < min || val > max)
5779                 return -EINVAL;
5780         *out = val;
5781         return 0;
5782 }
5783
5784 static int nl80211_check_s32(const struct nlattr *nla, s32 min, s32 max, s32 *out)
5785 {
5786         s32 val = nla_get_s32(nla);
5787         if (val < min || val > max)
5788                 return -EINVAL;
5789         *out = val;
5790         return 0;
5791 }
5792
5793 static int nl80211_check_power_mode(const struct nlattr *nla,
5794                                     enum nl80211_mesh_power_mode min,
5795                                     enum nl80211_mesh_power_mode max,
5796                                     enum nl80211_mesh_power_mode *out)
5797 {
5798         u32 val = nla_get_u32(nla);
5799         if (val < min || val > max)
5800                 return -EINVAL;
5801         *out = val;
5802         return 0;
5803 }
5804
5805 static int nl80211_parse_mesh_config(struct genl_info *info,
5806                                      struct mesh_config *cfg,
5807                                      u32 *mask_out)
5808 {
5809         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
5810         u32 mask = 0;
5811         u16 ht_opmode;
5812
5813 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
5814 do {                                                                        \
5815         if (tb[attr]) {                                                     \
5816                 if (fn(tb[attr], min, max, &cfg->param))                    \
5817                         return -EINVAL;                                     \
5818                 mask |= (1 << (attr - 1));                                  \
5819         }                                                                   \
5820 } while (0)
5821
5822         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
5823                 return -EINVAL;
5824         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
5825                              info->attrs[NL80211_ATTR_MESH_CONFIG],
5826                              nl80211_meshconf_params_policy))
5827                 return -EINVAL;
5828
5829         /* This makes sure that there aren't more than 32 mesh config
5830          * parameters (otherwise our bitfield scheme would not work.) */
5831         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
5832
5833         /* Fill in the params struct */
5834         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
5835                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
5836                                   nl80211_check_u16);
5837         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
5838                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5839                                   nl80211_check_u16);
5840         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
5841                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
5842                                   nl80211_check_u16);
5843         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
5844                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
5845                                   nl80211_check_u16);
5846         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
5847                                   mask, NL80211_MESHCONF_MAX_RETRIES,
5848                                   nl80211_check_u8);
5849         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
5850                                   mask, NL80211_MESHCONF_TTL, nl80211_check_u8);
5851         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
5852                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
5853                                   nl80211_check_u8);
5854         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
5855                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5856                                   nl80211_check_bool);
5857         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
5858                                   1, 255, mask,
5859                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5860                                   nl80211_check_u32);
5861         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
5862                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5863                                   nl80211_check_u8);
5864         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
5865                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
5866                                   nl80211_check_u32);
5867         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
5868                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5869                                   nl80211_check_u16);
5870         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
5871                                   1, 65535, mask,
5872                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5873                                   nl80211_check_u32);
5874         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
5875                                   1, 65535, mask,
5876                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5877                                   nl80211_check_u16);
5878         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
5879                                   1, 65535, mask,
5880                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5881                                   nl80211_check_u16);
5882         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5883                                   dot11MeshHWMPnetDiameterTraversalTime,
5884                                   1, 65535, mask,
5885                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5886                                   nl80211_check_u16);
5887         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
5888                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
5889                                   nl80211_check_u8);
5890         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
5891                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5892                                   nl80211_check_u16);
5893         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5894                                   dot11MeshGateAnnouncementProtocol, 0, 1,
5895                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5896                                   nl80211_check_bool);
5897         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
5898                                   mask, NL80211_MESHCONF_FORWARDING,
5899                                   nl80211_check_bool);
5900         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
5901                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
5902                                   nl80211_check_s32);
5903         /*
5904          * Check HT operation mode based on
5905          * IEEE 802.11-2016 9.4.2.57 HT Operation element.
5906          */
5907         if (tb[NL80211_MESHCONF_HT_OPMODE]) {
5908                 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
5909
5910                 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
5911                                   IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
5912                                   IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
5913                         return -EINVAL;
5914
5915                 /* NON_HT_STA bit is reserved, but some programs set it */
5916                 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
5917
5918                 cfg->ht_opmode = ht_opmode;
5919                 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
5920         }
5921         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
5922                                   1, 65535, mask,
5923                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5924                                   nl80211_check_u32);
5925         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
5926                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5927                                   nl80211_check_u16);
5928         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5929                                   dot11MeshHWMPconfirmationInterval,
5930                                   1, 65535, mask,
5931                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5932                                   nl80211_check_u16);
5933         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
5934                                   NL80211_MESH_POWER_ACTIVE,
5935                                   NL80211_MESH_POWER_MAX,
5936                                   mask, NL80211_MESHCONF_POWER_MODE,
5937                                   nl80211_check_power_mode);
5938         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
5939                                   0, 65535, mask,
5940                                   NL80211_MESHCONF_AWAKE_WINDOW, nl80211_check_u16);
5941         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 0, 0xffffffff,
5942                                   mask, NL80211_MESHCONF_PLINK_TIMEOUT,
5943                                   nl80211_check_u32);
5944         if (mask_out)
5945                 *mask_out = mask;
5946
5947         return 0;
5948
5949 #undef FILL_IN_MESH_PARAM_IF_SET
5950 }
5951
5952 static int nl80211_parse_mesh_setup(struct genl_info *info,
5953                                      struct mesh_setup *setup)
5954 {
5955         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5956         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
5957
5958         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
5959                 return -EINVAL;
5960         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
5961                              info->attrs[NL80211_ATTR_MESH_SETUP],
5962                              nl80211_mesh_setup_params_policy))
5963                 return -EINVAL;
5964
5965         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
5966                 setup->sync_method =
5967                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
5968                  IEEE80211_SYNC_METHOD_VENDOR :
5969                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
5970
5971         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
5972                 setup->path_sel_proto =
5973                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
5974                  IEEE80211_PATH_PROTOCOL_VENDOR :
5975                  IEEE80211_PATH_PROTOCOL_HWMP;
5976
5977         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
5978                 setup->path_metric =
5979                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
5980                  IEEE80211_PATH_METRIC_VENDOR :
5981                  IEEE80211_PATH_METRIC_AIRTIME;
5982
5983         if (tb[NL80211_MESH_SETUP_IE]) {
5984                 struct nlattr *ieattr =
5985                         tb[NL80211_MESH_SETUP_IE];
5986                 if (!is_valid_ie_attr(ieattr))
5987                         return -EINVAL;
5988                 setup->ie = nla_data(ieattr);
5989                 setup->ie_len = nla_len(ieattr);
5990         }
5991         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
5992             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
5993                 return -EINVAL;
5994         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
5995         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
5996         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
5997         if (setup->is_secure)
5998                 setup->user_mpm = true;
5999
6000         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
6001                 if (!setup->user_mpm)
6002                         return -EINVAL;
6003                 setup->auth_id =
6004                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
6005         }
6006
6007         return 0;
6008 }
6009
6010 static int nl80211_update_mesh_config(struct sk_buff *skb,
6011                                       struct genl_info *info)
6012 {
6013         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6014         struct net_device *dev = info->user_ptr[1];
6015         struct wireless_dev *wdev = dev->ieee80211_ptr;
6016         struct mesh_config cfg;
6017         u32 mask;
6018         int err;
6019
6020         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
6021                 return -EOPNOTSUPP;
6022
6023         if (!rdev->ops->update_mesh_config)
6024                 return -EOPNOTSUPP;
6025
6026         err = nl80211_parse_mesh_config(info, &cfg, &mask);
6027         if (err)
6028                 return err;
6029
6030         wdev_lock(wdev);
6031         if (!wdev->mesh_id_len)
6032                 err = -ENOLINK;
6033
6034         if (!err)
6035                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
6036
6037         wdev_unlock(wdev);
6038
6039         return err;
6040 }
6041
6042 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
6043                               struct sk_buff *msg)
6044 {
6045         struct nlattr *nl_reg_rules;
6046         unsigned int i;
6047
6048         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
6049             (regdom->dfs_region &&
6050              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
6051                 goto nla_put_failure;
6052
6053         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
6054         if (!nl_reg_rules)
6055                 goto nla_put_failure;
6056
6057         for (i = 0; i < regdom->n_reg_rules; i++) {
6058                 struct nlattr *nl_reg_rule;
6059                 const struct ieee80211_reg_rule *reg_rule;
6060                 const struct ieee80211_freq_range *freq_range;
6061                 const struct ieee80211_power_rule *power_rule;
6062                 unsigned int max_bandwidth_khz;
6063
6064                 reg_rule = &regdom->reg_rules[i];
6065                 freq_range = &reg_rule->freq_range;
6066                 power_rule = &reg_rule->power_rule;
6067
6068                 nl_reg_rule = nla_nest_start(msg, i);
6069                 if (!nl_reg_rule)
6070                         goto nla_put_failure;
6071
6072                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
6073                 if (!max_bandwidth_khz)
6074                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
6075                                                                   reg_rule);
6076
6077                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
6078                                 reg_rule->flags) ||
6079                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
6080                                 freq_range->start_freq_khz) ||
6081                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
6082                                 freq_range->end_freq_khz) ||
6083                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
6084                                 max_bandwidth_khz) ||
6085                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
6086                                 power_rule->max_antenna_gain) ||
6087                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
6088                                 power_rule->max_eirp) ||
6089                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
6090                                 reg_rule->dfs_cac_ms))
6091                         goto nla_put_failure;
6092
6093                 nla_nest_end(msg, nl_reg_rule);
6094         }
6095
6096         nla_nest_end(msg, nl_reg_rules);
6097         return 0;
6098
6099 nla_put_failure:
6100         return -EMSGSIZE;
6101 }
6102
6103 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
6104 {
6105         const struct ieee80211_regdomain *regdom = NULL;
6106         struct cfg80211_registered_device *rdev;
6107         struct wiphy *wiphy = NULL;
6108         struct sk_buff *msg;
6109         void *hdr;
6110
6111         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6112         if (!msg)
6113                 return -ENOBUFS;
6114
6115         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6116                              NL80211_CMD_GET_REG);
6117         if (!hdr)
6118                 goto put_failure;
6119
6120         if (info->attrs[NL80211_ATTR_WIPHY]) {
6121                 bool self_managed;
6122
6123                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
6124                 if (IS_ERR(rdev)) {
6125                         nlmsg_free(msg);
6126                         return PTR_ERR(rdev);
6127                 }
6128
6129                 wiphy = &rdev->wiphy;
6130                 self_managed = wiphy->regulatory_flags &
6131                                REGULATORY_WIPHY_SELF_MANAGED;
6132                 regdom = get_wiphy_regdom(wiphy);
6133
6134                 /* a self-managed-reg device must have a private regdom */
6135                 if (WARN_ON(!regdom && self_managed)) {
6136                         nlmsg_free(msg);
6137                         return -EINVAL;
6138                 }
6139
6140                 if (regdom &&
6141                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6142                         goto nla_put_failure;
6143         }
6144
6145         if (!wiphy && reg_last_request_cell_base() &&
6146             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6147                         NL80211_USER_REG_HINT_CELL_BASE))
6148                 goto nla_put_failure;
6149
6150         rcu_read_lock();
6151
6152         if (!regdom)
6153                 regdom = rcu_dereference(cfg80211_regdomain);
6154
6155         if (nl80211_put_regdom(regdom, msg))
6156                 goto nla_put_failure_rcu;
6157
6158         rcu_read_unlock();
6159
6160         genlmsg_end(msg, hdr);
6161         return genlmsg_reply(msg, info);
6162
6163 nla_put_failure_rcu:
6164         rcu_read_unlock();
6165 nla_put_failure:
6166         genlmsg_cancel(msg, hdr);
6167 put_failure:
6168         nlmsg_free(msg);
6169         return -EMSGSIZE;
6170 }
6171
6172 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
6173                                u32 seq, int flags, struct wiphy *wiphy,
6174                                const struct ieee80211_regdomain *regdom)
6175 {
6176         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6177                                    NL80211_CMD_GET_REG);
6178
6179         if (!hdr)
6180                 return -1;
6181
6182         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
6183
6184         if (nl80211_put_regdom(regdom, msg))
6185                 goto nla_put_failure;
6186
6187         if (!wiphy && reg_last_request_cell_base() &&
6188             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6189                         NL80211_USER_REG_HINT_CELL_BASE))
6190                 goto nla_put_failure;
6191
6192         if (wiphy &&
6193             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6194                 goto nla_put_failure;
6195
6196         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
6197             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
6198                 goto nla_put_failure;
6199
6200         genlmsg_end(msg, hdr);
6201         return 0;
6202
6203 nla_put_failure:
6204         genlmsg_cancel(msg, hdr);
6205         return -EMSGSIZE;
6206 }
6207
6208 static int nl80211_get_reg_dump(struct sk_buff *skb,
6209                                 struct netlink_callback *cb)
6210 {
6211         const struct ieee80211_regdomain *regdom = NULL;
6212         struct cfg80211_registered_device *rdev;
6213         int err, reg_idx, start = cb->args[2];
6214
6215         rtnl_lock();
6216
6217         if (cfg80211_regdomain && start == 0) {
6218                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6219                                           NLM_F_MULTI, NULL,
6220                                           rtnl_dereference(cfg80211_regdomain));
6221                 if (err < 0)
6222                         goto out_err;
6223         }
6224
6225         /* the global regdom is idx 0 */
6226         reg_idx = 1;
6227         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
6228                 regdom = get_wiphy_regdom(&rdev->wiphy);
6229                 if (!regdom)
6230                         continue;
6231
6232                 if (++reg_idx <= start)
6233                         continue;
6234
6235                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6236                                           NLM_F_MULTI, &rdev->wiphy, regdom);
6237                 if (err < 0) {
6238                         reg_idx--;
6239                         break;
6240                 }
6241         }
6242
6243         cb->args[2] = reg_idx;
6244         err = skb->len;
6245 out_err:
6246         rtnl_unlock();
6247         return err;
6248 }
6249
6250 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
6251 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
6252         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
6253         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
6254         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
6255         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
6256         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
6257         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
6258         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
6259 };
6260
6261 static int parse_reg_rule(struct nlattr *tb[],
6262         struct ieee80211_reg_rule *reg_rule)
6263 {
6264         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
6265         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
6266
6267         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
6268                 return -EINVAL;
6269         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
6270                 return -EINVAL;
6271         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
6272                 return -EINVAL;
6273         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
6274                 return -EINVAL;
6275         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
6276                 return -EINVAL;
6277
6278         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
6279
6280         freq_range->start_freq_khz =
6281                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
6282         freq_range->end_freq_khz =
6283                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
6284         freq_range->max_bandwidth_khz =
6285                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
6286
6287         power_rule->max_eirp =
6288                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
6289
6290         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
6291                 power_rule->max_antenna_gain =
6292                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
6293
6294         if (tb[NL80211_ATTR_DFS_CAC_TIME])
6295                 reg_rule->dfs_cac_ms =
6296                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
6297
6298         return 0;
6299 }
6300
6301 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
6302 {
6303         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
6304         struct nlattr *nl_reg_rule;
6305         char *alpha2;
6306         int rem_reg_rules, r;
6307         u32 num_rules = 0, rule_idx = 0, size_of_regd;
6308         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
6309         struct ieee80211_regdomain *rd;
6310
6311         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
6312                 return -EINVAL;
6313
6314         if (!info->attrs[NL80211_ATTR_REG_RULES])
6315                 return -EINVAL;
6316
6317         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
6318
6319         if (info->attrs[NL80211_ATTR_DFS_REGION])
6320                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
6321
6322         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6323                             rem_reg_rules) {
6324                 num_rules++;
6325                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
6326                         return -EINVAL;
6327         }
6328
6329         if (!reg_is_valid_request(alpha2))
6330                 return -EINVAL;
6331
6332         size_of_regd = sizeof(struct ieee80211_regdomain) +
6333                        num_rules * sizeof(struct ieee80211_reg_rule);
6334
6335         rd = kzalloc(size_of_regd, GFP_KERNEL);
6336         if (!rd)
6337                 return -ENOMEM;
6338
6339         rd->n_reg_rules = num_rules;
6340         rd->alpha2[0] = alpha2[0];
6341         rd->alpha2[1] = alpha2[1];
6342
6343         /*
6344          * Disable DFS master mode if the DFS region was
6345          * not supported or known on this kernel.
6346          */
6347         if (reg_supported_dfs_region(dfs_region))
6348                 rd->dfs_region = dfs_region;
6349
6350         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6351                             rem_reg_rules) {
6352                 r = nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
6353                               nla_data(nl_reg_rule), nla_len(nl_reg_rule),
6354                               reg_rule_policy);
6355                 if (r)
6356                         goto bad_reg;
6357                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
6358                 if (r)
6359                         goto bad_reg;
6360
6361                 rule_idx++;
6362
6363                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
6364                         r = -EINVAL;
6365                         goto bad_reg;
6366                 }
6367         }
6368
6369         /* set_regdom takes ownership of rd */
6370         return set_regdom(rd, REGD_SOURCE_CRDA);
6371  bad_reg:
6372         kfree(rd);
6373         return r;
6374 }
6375 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
6376
6377 static int validate_scan_freqs(struct nlattr *freqs)
6378 {
6379         struct nlattr *attr1, *attr2;
6380         int n_channels = 0, tmp1, tmp2;
6381
6382         nla_for_each_nested(attr1, freqs, tmp1)
6383                 if (nla_len(attr1) != sizeof(u32))
6384                         return 0;
6385
6386         nla_for_each_nested(attr1, freqs, tmp1) {
6387                 n_channels++;
6388                 /*
6389                  * Some hardware has a limited channel list for
6390                  * scanning, and it is pretty much nonsensical
6391                  * to scan for a channel twice, so disallow that
6392                  * and don't require drivers to check that the
6393                  * channel list they get isn't longer than what
6394                  * they can scan, as long as they can scan all
6395                  * the channels they registered at once.
6396                  */
6397                 nla_for_each_nested(attr2, freqs, tmp2)
6398                         if (attr1 != attr2 &&
6399                             nla_get_u32(attr1) == nla_get_u32(attr2))
6400                                 return 0;
6401         }
6402
6403         return n_channels;
6404 }
6405
6406 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
6407 {
6408         return b < NUM_NL80211_BANDS && wiphy->bands[b];
6409 }
6410
6411 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
6412                             struct cfg80211_bss_selection *bss_select)
6413 {
6414         struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
6415         struct nlattr *nest;
6416         int err;
6417         bool found = false;
6418         int i;
6419
6420         /* only process one nested attribute */
6421         nest = nla_data(nla);
6422         if (!nla_ok(nest, nla_len(nest)))
6423                 return -EINVAL;
6424
6425         err = nla_parse(attr, NL80211_BSS_SELECT_ATTR_MAX, nla_data(nest),
6426                         nla_len(nest), nl80211_bss_select_policy);
6427         if (err)
6428                 return err;
6429
6430         /* only one attribute may be given */
6431         for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
6432                 if (attr[i]) {
6433                         if (found)
6434                                 return -EINVAL;
6435                         found = true;
6436                 }
6437         }
6438
6439         bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
6440
6441         if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
6442                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
6443
6444         if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
6445                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
6446                 bss_select->param.band_pref =
6447                         nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
6448                 if (!is_band_valid(wiphy, bss_select->param.band_pref))
6449                         return -EINVAL;
6450         }
6451
6452         if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
6453                 struct nl80211_bss_select_rssi_adjust *adj_param;
6454
6455                 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
6456                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
6457                 bss_select->param.adjust.band = adj_param->band;
6458                 bss_select->param.adjust.delta = adj_param->delta;
6459                 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
6460                         return -EINVAL;
6461         }
6462
6463         /* user-space did not provide behaviour attribute */
6464         if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
6465                 return -EINVAL;
6466
6467         if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
6468                 return -EINVAL;
6469
6470         return 0;
6471 }
6472
6473 static int nl80211_parse_random_mac(struct nlattr **attrs,
6474                                     u8 *mac_addr, u8 *mac_addr_mask)
6475 {
6476         int i;
6477
6478         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
6479                 eth_zero_addr(mac_addr);
6480                 eth_zero_addr(mac_addr_mask);
6481                 mac_addr[0] = 0x2;
6482                 mac_addr_mask[0] = 0x3;
6483
6484                 return 0;
6485         }
6486
6487         /* need both or none */
6488         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
6489                 return -EINVAL;
6490
6491         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
6492         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
6493
6494         /* don't allow or configure an mcast address */
6495         if (!is_multicast_ether_addr(mac_addr_mask) ||
6496             is_multicast_ether_addr(mac_addr))
6497                 return -EINVAL;
6498
6499         /*
6500          * allow users to pass a MAC address that has bits set outside
6501          * of the mask, but don't bother drivers with having to deal
6502          * with such bits
6503          */
6504         for (i = 0; i < ETH_ALEN; i++)
6505                 mac_addr[i] &= mac_addr_mask[i];
6506
6507         return 0;
6508 }
6509
6510 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
6511 {
6512         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6513         struct wireless_dev *wdev = info->user_ptr[1];
6514         struct cfg80211_scan_request *request;
6515         struct nlattr *attr;
6516         struct wiphy *wiphy;
6517         int err, tmp, n_ssids = 0, n_channels, i;
6518         size_t ie_len;
6519
6520         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6521                 return -EINVAL;
6522
6523         wiphy = &rdev->wiphy;
6524
6525         if (wdev->iftype == NL80211_IFTYPE_NAN)
6526                 return -EOPNOTSUPP;
6527
6528         if (!rdev->ops->scan)
6529                 return -EOPNOTSUPP;
6530
6531         if (rdev->scan_req || rdev->scan_msg) {
6532                 err = -EBUSY;
6533                 goto unlock;
6534         }
6535
6536         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6537                 n_channels = validate_scan_freqs(
6538                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
6539                 if (!n_channels) {
6540                         err = -EINVAL;
6541                         goto unlock;
6542                 }
6543         } else {
6544                 n_channels = ieee80211_get_num_supported_channels(wiphy);
6545         }
6546
6547         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
6548                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
6549                         n_ssids++;
6550
6551         if (n_ssids > wiphy->max_scan_ssids) {
6552                 err = -EINVAL;
6553                 goto unlock;
6554         }
6555
6556         if (info->attrs[NL80211_ATTR_IE])
6557                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6558         else
6559                 ie_len = 0;
6560
6561         if (ie_len > wiphy->max_scan_ie_len) {
6562                 err = -EINVAL;
6563                 goto unlock;
6564         }
6565
6566         request = kzalloc(sizeof(*request)
6567                         + sizeof(*request->ssids) * n_ssids
6568                         + sizeof(*request->channels) * n_channels
6569                         + ie_len, GFP_KERNEL);
6570         if (!request) {
6571                 err = -ENOMEM;
6572                 goto unlock;
6573         }
6574
6575         if (n_ssids)
6576                 request->ssids = (void *)&request->channels[n_channels];
6577         request->n_ssids = n_ssids;
6578         if (ie_len) {
6579                 if (n_ssids)
6580                         request->ie = (void *)(request->ssids + n_ssids);
6581                 else
6582                         request->ie = (void *)(request->channels + n_channels);
6583         }
6584
6585         i = 0;
6586         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6587                 /* user specified, bail out if channel not found */
6588                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
6589                         struct ieee80211_channel *chan;
6590
6591                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
6592
6593                         if (!chan) {
6594                                 err = -EINVAL;
6595                                 goto out_free;
6596                         }
6597
6598                         /* ignore disabled channels */
6599                         if (chan->flags & IEEE80211_CHAN_DISABLED)
6600                                 continue;
6601
6602                         request->channels[i] = chan;
6603                         i++;
6604                 }
6605         } else {
6606                 enum nl80211_band band;
6607
6608                 /* all channels */
6609                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
6610                         int j;
6611
6612                         if (!wiphy->bands[band])
6613                                 continue;
6614                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
6615                                 struct ieee80211_channel *chan;
6616
6617                                 chan = &wiphy->bands[band]->channels[j];
6618
6619                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
6620                                         continue;
6621
6622                                 request->channels[i] = chan;
6623                                 i++;
6624                         }
6625                 }
6626         }
6627
6628         if (!i) {
6629                 err = -EINVAL;
6630                 goto out_free;
6631         }
6632
6633         request->n_channels = i;
6634
6635         i = 0;
6636         if (n_ssids) {
6637                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
6638                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
6639                                 err = -EINVAL;
6640                                 goto out_free;
6641                         }
6642                         request->ssids[i].ssid_len = nla_len(attr);
6643                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
6644                         i++;
6645                 }
6646         }
6647
6648         if (info->attrs[NL80211_ATTR_IE]) {
6649                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6650                 memcpy((void *)request->ie,
6651                        nla_data(info->attrs[NL80211_ATTR_IE]),
6652                        request->ie_len);
6653         }
6654
6655         for (i = 0; i < NUM_NL80211_BANDS; i++)
6656                 if (wiphy->bands[i])
6657                         request->rates[i] =
6658                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
6659
6660         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
6661                 nla_for_each_nested(attr,
6662                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
6663                                     tmp) {
6664                         enum nl80211_band band = nla_type(attr);
6665
6666                         if (band < 0 || band >= NUM_NL80211_BANDS) {
6667                                 err = -EINVAL;
6668                                 goto out_free;
6669                         }
6670
6671                         if (!wiphy->bands[band])
6672                                 continue;
6673
6674                         err = ieee80211_get_ratemask(wiphy->bands[band],
6675                                                      nla_data(attr),
6676                                                      nla_len(attr),
6677                                                      &request->rates[band]);
6678                         if (err)
6679                                 goto out_free;
6680                 }
6681         }
6682
6683         if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
6684                 if (!wiphy_ext_feature_isset(wiphy,
6685                                         NL80211_EXT_FEATURE_SET_SCAN_DWELL)) {
6686                         err = -EOPNOTSUPP;
6687                         goto out_free;
6688                 }
6689
6690                 request->duration =
6691                         nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
6692                 request->duration_mandatory =
6693                         nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
6694         }
6695
6696         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
6697                 request->flags = nla_get_u32(
6698                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
6699                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
6700                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
6701                         err = -EOPNOTSUPP;
6702                         goto out_free;
6703                 }
6704
6705                 if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
6706                         if (!(wiphy->features &
6707                                         NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR)) {
6708                                 err = -EOPNOTSUPP;
6709                                 goto out_free;
6710                         }
6711
6712                         if (wdev->current_bss) {
6713                                 err = -EOPNOTSUPP;
6714                                 goto out_free;
6715                         }
6716
6717                         err = nl80211_parse_random_mac(info->attrs,
6718                                                        request->mac_addr,
6719                                                        request->mac_addr_mask);
6720                         if (err)
6721                                 goto out_free;
6722                 }
6723         }
6724
6725         request->no_cck =
6726                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
6727
6728         /* Initial implementation used NL80211_ATTR_MAC to set the specific
6729          * BSSID to scan for. This was problematic because that same attribute
6730          * was already used for another purpose (local random MAC address). The
6731          * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
6732          * compatibility with older userspace components, also use the
6733          * NL80211_ATTR_MAC value here if it can be determined to be used for
6734          * the specific BSSID use case instead of the random MAC address
6735          * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
6736          */
6737         if (info->attrs[NL80211_ATTR_BSSID])
6738                 memcpy(request->bssid,
6739                        nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
6740         else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
6741                  info->attrs[NL80211_ATTR_MAC])
6742                 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
6743                        ETH_ALEN);
6744         else
6745                 eth_broadcast_addr(request->bssid);
6746
6747         request->wdev = wdev;
6748         request->wiphy = &rdev->wiphy;
6749         request->scan_start = jiffies;
6750
6751         rdev->scan_req = request;
6752         err = rdev_scan(rdev, request);
6753
6754         if (!err) {
6755                 nl80211_send_scan_start(rdev, wdev);
6756                 if (wdev->netdev)
6757                         dev_hold(wdev->netdev);
6758         } else {
6759  out_free:
6760                 rdev->scan_req = NULL;
6761                 kfree(request);
6762         }
6763
6764  unlock:
6765         return err;
6766 }
6767
6768 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
6769 {
6770         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6771         struct wireless_dev *wdev = info->user_ptr[1];
6772
6773         if (!rdev->ops->abort_scan)
6774                 return -EOPNOTSUPP;
6775
6776         if (rdev->scan_msg)
6777                 return 0;
6778
6779         if (!rdev->scan_req)
6780                 return -ENOENT;
6781
6782         rdev_abort_scan(rdev, wdev);
6783         return 0;
6784 }
6785
6786 static int
6787 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
6788                                struct cfg80211_sched_scan_request *request,
6789                                struct nlattr **attrs)
6790 {
6791         int tmp, err, i = 0;
6792         struct nlattr *attr;
6793
6794         if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
6795                 u32 interval;
6796
6797                 /*
6798                  * If scan plans are not specified,
6799                  * %NL80211_ATTR_SCHED_SCAN_INTERVAL must be specified. In this
6800                  * case one scan plan will be set with the specified scan
6801                  * interval and infinite number of iterations.
6802                  */
6803                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
6804                         return -EINVAL;
6805
6806                 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
6807                 if (!interval)
6808                         return -EINVAL;
6809
6810                 request->scan_plans[0].interval =
6811                         DIV_ROUND_UP(interval, MSEC_PER_SEC);
6812                 if (!request->scan_plans[0].interval)
6813                         return -EINVAL;
6814
6815                 if (request->scan_plans[0].interval >
6816                     wiphy->max_sched_scan_plan_interval)
6817                         request->scan_plans[0].interval =
6818                                 wiphy->max_sched_scan_plan_interval;
6819
6820                 return 0;
6821         }
6822
6823         nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
6824                 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
6825
6826                 if (WARN_ON(i >= n_plans))
6827                         return -EINVAL;
6828
6829                 err = nla_parse(plan, NL80211_SCHED_SCAN_PLAN_MAX,
6830                                 nla_data(attr), nla_len(attr),
6831                                 nl80211_plan_policy);
6832                 if (err)
6833                         return err;
6834
6835                 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
6836                         return -EINVAL;
6837
6838                 request->scan_plans[i].interval =
6839                         nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
6840                 if (!request->scan_plans[i].interval ||
6841                     request->scan_plans[i].interval >
6842                     wiphy->max_sched_scan_plan_interval)
6843                         return -EINVAL;
6844
6845                 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
6846                         request->scan_plans[i].iterations =
6847                                 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
6848                         if (!request->scan_plans[i].iterations ||
6849                             (request->scan_plans[i].iterations >
6850                              wiphy->max_sched_scan_plan_iterations))
6851                                 return -EINVAL;
6852                 } else if (i < n_plans - 1) {
6853                         /*
6854                          * All scan plans but the last one must specify
6855                          * a finite number of iterations
6856                          */
6857                         return -EINVAL;
6858                 }
6859
6860                 i++;
6861         }
6862
6863         /*
6864          * The last scan plan must not specify the number of
6865          * iterations, it is supposed to run infinitely
6866          */
6867         if (request->scan_plans[n_plans - 1].iterations)
6868                 return  -EINVAL;
6869
6870         return 0;
6871 }
6872
6873 static struct cfg80211_sched_scan_request *
6874 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
6875                          struct nlattr **attrs)
6876 {
6877         struct cfg80211_sched_scan_request *request;
6878         struct nlattr *attr;
6879         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
6880         enum nl80211_band band;
6881         size_t ie_len;
6882         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
6883         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
6884
6885         if (!is_valid_ie_attr(attrs[NL80211_ATTR_IE]))
6886                 return ERR_PTR(-EINVAL);
6887
6888         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6889                 n_channels = validate_scan_freqs(
6890                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
6891                 if (!n_channels)
6892                         return ERR_PTR(-EINVAL);
6893         } else {
6894                 n_channels = ieee80211_get_num_supported_channels(wiphy);
6895         }
6896
6897         if (attrs[NL80211_ATTR_SCAN_SSIDS])
6898                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
6899                                     tmp)
6900                         n_ssids++;
6901
6902         if (n_ssids > wiphy->max_sched_scan_ssids)
6903                 return ERR_PTR(-EINVAL);
6904
6905         /*
6906          * First, count the number of 'real' matchsets. Due to an issue with
6907          * the old implementation, matchsets containing only the RSSI attribute
6908          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
6909          * RSSI for all matchsets, rather than their own matchset for reporting
6910          * all APs with a strong RSSI. This is needed to be compatible with
6911          * older userspace that treated a matchset with only the RSSI as the
6912          * global RSSI for all other matchsets - if there are other matchsets.
6913          */
6914         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
6915                 nla_for_each_nested(attr,
6916                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
6917                                     tmp) {
6918                         struct nlattr *rssi;
6919
6920                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
6921                                         nla_data(attr), nla_len(attr),
6922                                         nl80211_match_policy);
6923                         if (err)
6924                                 return ERR_PTR(err);
6925                         /* add other standalone attributes here */
6926                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]) {
6927                                 n_match_sets++;
6928                                 continue;
6929                         }
6930                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
6931                         if (rssi)
6932                                 default_match_rssi = nla_get_s32(rssi);
6933                 }
6934         }
6935
6936         /* However, if there's no other matchset, add the RSSI one */
6937         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
6938                 n_match_sets = 1;
6939
6940         if (n_match_sets > wiphy->max_match_sets)
6941                 return ERR_PTR(-EINVAL);
6942
6943         if (attrs[NL80211_ATTR_IE])
6944                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
6945         else
6946                 ie_len = 0;
6947
6948         if (ie_len > wiphy->max_sched_scan_ie_len)
6949                 return ERR_PTR(-EINVAL);
6950
6951         if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
6952                 /*
6953                  * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
6954                  * each scan plan already specifies its own interval
6955                  */
6956                 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
6957                         return ERR_PTR(-EINVAL);
6958
6959                 nla_for_each_nested(attr,
6960                                     attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
6961                         n_plans++;
6962         } else {
6963                 /*
6964                  * The scan interval attribute is kept for backward
6965                  * compatibility. If no scan plans are specified and sched scan
6966                  * interval is specified, one scan plan will be set with this
6967                  * scan interval and infinite number of iterations.
6968                  */
6969                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
6970                         return ERR_PTR(-EINVAL);
6971
6972                 n_plans = 1;
6973         }
6974
6975         if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
6976                 return ERR_PTR(-EINVAL);
6977
6978         request = kzalloc(sizeof(*request)
6979                         + sizeof(*request->ssids) * n_ssids
6980                         + sizeof(*request->match_sets) * n_match_sets
6981                         + sizeof(*request->scan_plans) * n_plans
6982                         + sizeof(*request->channels) * n_channels
6983                         + ie_len, GFP_KERNEL);
6984         if (!request)
6985                 return ERR_PTR(-ENOMEM);
6986
6987         if (n_ssids)
6988                 request->ssids = (void *)&request->channels[n_channels];
6989         request->n_ssids = n_ssids;
6990         if (ie_len) {
6991                 if (n_ssids)
6992                         request->ie = (void *)(request->ssids + n_ssids);
6993                 else
6994                         request->ie = (void *)(request->channels + n_channels);
6995         }
6996
6997         if (n_match_sets) {
6998                 if (request->ie)
6999                         request->match_sets = (void *)(request->ie + ie_len);
7000                 else if (n_ssids)
7001                         request->match_sets =
7002                                 (void *)(request->ssids + n_ssids);
7003                 else
7004                         request->match_sets =
7005                                 (void *)(request->channels + n_channels);
7006         }
7007         request->n_match_sets = n_match_sets;
7008
7009         if (n_match_sets)
7010                 request->scan_plans = (void *)(request->match_sets +
7011                                                n_match_sets);
7012         else if (request->ie)
7013                 request->scan_plans = (void *)(request->ie + ie_len);
7014         else if (n_ssids)
7015                 request->scan_plans = (void *)(request->ssids + n_ssids);
7016         else
7017                 request->scan_plans = (void *)(request->channels + n_channels);
7018
7019         request->n_scan_plans = n_plans;
7020
7021         i = 0;
7022         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7023                 /* user specified, bail out if channel not found */
7024                 nla_for_each_nested(attr,
7025                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
7026                                     tmp) {
7027                         struct ieee80211_channel *chan;
7028
7029                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
7030
7031                         if (!chan) {
7032                                 err = -EINVAL;
7033                                 goto out_free;
7034                         }
7035
7036                         /* ignore disabled channels */
7037                         if (chan->flags & IEEE80211_CHAN_DISABLED)
7038                                 continue;
7039
7040                         request->channels[i] = chan;
7041                         i++;
7042                 }
7043         } else {
7044                 /* all channels */
7045                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
7046                         int j;
7047
7048                         if (!wiphy->bands[band])
7049                                 continue;
7050                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
7051                                 struct ieee80211_channel *chan;
7052
7053                                 chan = &wiphy->bands[band]->channels[j];
7054
7055                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
7056                                         continue;
7057
7058                                 request->channels[i] = chan;
7059                                 i++;
7060                         }
7061                 }
7062         }
7063
7064         if (!i) {
7065                 err = -EINVAL;
7066                 goto out_free;
7067         }
7068
7069         request->n_channels = i;
7070
7071         i = 0;
7072         if (n_ssids) {
7073                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7074                                     tmp) {
7075                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
7076                                 err = -EINVAL;
7077                                 goto out_free;
7078                         }
7079                         request->ssids[i].ssid_len = nla_len(attr);
7080                         memcpy(request->ssids[i].ssid, nla_data(attr),
7081                                nla_len(attr));
7082                         i++;
7083                 }
7084         }
7085
7086         i = 0;
7087         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7088                 nla_for_each_nested(attr,
7089                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7090                                     tmp) {
7091                         struct nlattr *ssid, *rssi;
7092
7093                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7094                                         nla_data(attr), nla_len(attr),
7095                                         nl80211_match_policy);
7096                         if (err)
7097                                 goto out_free;
7098                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
7099                         if (ssid) {
7100                                 if (WARN_ON(i >= n_match_sets)) {
7101                                         /* this indicates a programming error,
7102                                          * the loop above should have verified
7103                                          * things properly
7104                                          */
7105                                         err = -EINVAL;
7106                                         goto out_free;
7107                                 }
7108
7109                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
7110                                         err = -EINVAL;
7111                                         goto out_free;
7112                                 }
7113                                 memcpy(request->match_sets[i].ssid.ssid,
7114                                        nla_data(ssid), nla_len(ssid));
7115                                 request->match_sets[i].ssid.ssid_len =
7116                                         nla_len(ssid);
7117                                 /* special attribute - old implementation w/a */
7118                                 request->match_sets[i].rssi_thold =
7119                                         default_match_rssi;
7120                                 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7121                                 if (rssi)
7122                                         request->match_sets[i].rssi_thold =
7123                                                 nla_get_s32(rssi);
7124                         }
7125                         i++;
7126                 }
7127
7128                 /* there was no other matchset, so the RSSI one is alone */
7129                 if (i == 0 && n_match_sets)
7130                         request->match_sets[0].rssi_thold = default_match_rssi;
7131
7132                 request->min_rssi_thold = INT_MAX;
7133                 for (i = 0; i < n_match_sets; i++)
7134                         request->min_rssi_thold =
7135                                 min(request->match_sets[i].rssi_thold,
7136                                     request->min_rssi_thold);
7137         } else {
7138                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
7139         }
7140
7141         if (ie_len) {
7142                 request->ie_len = ie_len;
7143                 memcpy((void *)request->ie,
7144                        nla_data(attrs[NL80211_ATTR_IE]),
7145                        request->ie_len);
7146         }
7147
7148         if (attrs[NL80211_ATTR_SCAN_FLAGS]) {
7149                 request->flags = nla_get_u32(
7150                         attrs[NL80211_ATTR_SCAN_FLAGS]);
7151                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
7152                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
7153                         err = -EOPNOTSUPP;
7154                         goto out_free;
7155                 }
7156
7157                 if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
7158                         u32 flg = NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
7159
7160                         if (!wdev) /* must be net-detect */
7161                                 flg = NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
7162
7163                         if (!(wiphy->features & flg)) {
7164                                 err = -EOPNOTSUPP;
7165                                 goto out_free;
7166                         }
7167
7168                         if (wdev && wdev->current_bss) {
7169                                 err = -EOPNOTSUPP;
7170                                 goto out_free;
7171                         }
7172
7173                         err = nl80211_parse_random_mac(attrs, request->mac_addr,
7174                                                        request->mac_addr_mask);
7175                         if (err)
7176                                 goto out_free;
7177                 }
7178         }
7179
7180         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
7181                 request->delay =
7182                         nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
7183
7184         err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
7185         if (err)
7186                 goto out_free;
7187
7188         request->scan_start = jiffies;
7189
7190         return request;
7191
7192 out_free:
7193         kfree(request);
7194         return ERR_PTR(err);
7195 }
7196
7197 static int nl80211_start_sched_scan(struct sk_buff *skb,
7198                                     struct genl_info *info)
7199 {
7200         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7201         struct net_device *dev = info->user_ptr[1];
7202         struct wireless_dev *wdev = dev->ieee80211_ptr;
7203         struct cfg80211_sched_scan_request *sched_scan_req;
7204         int err;
7205
7206         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
7207             !rdev->ops->sched_scan_start)
7208                 return -EOPNOTSUPP;
7209
7210         if (rdev->sched_scan_req)
7211                 return -EINPROGRESS;
7212
7213         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
7214                                                   info->attrs);
7215
7216         err = PTR_ERR_OR_ZERO(sched_scan_req);
7217         if (err)
7218                 goto out_err;
7219
7220         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
7221         if (err)
7222                 goto out_free;
7223
7224         sched_scan_req->dev = dev;
7225         sched_scan_req->wiphy = &rdev->wiphy;
7226
7227         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
7228                 sched_scan_req->owner_nlportid = info->snd_portid;
7229
7230         rcu_assign_pointer(rdev->sched_scan_req, sched_scan_req);
7231
7232         nl80211_send_sched_scan(rdev, dev,
7233                                 NL80211_CMD_START_SCHED_SCAN);
7234         return 0;
7235
7236 out_free:
7237         kfree(sched_scan_req);
7238 out_err:
7239         return err;
7240 }
7241
7242 static int nl80211_stop_sched_scan(struct sk_buff *skb,
7243                                    struct genl_info *info)
7244 {
7245         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7246
7247         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
7248             !rdev->ops->sched_scan_stop)
7249                 return -EOPNOTSUPP;
7250
7251         return __cfg80211_stop_sched_scan(rdev, false);
7252 }
7253
7254 static int nl80211_start_radar_detection(struct sk_buff *skb,
7255                                          struct genl_info *info)
7256 {
7257         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7258         struct net_device *dev = info->user_ptr[1];
7259         struct wireless_dev *wdev = dev->ieee80211_ptr;
7260         struct cfg80211_chan_def chandef;
7261         enum nl80211_dfs_regions dfs_region;
7262         unsigned int cac_time_ms;
7263         int err;
7264
7265         dfs_region = reg_get_dfs_region(wdev->wiphy);
7266         if (dfs_region == NL80211_DFS_UNSET)
7267                 return -EINVAL;
7268
7269         err = nl80211_parse_chandef(rdev, info, &chandef);
7270         if (err)
7271                 return err;
7272
7273         if (netif_carrier_ok(dev))
7274                 return -EBUSY;
7275
7276         if (wdev->cac_started)
7277                 return -EBUSY;
7278
7279         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef,
7280                                             wdev->iftype);
7281         if (err < 0)
7282                 return err;
7283
7284         if (err == 0)
7285                 return -EINVAL;
7286
7287         if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef))
7288                 return -EINVAL;
7289
7290         if (!rdev->ops->start_radar_detection)
7291                 return -EOPNOTSUPP;
7292
7293         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
7294         if (WARN_ON(!cac_time_ms))
7295                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
7296
7297         err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
7298         if (!err) {
7299                 wdev->chandef = chandef;
7300                 wdev->cac_started = true;
7301                 wdev->cac_start_time = jiffies;
7302                 wdev->cac_time_ms = cac_time_ms;
7303         }
7304         return err;
7305 }
7306
7307 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
7308 {
7309         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7310         struct net_device *dev = info->user_ptr[1];
7311         struct wireless_dev *wdev = dev->ieee80211_ptr;
7312         struct cfg80211_csa_settings params;
7313         /* csa_attrs is defined static to avoid waste of stack size - this
7314          * function is called under RTNL lock, so this should not be a problem.
7315          */
7316         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
7317         int err;
7318         bool need_new_beacon = false;
7319         int len, i;
7320         u32 cs_count;
7321
7322         if (!rdev->ops->channel_switch ||
7323             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
7324                 return -EOPNOTSUPP;
7325
7326         switch (dev->ieee80211_ptr->iftype) {
7327         case NL80211_IFTYPE_AP:
7328         case NL80211_IFTYPE_P2P_GO:
7329                 need_new_beacon = true;
7330
7331                 /* useless if AP is not running */
7332                 if (!wdev->beacon_interval)
7333                         return -ENOTCONN;
7334                 break;
7335         case NL80211_IFTYPE_ADHOC:
7336                 if (!wdev->ssid_len)
7337                         return -ENOTCONN;
7338                 break;
7339         case NL80211_IFTYPE_MESH_POINT:
7340                 if (!wdev->mesh_id_len)
7341                         return -ENOTCONN;
7342                 break;
7343         default:
7344                 return -EOPNOTSUPP;
7345         }
7346
7347         memset(&params, 0, sizeof(params));
7348
7349         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
7350             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
7351                 return -EINVAL;
7352
7353         /* only important for AP, IBSS and mesh create IEs internally */
7354         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
7355                 return -EINVAL;
7356
7357         /* Even though the attribute is u32, the specification says
7358          * u8, so let's make sure we don't overflow.
7359          */
7360         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
7361         if (cs_count > 255)
7362                 return -EINVAL;
7363
7364         params.count = cs_count;
7365
7366         if (!need_new_beacon)
7367                 goto skip_beacons;
7368
7369         err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
7370         if (err)
7371                 return err;
7372
7373         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
7374                                info->attrs[NL80211_ATTR_CSA_IES],
7375                                nl80211_policy);
7376         if (err)
7377                 return err;
7378
7379         err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
7380         if (err)
7381                 return err;
7382
7383         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
7384                 return -EINVAL;
7385
7386         len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
7387         if (!len || (len % sizeof(u16)))
7388                 return -EINVAL;
7389
7390         params.n_counter_offsets_beacon = len / sizeof(u16);
7391         if (rdev->wiphy.max_num_csa_counters &&
7392             (params.n_counter_offsets_beacon >
7393              rdev->wiphy.max_num_csa_counters))
7394                 return -EINVAL;
7395
7396         params.counter_offsets_beacon =
7397                 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
7398
7399         /* sanity checks - counters should fit and be the same */
7400         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
7401                 u16 offset = params.counter_offsets_beacon[i];
7402
7403                 if (offset >= params.beacon_csa.tail_len)
7404                         return -EINVAL;
7405
7406                 if (params.beacon_csa.tail[offset] != params.count)
7407                         return -EINVAL;
7408         }
7409
7410         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
7411                 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
7412                 if (!len || (len % sizeof(u16)))
7413                         return -EINVAL;
7414
7415                 params.n_counter_offsets_presp = len / sizeof(u16);
7416                 if (rdev->wiphy.max_num_csa_counters &&
7417                     (params.n_counter_offsets_presp >
7418                      rdev->wiphy.max_num_csa_counters))
7419                         return -EINVAL;
7420
7421                 params.counter_offsets_presp =
7422                         nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
7423
7424                 /* sanity checks - counters should fit and be the same */
7425                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
7426                         u16 offset = params.counter_offsets_presp[i];
7427
7428                         if (offset >= params.beacon_csa.probe_resp_len)
7429                                 return -EINVAL;
7430
7431                         if (params.beacon_csa.probe_resp[offset] !=
7432                             params.count)
7433                                 return -EINVAL;
7434                 }
7435         }
7436
7437 skip_beacons:
7438         err = nl80211_parse_chandef(rdev, info, &params.chandef);
7439         if (err)
7440                 return err;
7441
7442         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
7443                                            wdev->iftype))
7444                 return -EINVAL;
7445
7446         err = cfg80211_chandef_dfs_required(wdev->wiphy,
7447                                             &params.chandef,
7448                                             wdev->iftype);
7449         if (err < 0)
7450                 return err;
7451
7452         if (err > 0)
7453                 params.radar_required = true;
7454
7455         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
7456                 params.block_tx = true;
7457
7458         wdev_lock(wdev);
7459         err = rdev_channel_switch(rdev, dev, &params);
7460         wdev_unlock(wdev);
7461
7462         return err;
7463 }
7464
7465 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
7466                             u32 seq, int flags,
7467                             struct cfg80211_registered_device *rdev,
7468                             struct wireless_dev *wdev,
7469                             struct cfg80211_internal_bss *intbss)
7470 {
7471         struct cfg80211_bss *res = &intbss->pub;
7472         const struct cfg80211_bss_ies *ies;
7473         void *hdr;
7474         struct nlattr *bss;
7475
7476         ASSERT_WDEV_LOCK(wdev);
7477
7478         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
7479                              NL80211_CMD_NEW_SCAN_RESULTS);
7480         if (!hdr)
7481                 return -1;
7482
7483         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
7484
7485         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
7486                 goto nla_put_failure;
7487         if (wdev->netdev &&
7488             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
7489                 goto nla_put_failure;
7490         if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
7491                               NL80211_ATTR_PAD))
7492                 goto nla_put_failure;
7493
7494         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
7495         if (!bss)
7496                 goto nla_put_failure;
7497         if ((!is_zero_ether_addr(res->bssid) &&
7498              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
7499                 goto nla_put_failure;
7500
7501         rcu_read_lock();
7502         /* indicate whether we have probe response data or not */
7503         if (rcu_access_pointer(res->proberesp_ies) &&
7504             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
7505                 goto fail_unlock_rcu;
7506
7507         /* this pointer prefers to be pointed to probe response data
7508          * but is always valid
7509          */
7510         ies = rcu_dereference(res->ies);
7511         if (ies) {
7512                 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
7513                                       NL80211_BSS_PAD))
7514                         goto fail_unlock_rcu;
7515                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
7516                                         ies->len, ies->data))
7517                         goto fail_unlock_rcu;
7518         }
7519
7520         /* and this pointer is always (unless driver didn't know) beacon data */
7521         ies = rcu_dereference(res->beacon_ies);
7522         if (ies && ies->from_beacon) {
7523                 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
7524                                       NL80211_BSS_PAD))
7525                         goto fail_unlock_rcu;
7526                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
7527                                         ies->len, ies->data))
7528                         goto fail_unlock_rcu;
7529         }
7530         rcu_read_unlock();
7531
7532         if (res->beacon_interval &&
7533             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
7534                 goto nla_put_failure;
7535         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
7536             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
7537             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
7538             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
7539                         jiffies_to_msecs(jiffies - intbss->ts)))
7540                 goto nla_put_failure;
7541
7542         if (intbss->parent_tsf &&
7543             (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
7544                                intbss->parent_tsf, NL80211_BSS_PAD) ||
7545              nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
7546                      intbss->parent_bssid)))
7547                 goto nla_put_failure;
7548
7549         if (intbss->ts_boottime &&
7550             nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
7551                               intbss->ts_boottime, NL80211_BSS_PAD))
7552                 goto nla_put_failure;
7553
7554         switch (rdev->wiphy.signal_type) {
7555         case CFG80211_SIGNAL_TYPE_MBM:
7556                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
7557                         goto nla_put_failure;
7558                 break;
7559         case CFG80211_SIGNAL_TYPE_UNSPEC:
7560                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
7561                         goto nla_put_failure;
7562                 break;
7563         default:
7564                 break;
7565         }
7566
7567         switch (wdev->iftype) {
7568         case NL80211_IFTYPE_P2P_CLIENT:
7569         case NL80211_IFTYPE_STATION:
7570                 if (intbss == wdev->current_bss &&
7571                     nla_put_u32(msg, NL80211_BSS_STATUS,
7572                                 NL80211_BSS_STATUS_ASSOCIATED))
7573                         goto nla_put_failure;
7574                 break;
7575         case NL80211_IFTYPE_ADHOC:
7576                 if (intbss == wdev->current_bss &&
7577                     nla_put_u32(msg, NL80211_BSS_STATUS,
7578                                 NL80211_BSS_STATUS_IBSS_JOINED))
7579                         goto nla_put_failure;
7580                 break;
7581         default:
7582                 break;
7583         }
7584
7585         nla_nest_end(msg, bss);
7586
7587         genlmsg_end(msg, hdr);
7588         return 0;
7589
7590  fail_unlock_rcu:
7591         rcu_read_unlock();
7592  nla_put_failure:
7593         genlmsg_cancel(msg, hdr);
7594         return -EMSGSIZE;
7595 }
7596
7597 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
7598 {
7599         struct cfg80211_registered_device *rdev;
7600         struct cfg80211_internal_bss *scan;
7601         struct wireless_dev *wdev;
7602         int start = cb->args[2], idx = 0;
7603         int err;
7604
7605         rtnl_lock();
7606         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
7607         if (err) {
7608                 rtnl_unlock();
7609                 return err;
7610         }
7611
7612         wdev_lock(wdev);
7613         spin_lock_bh(&rdev->bss_lock);
7614         cfg80211_bss_expire(rdev);
7615
7616         cb->seq = rdev->bss_generation;
7617
7618         list_for_each_entry(scan, &rdev->bss_list, list) {
7619                 if (++idx <= start)
7620                         continue;
7621                 if (nl80211_send_bss(skb, cb,
7622                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
7623                                 rdev, wdev, scan) < 0) {
7624                         idx--;
7625                         break;
7626                 }
7627         }
7628
7629         spin_unlock_bh(&rdev->bss_lock);
7630         wdev_unlock(wdev);
7631
7632         cb->args[2] = idx;
7633         rtnl_unlock();
7634
7635         return skb->len;
7636 }
7637
7638 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
7639                                int flags, struct net_device *dev,
7640                                bool allow_radio_stats,
7641                                struct survey_info *survey)
7642 {
7643         void *hdr;
7644         struct nlattr *infoattr;
7645
7646         /* skip radio stats if userspace didn't request them */
7647         if (!survey->channel && !allow_radio_stats)
7648                 return 0;
7649
7650         hdr = nl80211hdr_put(msg, portid, seq, flags,
7651                              NL80211_CMD_NEW_SURVEY_RESULTS);
7652         if (!hdr)
7653                 return -ENOMEM;
7654
7655         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
7656                 goto nla_put_failure;
7657
7658         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
7659         if (!infoattr)
7660                 goto nla_put_failure;
7661
7662         if (survey->channel &&
7663             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
7664                         survey->channel->center_freq))
7665                 goto nla_put_failure;
7666
7667         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
7668             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
7669                 goto nla_put_failure;
7670         if ((survey->filled & SURVEY_INFO_IN_USE) &&
7671             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
7672                 goto nla_put_failure;
7673         if ((survey->filled & SURVEY_INFO_TIME) &&
7674             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
7675                         survey->time, NL80211_SURVEY_INFO_PAD))
7676                 goto nla_put_failure;
7677         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
7678             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
7679                               survey->time_busy, NL80211_SURVEY_INFO_PAD))
7680                 goto nla_put_failure;
7681         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
7682             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
7683                               survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
7684                 goto nla_put_failure;
7685         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
7686             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
7687                               survey->time_rx, NL80211_SURVEY_INFO_PAD))
7688                 goto nla_put_failure;
7689         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
7690             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
7691                               survey->time_tx, NL80211_SURVEY_INFO_PAD))
7692                 goto nla_put_failure;
7693         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
7694             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
7695                               survey->time_scan, NL80211_SURVEY_INFO_PAD))
7696                 goto nla_put_failure;
7697
7698         nla_nest_end(msg, infoattr);
7699
7700         genlmsg_end(msg, hdr);
7701         return 0;
7702
7703  nla_put_failure:
7704         genlmsg_cancel(msg, hdr);
7705         return -EMSGSIZE;
7706 }
7707
7708 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
7709 {
7710         struct survey_info survey;
7711         struct cfg80211_registered_device *rdev;
7712         struct wireless_dev *wdev;
7713         int survey_idx = cb->args[2];
7714         int res;
7715         bool radio_stats;
7716
7717         rtnl_lock();
7718         res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
7719         if (res)
7720                 goto out_err;
7721
7722         /* prepare_wdev_dump parsed the attributes */
7723         radio_stats = nl80211_fam.attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
7724
7725         if (!wdev->netdev) {
7726                 res = -EINVAL;
7727                 goto out_err;
7728         }
7729
7730         if (!rdev->ops->dump_survey) {
7731                 res = -EOPNOTSUPP;
7732                 goto out_err;
7733         }
7734
7735         while (1) {
7736                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
7737                 if (res == -ENOENT)
7738                         break;
7739                 if (res)
7740                         goto out_err;
7741
7742                 /* don't send disabled channels, but do send non-channel data */
7743                 if (survey.channel &&
7744                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
7745                         survey_idx++;
7746                         continue;
7747                 }
7748
7749                 if (nl80211_send_survey(skb,
7750                                 NETLINK_CB(cb->skb).portid,
7751                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
7752                                 wdev->netdev, radio_stats, &survey) < 0)
7753                         goto out;
7754                 survey_idx++;
7755         }
7756
7757  out:
7758         cb->args[2] = survey_idx;
7759         res = skb->len;
7760  out_err:
7761         rtnl_unlock();
7762         return res;
7763 }
7764
7765 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
7766 {
7767         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
7768                                   NL80211_WPA_VERSION_2));
7769 }
7770
7771 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
7772 {
7773         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7774         struct net_device *dev = info->user_ptr[1];
7775         struct ieee80211_channel *chan;
7776         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
7777         int err, ssid_len, ie_len = 0, sae_data_len = 0;
7778         enum nl80211_auth_type auth_type;
7779         struct key_parse key;
7780         bool local_state_change;
7781
7782         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7783                 return -EINVAL;
7784
7785         if (!info->attrs[NL80211_ATTR_MAC])
7786                 return -EINVAL;
7787
7788         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
7789                 return -EINVAL;
7790
7791         if (!info->attrs[NL80211_ATTR_SSID])
7792                 return -EINVAL;
7793
7794         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
7795                 return -EINVAL;
7796
7797         err = nl80211_parse_key(info, &key);
7798         if (err)
7799                 return err;
7800
7801         if (key.idx >= 0) {
7802                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
7803                         return -EINVAL;
7804                 if (!key.p.key || !key.p.key_len)
7805                         return -EINVAL;
7806                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
7807                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
7808                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
7809                      key.p.key_len != WLAN_KEY_LEN_WEP104))
7810                         return -EINVAL;
7811                 if (key.idx > 3)
7812                         return -EINVAL;
7813         } else {
7814                 key.p.key_len = 0;
7815                 key.p.key = NULL;
7816         }
7817
7818         if (key.idx >= 0) {
7819                 int i;
7820                 bool ok = false;
7821
7822                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
7823                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
7824                                 ok = true;
7825                                 break;
7826                         }
7827                 }
7828                 if (!ok)
7829                         return -EINVAL;
7830         }
7831
7832         if (!rdev->ops->auth)
7833                 return -EOPNOTSUPP;
7834
7835         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7836             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7837                 return -EOPNOTSUPP;
7838
7839         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7840         chan = nl80211_get_valid_chan(&rdev->wiphy,
7841                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7842         if (!chan)
7843                 return -EINVAL;
7844
7845         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7846         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7847
7848         if (info->attrs[NL80211_ATTR_IE]) {
7849                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7850                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7851         }
7852
7853         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
7854         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
7855                 return -EINVAL;
7856
7857         if (auth_type == NL80211_AUTHTYPE_SAE &&
7858             !info->attrs[NL80211_ATTR_SAE_DATA])
7859                 return -EINVAL;
7860
7861         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
7862                 if (auth_type != NL80211_AUTHTYPE_SAE)
7863                         return -EINVAL;
7864                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
7865                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
7866                 /* need to include at least Auth Transaction and Status Code */
7867                 if (sae_data_len < 4)
7868                         return -EINVAL;
7869         }
7870
7871         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
7872
7873         /*
7874          * Since we no longer track auth state, ignore
7875          * requests to only change local state.
7876          */
7877         if (local_state_change)
7878                 return 0;
7879
7880         wdev_lock(dev->ieee80211_ptr);
7881         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
7882                                  ssid, ssid_len, ie, ie_len,
7883                                  key.p.key, key.p.key_len, key.idx,
7884                                  sae_data, sae_data_len);
7885         wdev_unlock(dev->ieee80211_ptr);
7886         return err;
7887 }
7888
7889 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
7890                                    struct genl_info *info,
7891                                    struct cfg80211_crypto_settings *settings,
7892                                    int cipher_limit)
7893 {
7894         memset(settings, 0, sizeof(*settings));
7895
7896         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
7897
7898         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
7899                 u16 proto;
7900
7901                 proto = nla_get_u16(
7902                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
7903                 settings->control_port_ethertype = cpu_to_be16(proto);
7904                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
7905                     proto != ETH_P_PAE)
7906                         return -EINVAL;
7907                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
7908                         settings->control_port_no_encrypt = true;
7909         } else
7910                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
7911
7912         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
7913                 void *data;
7914                 int len, i;
7915
7916                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
7917                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
7918                 settings->n_ciphers_pairwise = len / sizeof(u32);
7919
7920                 if (len % sizeof(u32))
7921                         return -EINVAL;
7922
7923                 if (settings->n_ciphers_pairwise > cipher_limit)
7924                         return -EINVAL;
7925
7926                 memcpy(settings->ciphers_pairwise, data, len);
7927
7928                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
7929                         if (!cfg80211_supported_cipher_suite(
7930                                         &rdev->wiphy,
7931                                         settings->ciphers_pairwise[i]))
7932                                 return -EINVAL;
7933         }
7934
7935         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
7936                 settings->cipher_group =
7937                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
7938                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
7939                                                      settings->cipher_group))
7940                         return -EINVAL;
7941         }
7942
7943         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
7944                 settings->wpa_versions =
7945                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
7946                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
7947                         return -EINVAL;
7948         }
7949
7950         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
7951                 void *data;
7952                 int len;
7953
7954                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
7955                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
7956                 settings->n_akm_suites = len / sizeof(u32);
7957
7958                 if (len % sizeof(u32))
7959                         return -EINVAL;
7960
7961                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
7962                         return -EINVAL;
7963
7964                 memcpy(settings->akm_suites, data, len);
7965         }
7966
7967         return 0;
7968 }
7969
7970 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
7971 {
7972         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7973         struct net_device *dev = info->user_ptr[1];
7974         struct ieee80211_channel *chan;
7975         struct cfg80211_assoc_request req = {};
7976         const u8 *bssid, *ssid;
7977         int err, ssid_len = 0;
7978
7979         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7980                 return -EINVAL;
7981
7982         if (!info->attrs[NL80211_ATTR_MAC] ||
7983             !info->attrs[NL80211_ATTR_SSID] ||
7984             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
7985                 return -EINVAL;
7986
7987         if (!rdev->ops->assoc)
7988                 return -EOPNOTSUPP;
7989
7990         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7991             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7992                 return -EOPNOTSUPP;
7993
7994         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7995
7996         chan = nl80211_get_valid_chan(&rdev->wiphy,
7997                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7998         if (!chan)
7999                 return -EINVAL;
8000
8001         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8002         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8003
8004         if (info->attrs[NL80211_ATTR_IE]) {
8005                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8006                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8007         }
8008
8009         if (info->attrs[NL80211_ATTR_USE_MFP]) {
8010                 enum nl80211_mfp mfp =
8011                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
8012                 if (mfp == NL80211_MFP_REQUIRED)
8013                         req.use_mfp = true;
8014                 else if (mfp != NL80211_MFP_NO)
8015                         return -EINVAL;
8016         }
8017
8018         if (info->attrs[NL80211_ATTR_PREV_BSSID])
8019                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
8020
8021         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
8022                 req.flags |= ASSOC_REQ_DISABLE_HT;
8023
8024         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8025                 memcpy(&req.ht_capa_mask,
8026                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8027                        sizeof(req.ht_capa_mask));
8028
8029         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8030                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8031                         return -EINVAL;
8032                 memcpy(&req.ht_capa,
8033                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8034                        sizeof(req.ht_capa));
8035         }
8036
8037         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
8038                 req.flags |= ASSOC_REQ_DISABLE_VHT;
8039
8040         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8041                 memcpy(&req.vht_capa_mask,
8042                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
8043                        sizeof(req.vht_capa_mask));
8044
8045         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
8046                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8047                         return -EINVAL;
8048                 memcpy(&req.vht_capa,
8049                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
8050                        sizeof(req.vht_capa));
8051         }
8052
8053         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
8054                 if (!((rdev->wiphy.features &
8055                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
8056                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
8057                     !wiphy_ext_feature_isset(&rdev->wiphy,
8058                                              NL80211_EXT_FEATURE_RRM))
8059                         return -EINVAL;
8060                 req.flags |= ASSOC_REQ_USE_RRM;
8061         }
8062
8063         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
8064         if (!err) {
8065                 wdev_lock(dev->ieee80211_ptr);
8066                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
8067                                           ssid, ssid_len, &req);
8068                 wdev_unlock(dev->ieee80211_ptr);
8069         }
8070
8071         return err;
8072 }
8073
8074 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
8075 {
8076         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8077         struct net_device *dev = info->user_ptr[1];
8078         const u8 *ie = NULL, *bssid;
8079         int ie_len = 0, err;
8080         u16 reason_code;
8081         bool local_state_change;
8082
8083         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8084                 return -EINVAL;
8085
8086         if (!info->attrs[NL80211_ATTR_MAC])
8087                 return -EINVAL;
8088
8089         if (!info->attrs[NL80211_ATTR_REASON_CODE])
8090                 return -EINVAL;
8091
8092         if (!rdev->ops->deauth)
8093                 return -EOPNOTSUPP;
8094
8095         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8096             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8097                 return -EOPNOTSUPP;
8098
8099         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8100
8101         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8102         if (reason_code == 0) {
8103                 /* Reason Code 0 is reserved */
8104                 return -EINVAL;
8105         }
8106
8107         if (info->attrs[NL80211_ATTR_IE]) {
8108                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8109                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8110         }
8111
8112         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8113
8114         wdev_lock(dev->ieee80211_ptr);
8115         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
8116                                    local_state_change);
8117         wdev_unlock(dev->ieee80211_ptr);
8118         return err;
8119 }
8120
8121 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
8122 {
8123         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8124         struct net_device *dev = info->user_ptr[1];
8125         const u8 *ie = NULL, *bssid;
8126         int ie_len = 0, err;
8127         u16 reason_code;
8128         bool local_state_change;
8129
8130         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8131                 return -EINVAL;
8132
8133         if (!info->attrs[NL80211_ATTR_MAC])
8134                 return -EINVAL;
8135
8136         if (!info->attrs[NL80211_ATTR_REASON_CODE])
8137                 return -EINVAL;
8138
8139         if (!rdev->ops->disassoc)
8140                 return -EOPNOTSUPP;
8141
8142         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8143             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8144                 return -EOPNOTSUPP;
8145
8146         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8147
8148         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8149         if (reason_code == 0) {
8150                 /* Reason Code 0 is reserved */
8151                 return -EINVAL;
8152         }
8153
8154         if (info->attrs[NL80211_ATTR_IE]) {
8155                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8156                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8157         }
8158
8159         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8160
8161         wdev_lock(dev->ieee80211_ptr);
8162         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
8163                                      local_state_change);
8164         wdev_unlock(dev->ieee80211_ptr);
8165         return err;
8166 }
8167
8168 static bool
8169 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
8170                          int mcast_rate[NUM_NL80211_BANDS],
8171                          int rateval)
8172 {
8173         struct wiphy *wiphy = &rdev->wiphy;
8174         bool found = false;
8175         int band, i;
8176
8177         for (band = 0; band < NUM_NL80211_BANDS; band++) {
8178                 struct ieee80211_supported_band *sband;
8179
8180                 sband = wiphy->bands[band];
8181                 if (!sband)
8182                         continue;
8183
8184                 for (i = 0; i < sband->n_bitrates; i++) {
8185                         if (sband->bitrates[i].bitrate == rateval) {
8186                                 mcast_rate[band] = i + 1;
8187                                 found = true;
8188                                 break;
8189                         }
8190                 }
8191         }
8192
8193         return found;
8194 }
8195
8196 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
8197 {
8198         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8199         struct net_device *dev = info->user_ptr[1];
8200         struct cfg80211_ibss_params ibss;
8201         struct wiphy *wiphy;
8202         struct cfg80211_cached_keys *connkeys = NULL;
8203         int err;
8204
8205         memset(&ibss, 0, sizeof(ibss));
8206
8207         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8208                 return -EINVAL;
8209
8210         if (!info->attrs[NL80211_ATTR_SSID] ||
8211             !nla_len(info->attrs[NL80211_ATTR_SSID]))
8212                 return -EINVAL;
8213
8214         ibss.beacon_interval = 100;
8215
8216         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
8217                 ibss.beacon_interval =
8218                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
8219
8220         err = cfg80211_validate_beacon_int(rdev, ibss.beacon_interval);
8221         if (err)
8222                 return err;
8223
8224         if (!rdev->ops->join_ibss)
8225                 return -EOPNOTSUPP;
8226
8227         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
8228                 return -EOPNOTSUPP;
8229
8230         wiphy = &rdev->wiphy;
8231
8232         if (info->attrs[NL80211_ATTR_MAC]) {
8233                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8234
8235                 if (!is_valid_ether_addr(ibss.bssid))
8236                         return -EINVAL;
8237         }
8238         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8239         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8240
8241         if (info->attrs[NL80211_ATTR_IE]) {
8242                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8243                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8244         }
8245
8246         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
8247         if (err)
8248                 return err;
8249
8250         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
8251                                      NL80211_IFTYPE_ADHOC))
8252                 return -EINVAL;
8253
8254         switch (ibss.chandef.width) {
8255         case NL80211_CHAN_WIDTH_5:
8256         case NL80211_CHAN_WIDTH_10:
8257         case NL80211_CHAN_WIDTH_20_NOHT:
8258                 break;
8259         case NL80211_CHAN_WIDTH_20:
8260         case NL80211_CHAN_WIDTH_40:
8261                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
8262                         return -EINVAL;
8263                 break;
8264         case NL80211_CHAN_WIDTH_80:
8265         case NL80211_CHAN_WIDTH_80P80:
8266         case NL80211_CHAN_WIDTH_160:
8267                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
8268                         return -EINVAL;
8269                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
8270                                              NL80211_EXT_FEATURE_VHT_IBSS))
8271                         return -EINVAL;
8272                 break;
8273         default:
8274                 return -EINVAL;
8275         }
8276
8277         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
8278         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
8279
8280         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8281                 u8 *rates =
8282                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8283                 int n_rates =
8284                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8285                 struct ieee80211_supported_band *sband =
8286                         wiphy->bands[ibss.chandef.chan->band];
8287
8288                 err = ieee80211_get_ratemask(sband, rates, n_rates,
8289                                              &ibss.basic_rates);
8290                 if (err)
8291                         return err;
8292         }
8293
8294         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8295                 memcpy(&ibss.ht_capa_mask,
8296                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8297                        sizeof(ibss.ht_capa_mask));
8298
8299         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8300                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8301                         return -EINVAL;
8302                 memcpy(&ibss.ht_capa,
8303                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8304                        sizeof(ibss.ht_capa));
8305         }
8306
8307         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
8308             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
8309                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
8310                 return -EINVAL;
8311
8312         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
8313                 bool no_ht = false;
8314
8315                 connkeys = nl80211_parse_connkeys(rdev,
8316                                           info->attrs[NL80211_ATTR_KEYS],
8317                                           &no_ht);
8318                 if (IS_ERR(connkeys))
8319                         return PTR_ERR(connkeys);
8320
8321                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
8322                     no_ht) {
8323                         kzfree(connkeys);
8324                         return -EINVAL;
8325                 }
8326         }
8327
8328         ibss.control_port =
8329                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
8330
8331         ibss.userspace_handles_dfs =
8332                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
8333
8334         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
8335         if (err)
8336                 kzfree(connkeys);
8337         return err;
8338 }
8339
8340 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
8341 {
8342         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8343         struct net_device *dev = info->user_ptr[1];
8344
8345         if (!rdev->ops->leave_ibss)
8346                 return -EOPNOTSUPP;
8347
8348         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
8349                 return -EOPNOTSUPP;
8350
8351         return cfg80211_leave_ibss(rdev, dev, false);
8352 }
8353
8354 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
8355 {
8356         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8357         struct net_device *dev = info->user_ptr[1];
8358         int mcast_rate[NUM_NL80211_BANDS];
8359         u32 nla_rate;
8360         int err;
8361
8362         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
8363             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
8364             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
8365                 return -EOPNOTSUPP;
8366
8367         if (!rdev->ops->set_mcast_rate)
8368                 return -EOPNOTSUPP;
8369
8370         memset(mcast_rate, 0, sizeof(mcast_rate));
8371
8372         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
8373                 return -EINVAL;
8374
8375         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
8376         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
8377                 return -EINVAL;
8378
8379         err = rdev_set_mcast_rate(rdev, dev, mcast_rate);
8380
8381         return err;
8382 }
8383
8384 static struct sk_buff *
8385 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
8386                             struct wireless_dev *wdev, int approxlen,
8387                             u32 portid, u32 seq, enum nl80211_commands cmd,
8388                             enum nl80211_attrs attr,
8389                             const struct nl80211_vendor_cmd_info *info,
8390                             gfp_t gfp)
8391 {
8392         struct sk_buff *skb;
8393         void *hdr;
8394         struct nlattr *data;
8395
8396         skb = nlmsg_new(approxlen + 100, gfp);
8397         if (!skb)
8398                 return NULL;
8399
8400         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
8401         if (!hdr) {
8402                 kfree_skb(skb);
8403                 return NULL;
8404         }
8405
8406         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
8407                 goto nla_put_failure;
8408
8409         if (info) {
8410                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
8411                                 info->vendor_id))
8412                         goto nla_put_failure;
8413                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
8414                                 info->subcmd))
8415                         goto nla_put_failure;
8416         }
8417
8418         if (wdev) {
8419                 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
8420                                       wdev_id(wdev), NL80211_ATTR_PAD))
8421                         goto nla_put_failure;
8422                 if (wdev->netdev &&
8423                     nla_put_u32(skb, NL80211_ATTR_IFINDEX,
8424                                 wdev->netdev->ifindex))
8425                         goto nla_put_failure;
8426         }
8427
8428         data = nla_nest_start(skb, attr);
8429         if (!data)
8430                 goto nla_put_failure;
8431
8432         ((void **)skb->cb)[0] = rdev;
8433         ((void **)skb->cb)[1] = hdr;
8434         ((void **)skb->cb)[2] = data;
8435
8436         return skb;
8437
8438  nla_put_failure:
8439         kfree_skb(skb);
8440         return NULL;
8441 }
8442
8443 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
8444                                            struct wireless_dev *wdev,
8445                                            enum nl80211_commands cmd,
8446                                            enum nl80211_attrs attr,
8447                                            int vendor_event_idx,
8448                                            int approxlen, gfp_t gfp)
8449 {
8450         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
8451         const struct nl80211_vendor_cmd_info *info;
8452
8453         switch (cmd) {
8454         case NL80211_CMD_TESTMODE:
8455                 if (WARN_ON(vendor_event_idx != -1))
8456                         return NULL;
8457                 info = NULL;
8458                 break;
8459         case NL80211_CMD_VENDOR:
8460                 if (WARN_ON(vendor_event_idx < 0 ||
8461                             vendor_event_idx >= wiphy->n_vendor_events))
8462                         return NULL;
8463                 info = &wiphy->vendor_events[vendor_event_idx];
8464                 break;
8465         default:
8466                 WARN_ON(1);
8467                 return NULL;
8468         }
8469
8470         return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, 0, 0,
8471                                            cmd, attr, info, gfp);
8472 }
8473 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
8474
8475 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
8476 {
8477         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
8478         void *hdr = ((void **)skb->cb)[1];
8479         struct nlattr *data = ((void **)skb->cb)[2];
8480         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
8481
8482         /* clear CB data for netlink core to own from now on */
8483         memset(skb->cb, 0, sizeof(skb->cb));
8484
8485         nla_nest_end(skb, data);
8486         genlmsg_end(skb, hdr);
8487
8488         if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
8489                 mcgrp = NL80211_MCGRP_VENDOR;
8490
8491         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
8492                                 mcgrp, gfp);
8493 }
8494 EXPORT_SYMBOL(__cfg80211_send_event_skb);
8495
8496 #ifdef CONFIG_NL80211_TESTMODE
8497 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
8498 {
8499         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8500         struct wireless_dev *wdev =
8501                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
8502         int err;
8503
8504         if (!rdev->ops->testmode_cmd)
8505                 return -EOPNOTSUPP;
8506
8507         if (IS_ERR(wdev)) {
8508                 err = PTR_ERR(wdev);
8509                 if (err != -EINVAL)
8510                         return err;
8511                 wdev = NULL;
8512         } else if (wdev->wiphy != &rdev->wiphy) {
8513                 return -EINVAL;
8514         }
8515
8516         if (!info->attrs[NL80211_ATTR_TESTDATA])
8517                 return -EINVAL;
8518
8519         rdev->cur_cmd_info = info;
8520         err = rdev_testmode_cmd(rdev, wdev,
8521                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
8522                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
8523         rdev->cur_cmd_info = NULL;
8524
8525         return err;
8526 }
8527
8528 static int nl80211_testmode_dump(struct sk_buff *skb,
8529                                  struct netlink_callback *cb)
8530 {
8531         struct cfg80211_registered_device *rdev;
8532         int err;
8533         long phy_idx;
8534         void *data = NULL;
8535         int data_len = 0;
8536
8537         rtnl_lock();
8538
8539         if (cb->args[0]) {
8540                 /*
8541                  * 0 is a valid index, but not valid for args[0],
8542                  * so we need to offset by 1.
8543                  */
8544                 phy_idx = cb->args[0] - 1;
8545         } else {
8546                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
8547                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
8548                                   nl80211_policy);
8549                 if (err)
8550                         goto out_err;
8551
8552                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
8553                                                   nl80211_fam.attrbuf);
8554                 if (IS_ERR(rdev)) {
8555                         err = PTR_ERR(rdev);
8556                         goto out_err;
8557                 }
8558                 phy_idx = rdev->wiphy_idx;
8559                 rdev = NULL;
8560
8561                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
8562                         cb->args[1] =
8563                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
8564         }
8565
8566         if (cb->args[1]) {
8567                 data = nla_data((void *)cb->args[1]);
8568                 data_len = nla_len((void *)cb->args[1]);
8569         }
8570
8571         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
8572         if (!rdev) {
8573                 err = -ENOENT;
8574                 goto out_err;
8575         }
8576
8577         if (!rdev->ops->testmode_dump) {
8578                 err = -EOPNOTSUPP;
8579                 goto out_err;
8580         }
8581
8582         while (1) {
8583                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
8584                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
8585                                            NL80211_CMD_TESTMODE);
8586                 struct nlattr *tmdata;
8587
8588                 if (!hdr)
8589                         break;
8590
8591                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
8592                         genlmsg_cancel(skb, hdr);
8593                         break;
8594                 }
8595
8596                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
8597                 if (!tmdata) {
8598                         genlmsg_cancel(skb, hdr);
8599                         break;
8600                 }
8601                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
8602                 nla_nest_end(skb, tmdata);
8603
8604                 if (err == -ENOBUFS || err == -ENOENT) {
8605                         genlmsg_cancel(skb, hdr);
8606                         break;
8607                 } else if (err) {
8608                         genlmsg_cancel(skb, hdr);
8609                         goto out_err;
8610                 }
8611
8612                 genlmsg_end(skb, hdr);
8613         }
8614
8615         err = skb->len;
8616         /* see above */
8617         cb->args[0] = phy_idx + 1;
8618  out_err:
8619         rtnl_unlock();
8620         return err;
8621 }
8622 #endif
8623
8624 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
8625 {
8626         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8627         struct net_device *dev = info->user_ptr[1];
8628         struct cfg80211_connect_params connect;
8629         struct wiphy *wiphy;
8630         struct cfg80211_cached_keys *connkeys = NULL;
8631         int err;
8632
8633         memset(&connect, 0, sizeof(connect));
8634
8635         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8636                 return -EINVAL;
8637
8638         if (!info->attrs[NL80211_ATTR_SSID] ||
8639             !nla_len(info->attrs[NL80211_ATTR_SSID]))
8640                 return -EINVAL;
8641
8642         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
8643                 connect.auth_type =
8644                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
8645                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
8646                                              NL80211_CMD_CONNECT))
8647                         return -EINVAL;
8648         } else
8649                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
8650
8651         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
8652
8653         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
8654                                       NL80211_MAX_NR_CIPHER_SUITES);
8655         if (err)
8656                 return err;
8657
8658         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8659             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8660                 return -EOPNOTSUPP;
8661
8662         wiphy = &rdev->wiphy;
8663
8664         connect.bg_scan_period = -1;
8665         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
8666                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
8667                 connect.bg_scan_period =
8668                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
8669         }
8670
8671         if (info->attrs[NL80211_ATTR_MAC])
8672                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8673         else if (info->attrs[NL80211_ATTR_MAC_HINT])
8674                 connect.bssid_hint =
8675                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
8676         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8677         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8678
8679         if (info->attrs[NL80211_ATTR_IE]) {
8680                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8681                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8682         }
8683
8684         if (info->attrs[NL80211_ATTR_USE_MFP]) {
8685                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
8686                 if (connect.mfp != NL80211_MFP_REQUIRED &&
8687                     connect.mfp != NL80211_MFP_NO)
8688                         return -EINVAL;
8689         } else {
8690                 connect.mfp = NL80211_MFP_NO;
8691         }
8692
8693         if (info->attrs[NL80211_ATTR_PREV_BSSID])
8694                 connect.prev_bssid =
8695                         nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
8696
8697         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8698                 connect.channel = nl80211_get_valid_chan(
8699                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8700                 if (!connect.channel)
8701                         return -EINVAL;
8702         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
8703                 connect.channel_hint = nl80211_get_valid_chan(
8704                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
8705                 if (!connect.channel_hint)
8706                         return -EINVAL;
8707         }
8708
8709         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
8710                 connkeys = nl80211_parse_connkeys(rdev,
8711                                           info->attrs[NL80211_ATTR_KEYS], NULL);
8712                 if (IS_ERR(connkeys))
8713                         return PTR_ERR(connkeys);
8714         }
8715
8716         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
8717                 connect.flags |= ASSOC_REQ_DISABLE_HT;
8718
8719         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8720                 memcpy(&connect.ht_capa_mask,
8721                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8722                        sizeof(connect.ht_capa_mask));
8723
8724         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8725                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
8726                         kzfree(connkeys);
8727                         return -EINVAL;
8728                 }
8729                 memcpy(&connect.ht_capa,
8730                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8731                        sizeof(connect.ht_capa));
8732         }
8733
8734         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
8735                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
8736
8737         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8738                 memcpy(&connect.vht_capa_mask,
8739                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
8740                        sizeof(connect.vht_capa_mask));
8741
8742         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
8743                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
8744                         kzfree(connkeys);
8745                         return -EINVAL;
8746                 }
8747                 memcpy(&connect.vht_capa,
8748                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
8749                        sizeof(connect.vht_capa));
8750         }
8751
8752         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
8753                 if (!((rdev->wiphy.features &
8754                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
8755                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
8756                     !wiphy_ext_feature_isset(&rdev->wiphy,
8757                                              NL80211_EXT_FEATURE_RRM)) {
8758                         kzfree(connkeys);
8759                         return -EINVAL;
8760                 }
8761                 connect.flags |= ASSOC_REQ_USE_RRM;
8762         }
8763
8764         connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
8765         if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
8766                 kzfree(connkeys);
8767                 return -EOPNOTSUPP;
8768         }
8769
8770         if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
8771                 /* bss selection makes no sense if bssid is set */
8772                 if (connect.bssid) {
8773                         kzfree(connkeys);
8774                         return -EINVAL;
8775                 }
8776
8777                 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
8778                                        wiphy, &connect.bss_select);
8779                 if (err) {
8780                         kzfree(connkeys);
8781                         return err;
8782                 }
8783         }
8784
8785         wdev_lock(dev->ieee80211_ptr);
8786         err = cfg80211_connect(rdev, dev, &connect, connkeys,
8787                                connect.prev_bssid);
8788         wdev_unlock(dev->ieee80211_ptr);
8789         if (err)
8790                 kzfree(connkeys);
8791         return err;
8792 }
8793
8794 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
8795 {
8796         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8797         struct net_device *dev = info->user_ptr[1];
8798         u16 reason;
8799         int ret;
8800
8801         if (!info->attrs[NL80211_ATTR_REASON_CODE])
8802                 reason = WLAN_REASON_DEAUTH_LEAVING;
8803         else
8804                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8805
8806         if (reason == 0)
8807                 return -EINVAL;
8808
8809         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8810             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8811                 return -EOPNOTSUPP;
8812
8813         wdev_lock(dev->ieee80211_ptr);
8814         ret = cfg80211_disconnect(rdev, dev, reason, true);
8815         wdev_unlock(dev->ieee80211_ptr);
8816         return ret;
8817 }
8818
8819 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
8820 {
8821         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8822         struct net *net;
8823         int err;
8824
8825         if (info->attrs[NL80211_ATTR_PID]) {
8826                 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
8827
8828                 net = get_net_ns_by_pid(pid);
8829         } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
8830                 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
8831
8832                 net = get_net_ns_by_fd(fd);
8833         } else {
8834                 return -EINVAL;
8835         }
8836
8837         if (IS_ERR(net))
8838                 return PTR_ERR(net);
8839
8840         err = 0;
8841
8842         /* check if anything to do */
8843         if (!net_eq(wiphy_net(&rdev->wiphy), net))
8844                 err = cfg80211_switch_netns(rdev, net);
8845
8846         put_net(net);
8847         return err;
8848 }
8849
8850 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
8851 {
8852         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8853         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
8854                         struct cfg80211_pmksa *pmksa) = NULL;
8855         struct net_device *dev = info->user_ptr[1];
8856         struct cfg80211_pmksa pmksa;
8857
8858         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
8859
8860         if (!info->attrs[NL80211_ATTR_MAC])
8861                 return -EINVAL;
8862
8863         if (!info->attrs[NL80211_ATTR_PMKID])
8864                 return -EINVAL;
8865
8866         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
8867         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8868
8869         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8870             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8871                 return -EOPNOTSUPP;
8872
8873         switch (info->genlhdr->cmd) {
8874         case NL80211_CMD_SET_PMKSA:
8875                 rdev_ops = rdev->ops->set_pmksa;
8876                 break;
8877         case NL80211_CMD_DEL_PMKSA:
8878                 rdev_ops = rdev->ops->del_pmksa;
8879                 break;
8880         default:
8881                 WARN_ON(1);
8882                 break;
8883         }
8884
8885         if (!rdev_ops)
8886                 return -EOPNOTSUPP;
8887
8888         return rdev_ops(&rdev->wiphy, dev, &pmksa);
8889 }
8890
8891 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
8892 {
8893         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8894         struct net_device *dev = info->user_ptr[1];
8895
8896         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8897             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8898                 return -EOPNOTSUPP;
8899
8900         if (!rdev->ops->flush_pmksa)
8901                 return -EOPNOTSUPP;
8902
8903         return rdev_flush_pmksa(rdev, dev);
8904 }
8905
8906 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
8907 {
8908         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8909         struct net_device *dev = info->user_ptr[1];
8910         u8 action_code, dialog_token;
8911         u32 peer_capability = 0;
8912         u16 status_code;
8913         u8 *peer;
8914         bool initiator;
8915
8916         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
8917             !rdev->ops->tdls_mgmt)
8918                 return -EOPNOTSUPP;
8919
8920         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
8921             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
8922             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
8923             !info->attrs[NL80211_ATTR_IE] ||
8924             !info->attrs[NL80211_ATTR_MAC])
8925                 return -EINVAL;
8926
8927         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
8928         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
8929         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
8930         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
8931         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
8932         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
8933                 peer_capability =
8934                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
8935
8936         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
8937                               dialog_token, status_code, peer_capability,
8938                               initiator,
8939                               nla_data(info->attrs[NL80211_ATTR_IE]),
8940                               nla_len(info->attrs[NL80211_ATTR_IE]));
8941 }
8942
8943 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
8944 {
8945         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8946         struct net_device *dev = info->user_ptr[1];
8947         enum nl80211_tdls_operation operation;
8948         u8 *peer;
8949
8950         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
8951             !rdev->ops->tdls_oper)
8952                 return -EOPNOTSUPP;
8953
8954         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
8955             !info->attrs[NL80211_ATTR_MAC])
8956                 return -EINVAL;
8957
8958         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
8959         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
8960
8961         return rdev_tdls_oper(rdev, dev, peer, operation);
8962 }
8963
8964 static int nl80211_remain_on_channel(struct sk_buff *skb,
8965                                      struct genl_info *info)
8966 {
8967         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8968         struct wireless_dev *wdev = info->user_ptr[1];
8969         struct cfg80211_chan_def chandef;
8970         struct sk_buff *msg;
8971         void *hdr;
8972         u64 cookie;
8973         u32 duration;
8974         int err;
8975
8976         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
8977             !info->attrs[NL80211_ATTR_DURATION])
8978                 return -EINVAL;
8979
8980         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
8981
8982         if (!rdev->ops->remain_on_channel ||
8983             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
8984                 return -EOPNOTSUPP;
8985
8986         /*
8987          * We should be on that channel for at least a minimum amount of
8988          * time (10ms) but no longer than the driver supports.
8989          */
8990         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
8991             duration > rdev->wiphy.max_remain_on_channel_duration)
8992                 return -EINVAL;
8993
8994         err = nl80211_parse_chandef(rdev, info, &chandef);
8995         if (err)
8996                 return err;
8997
8998         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8999         if (!msg)
9000                 return -ENOMEM;
9001
9002         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9003                              NL80211_CMD_REMAIN_ON_CHANNEL);
9004         if (!hdr) {
9005                 err = -ENOBUFS;
9006                 goto free_msg;
9007         }
9008
9009         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
9010                                      duration, &cookie);
9011
9012         if (err)
9013                 goto free_msg;
9014
9015         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
9016                               NL80211_ATTR_PAD))
9017                 goto nla_put_failure;
9018
9019         genlmsg_end(msg, hdr);
9020
9021         return genlmsg_reply(msg, info);
9022
9023  nla_put_failure:
9024         err = -ENOBUFS;
9025  free_msg:
9026         nlmsg_free(msg);
9027         return err;
9028 }
9029
9030 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
9031                                             struct genl_info *info)
9032 {
9033         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9034         struct wireless_dev *wdev = info->user_ptr[1];
9035         u64 cookie;
9036
9037         if (!info->attrs[NL80211_ATTR_COOKIE])
9038                 return -EINVAL;
9039
9040         if (!rdev->ops->cancel_remain_on_channel)
9041                 return -EOPNOTSUPP;
9042
9043         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9044
9045         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
9046 }
9047
9048 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
9049                                        struct genl_info *info)
9050 {
9051         struct cfg80211_bitrate_mask mask;
9052         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9053         struct net_device *dev = info->user_ptr[1];
9054         int err;
9055
9056         if (!rdev->ops->set_bitrate_mask)
9057                 return -EOPNOTSUPP;
9058
9059         err = nl80211_parse_tx_bitrate_mask(info, &mask);
9060         if (err)
9061                 return err;
9062
9063         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
9064 }
9065
9066 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
9067 {
9068         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9069         struct wireless_dev *wdev = info->user_ptr[1];
9070         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
9071
9072         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
9073                 return -EINVAL;
9074
9075         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
9076                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
9077
9078         switch (wdev->iftype) {
9079         case NL80211_IFTYPE_STATION:
9080         case NL80211_IFTYPE_ADHOC:
9081         case NL80211_IFTYPE_P2P_CLIENT:
9082         case NL80211_IFTYPE_AP:
9083         case NL80211_IFTYPE_AP_VLAN:
9084         case NL80211_IFTYPE_MESH_POINT:
9085         case NL80211_IFTYPE_P2P_GO:
9086         case NL80211_IFTYPE_P2P_DEVICE:
9087                 break;
9088         case NL80211_IFTYPE_NAN:
9089         default:
9090                 return -EOPNOTSUPP;
9091         }
9092
9093         /* not much point in registering if we can't reply */
9094         if (!rdev->ops->mgmt_tx)
9095                 return -EOPNOTSUPP;
9096
9097         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
9098                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
9099                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
9100 }
9101
9102 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
9103 {
9104         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9105         struct wireless_dev *wdev = info->user_ptr[1];
9106         struct cfg80211_chan_def chandef;
9107         int err;
9108         void *hdr = NULL;
9109         u64 cookie;
9110         struct sk_buff *msg = NULL;
9111         struct cfg80211_mgmt_tx_params params = {
9112                 .dont_wait_for_ack =
9113                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
9114         };
9115
9116         if (!info->attrs[NL80211_ATTR_FRAME])
9117                 return -EINVAL;
9118
9119         if (!rdev->ops->mgmt_tx)
9120                 return -EOPNOTSUPP;
9121
9122         switch (wdev->iftype) {
9123         case NL80211_IFTYPE_P2P_DEVICE:
9124                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
9125                         return -EINVAL;
9126         case NL80211_IFTYPE_STATION:
9127         case NL80211_IFTYPE_ADHOC:
9128         case NL80211_IFTYPE_P2P_CLIENT:
9129         case NL80211_IFTYPE_AP:
9130         case NL80211_IFTYPE_AP_VLAN:
9131         case NL80211_IFTYPE_MESH_POINT:
9132         case NL80211_IFTYPE_P2P_GO:
9133                 break;
9134         case NL80211_IFTYPE_NAN:
9135         default:
9136                 return -EOPNOTSUPP;
9137         }
9138
9139         if (info->attrs[NL80211_ATTR_DURATION]) {
9140                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
9141                         return -EINVAL;
9142                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
9143
9144                 /*
9145                  * We should wait on the channel for at least a minimum amount
9146                  * of time (10ms) but no longer than the driver supports.
9147                  */
9148                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
9149                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
9150                         return -EINVAL;
9151         }
9152
9153         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
9154
9155         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
9156                 return -EINVAL;
9157
9158         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
9159
9160         /* get the channel if any has been specified, otherwise pass NULL to
9161          * the driver. The latter will use the current one
9162          */
9163         chandef.chan = NULL;
9164         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9165                 err = nl80211_parse_chandef(rdev, info, &chandef);
9166                 if (err)
9167                         return err;
9168         }
9169
9170         if (!chandef.chan && params.offchan)
9171                 return -EINVAL;
9172
9173         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
9174         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
9175
9176         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
9177                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
9178                 int i;
9179
9180                 if (len % sizeof(u16))
9181                         return -EINVAL;
9182
9183                 params.n_csa_offsets = len / sizeof(u16);
9184                 params.csa_offsets =
9185                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
9186
9187                 /* check that all the offsets fit the frame */
9188                 for (i = 0; i < params.n_csa_offsets; i++) {
9189                         if (params.csa_offsets[i] >= params.len)
9190                                 return -EINVAL;
9191                 }
9192         }
9193
9194         if (!params.dont_wait_for_ack) {
9195                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9196                 if (!msg)
9197                         return -ENOMEM;
9198
9199                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9200                                      NL80211_CMD_FRAME);
9201                 if (!hdr) {
9202                         err = -ENOBUFS;
9203                         goto free_msg;
9204                 }
9205         }
9206
9207         params.chan = chandef.chan;
9208         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
9209         if (err)
9210                 goto free_msg;
9211
9212         if (msg) {
9213                 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
9214                                       NL80211_ATTR_PAD))
9215                         goto nla_put_failure;
9216
9217                 genlmsg_end(msg, hdr);
9218                 return genlmsg_reply(msg, info);
9219         }
9220
9221         return 0;
9222
9223  nla_put_failure:
9224         err = -ENOBUFS;
9225  free_msg:
9226         nlmsg_free(msg);
9227         return err;
9228 }
9229
9230 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
9231 {
9232         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9233         struct wireless_dev *wdev = info->user_ptr[1];
9234         u64 cookie;
9235
9236         if (!info->attrs[NL80211_ATTR_COOKIE])
9237                 return -EINVAL;
9238
9239         if (!rdev->ops->mgmt_tx_cancel_wait)
9240                 return -EOPNOTSUPP;
9241
9242         switch (wdev->iftype) {
9243         case NL80211_IFTYPE_STATION:
9244         case NL80211_IFTYPE_ADHOC:
9245         case NL80211_IFTYPE_P2P_CLIENT:
9246         case NL80211_IFTYPE_AP:
9247         case NL80211_IFTYPE_AP_VLAN:
9248         case NL80211_IFTYPE_P2P_GO:
9249         case NL80211_IFTYPE_P2P_DEVICE:
9250                 break;
9251         case NL80211_IFTYPE_NAN:
9252         default:
9253                 return -EOPNOTSUPP;
9254         }
9255
9256         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9257
9258         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
9259 }
9260
9261 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
9262 {
9263         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9264         struct wireless_dev *wdev;
9265         struct net_device *dev = info->user_ptr[1];
9266         u8 ps_state;
9267         bool state;
9268         int err;
9269
9270         if (!info->attrs[NL80211_ATTR_PS_STATE])
9271                 return -EINVAL;
9272
9273         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
9274
9275         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
9276                 return -EINVAL;
9277
9278         wdev = dev->ieee80211_ptr;
9279
9280         if (!rdev->ops->set_power_mgmt)
9281                 return -EOPNOTSUPP;
9282
9283         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
9284
9285         if (state == wdev->ps)
9286                 return 0;
9287
9288         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
9289         if (!err)
9290                 wdev->ps = state;
9291         return err;
9292 }
9293
9294 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
9295 {
9296         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9297         enum nl80211_ps_state ps_state;
9298         struct wireless_dev *wdev;
9299         struct net_device *dev = info->user_ptr[1];
9300         struct sk_buff *msg;
9301         void *hdr;
9302         int err;
9303
9304         wdev = dev->ieee80211_ptr;
9305
9306         if (!rdev->ops->set_power_mgmt)
9307                 return -EOPNOTSUPP;
9308
9309         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9310         if (!msg)
9311                 return -ENOMEM;
9312
9313         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9314                              NL80211_CMD_GET_POWER_SAVE);
9315         if (!hdr) {
9316                 err = -ENOBUFS;
9317                 goto free_msg;
9318         }
9319
9320         if (wdev->ps)
9321                 ps_state = NL80211_PS_ENABLED;
9322         else
9323                 ps_state = NL80211_PS_DISABLED;
9324
9325         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
9326                 goto nla_put_failure;
9327
9328         genlmsg_end(msg, hdr);
9329         return genlmsg_reply(msg, info);
9330
9331  nla_put_failure:
9332         err = -ENOBUFS;
9333  free_msg:
9334         nlmsg_free(msg);
9335         return err;
9336 }
9337
9338 static const struct nla_policy
9339 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
9340         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
9341         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
9342         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
9343         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
9344         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
9345         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
9346 };
9347
9348 static int nl80211_set_cqm_txe(struct genl_info *info,
9349                                u32 rate, u32 pkts, u32 intvl)
9350 {
9351         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9352         struct net_device *dev = info->user_ptr[1];
9353         struct wireless_dev *wdev = dev->ieee80211_ptr;
9354
9355         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
9356                 return -EINVAL;
9357
9358         if (!rdev->ops->set_cqm_txe_config)
9359                 return -EOPNOTSUPP;
9360
9361         if (wdev->iftype != NL80211_IFTYPE_STATION &&
9362             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
9363                 return -EOPNOTSUPP;
9364
9365         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
9366 }
9367
9368 static int nl80211_set_cqm_rssi(struct genl_info *info,
9369                                 s32 threshold, u32 hysteresis)
9370 {
9371         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9372         struct net_device *dev = info->user_ptr[1];
9373         struct wireless_dev *wdev = dev->ieee80211_ptr;
9374
9375         if (threshold > 0)
9376                 return -EINVAL;
9377
9378         /* disabling - hysteresis should also be zero then */
9379         if (threshold == 0)
9380                 hysteresis = 0;
9381
9382         if (!rdev->ops->set_cqm_rssi_config)
9383                 return -EOPNOTSUPP;
9384
9385         if (wdev->iftype != NL80211_IFTYPE_STATION &&
9386             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
9387                 return -EOPNOTSUPP;
9388
9389         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
9390 }
9391
9392 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
9393 {
9394         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
9395         struct nlattr *cqm;
9396         int err;
9397
9398         cqm = info->attrs[NL80211_ATTR_CQM];
9399         if (!cqm)
9400                 return -EINVAL;
9401
9402         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
9403                                nl80211_attr_cqm_policy);
9404         if (err)
9405                 return err;
9406
9407         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
9408             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
9409                 s32 threshold = nla_get_s32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
9410                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
9411
9412                 return nl80211_set_cqm_rssi(info, threshold, hysteresis);
9413         }
9414
9415         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
9416             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
9417             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
9418                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
9419                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
9420                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
9421
9422                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
9423         }
9424
9425         return -EINVAL;
9426 }
9427
9428 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
9429 {
9430         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9431         struct net_device *dev = info->user_ptr[1];
9432         struct ocb_setup setup = {};
9433         int err;
9434
9435         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
9436         if (err)
9437                 return err;
9438
9439         return cfg80211_join_ocb(rdev, dev, &setup);
9440 }
9441
9442 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
9443 {
9444         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9445         struct net_device *dev = info->user_ptr[1];
9446
9447         return cfg80211_leave_ocb(rdev, dev);
9448 }
9449
9450 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
9451 {
9452         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9453         struct net_device *dev = info->user_ptr[1];
9454         struct mesh_config cfg;
9455         struct mesh_setup setup;
9456         int err;
9457
9458         /* start with default */
9459         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
9460         memcpy(&setup, &default_mesh_setup, sizeof(setup));
9461
9462         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
9463                 /* and parse parameters if given */
9464                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
9465                 if (err)
9466                         return err;
9467         }
9468
9469         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
9470             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
9471                 return -EINVAL;
9472
9473         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
9474         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
9475
9476         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
9477             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
9478                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
9479                         return -EINVAL;
9480
9481         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
9482                 setup.beacon_interval =
9483                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
9484
9485                 err = cfg80211_validate_beacon_int(rdev, setup.beacon_interval);
9486                 if (err)
9487                         return err;
9488         }
9489
9490         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
9491                 setup.dtim_period =
9492                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
9493                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
9494                         return -EINVAL;
9495         }
9496
9497         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
9498                 /* parse additional setup parameters if given */
9499                 err = nl80211_parse_mesh_setup(info, &setup);
9500                 if (err)
9501                         return err;
9502         }
9503
9504         if (setup.user_mpm)
9505                 cfg.auto_open_plinks = false;
9506
9507         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9508                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
9509                 if (err)
9510                         return err;
9511         } else {
9512                 /* cfg80211_join_mesh() will sort it out */
9513                 setup.chandef.chan = NULL;
9514         }
9515
9516         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
9517                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9518                 int n_rates =
9519                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9520                 struct ieee80211_supported_band *sband;
9521
9522                 if (!setup.chandef.chan)
9523                         return -EINVAL;
9524
9525                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
9526
9527                 err = ieee80211_get_ratemask(sband, rates, n_rates,
9528                                              &setup.basic_rates);
9529                 if (err)
9530                         return err;
9531         }
9532
9533         if (info->attrs[NL80211_ATTR_TX_RATES]) {
9534                 err = nl80211_parse_tx_bitrate_mask(info, &setup.beacon_rate);
9535                 if (err)
9536                         return err;
9537
9538                 if (!setup.chandef.chan)
9539                         return -EINVAL;
9540
9541                 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
9542                                               &setup.beacon_rate);
9543                 if (err)
9544                         return err;
9545         }
9546
9547         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
9548 }
9549
9550 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
9551 {
9552         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9553         struct net_device *dev = info->user_ptr[1];
9554
9555         return cfg80211_leave_mesh(rdev, dev);
9556 }
9557
9558 #ifdef CONFIG_PM
9559 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
9560                                         struct cfg80211_registered_device *rdev)
9561 {
9562         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
9563         struct nlattr *nl_pats, *nl_pat;
9564         int i, pat_len;
9565
9566         if (!wowlan->n_patterns)
9567                 return 0;
9568
9569         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
9570         if (!nl_pats)
9571                 return -ENOBUFS;
9572
9573         for (i = 0; i < wowlan->n_patterns; i++) {
9574                 nl_pat = nla_nest_start(msg, i + 1);
9575                 if (!nl_pat)
9576                         return -ENOBUFS;
9577                 pat_len = wowlan->patterns[i].pattern_len;
9578                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
9579                             wowlan->patterns[i].mask) ||
9580                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
9581                             wowlan->patterns[i].pattern) ||
9582                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
9583                                 wowlan->patterns[i].pkt_offset))
9584                         return -ENOBUFS;
9585                 nla_nest_end(msg, nl_pat);
9586         }
9587         nla_nest_end(msg, nl_pats);
9588
9589         return 0;
9590 }
9591
9592 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
9593                                    struct cfg80211_wowlan_tcp *tcp)
9594 {
9595         struct nlattr *nl_tcp;
9596
9597         if (!tcp)
9598                 return 0;
9599
9600         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
9601         if (!nl_tcp)
9602                 return -ENOBUFS;
9603
9604         if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
9605             nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
9606             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
9607             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
9608             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
9609             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
9610                     tcp->payload_len, tcp->payload) ||
9611             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
9612                         tcp->data_interval) ||
9613             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
9614                     tcp->wake_len, tcp->wake_data) ||
9615             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
9616                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
9617                 return -ENOBUFS;
9618
9619         if (tcp->payload_seq.len &&
9620             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
9621                     sizeof(tcp->payload_seq), &tcp->payload_seq))
9622                 return -ENOBUFS;
9623
9624         if (tcp->payload_tok.len &&
9625             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
9626                     sizeof(tcp->payload_tok) + tcp->tokens_size,
9627                     &tcp->payload_tok))
9628                 return -ENOBUFS;
9629
9630         nla_nest_end(msg, nl_tcp);
9631
9632         return 0;
9633 }
9634
9635 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
9636                                   struct cfg80211_sched_scan_request *req)
9637 {
9638         struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
9639         int i;
9640
9641         if (!req)
9642                 return 0;
9643
9644         nd = nla_nest_start(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
9645         if (!nd)
9646                 return -ENOBUFS;
9647
9648         if (req->n_scan_plans == 1 &&
9649             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
9650                         req->scan_plans[0].interval * 1000))
9651                 return -ENOBUFS;
9652
9653         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
9654                 return -ENOBUFS;
9655
9656         freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
9657         if (!freqs)
9658                 return -ENOBUFS;
9659
9660         for (i = 0; i < req->n_channels; i++) {
9661                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
9662                         return -ENOBUFS;
9663         }
9664
9665         nla_nest_end(msg, freqs);
9666
9667         if (req->n_match_sets) {
9668                 matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
9669                 if (!matches)
9670                         return -ENOBUFS;
9671
9672                 for (i = 0; i < req->n_match_sets; i++) {
9673                         match = nla_nest_start(msg, i);
9674                         if (!match)
9675                                 return -ENOBUFS;
9676
9677                         if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
9678                                     req->match_sets[i].ssid.ssid_len,
9679                                     req->match_sets[i].ssid.ssid))
9680                                 return -ENOBUFS;
9681                         nla_nest_end(msg, match);
9682                 }
9683                 nla_nest_end(msg, matches);
9684         }
9685
9686         scan_plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
9687         if (!scan_plans)
9688                 return -ENOBUFS;
9689
9690         for (i = 0; i < req->n_scan_plans; i++) {
9691                 scan_plan = nla_nest_start(msg, i + 1);
9692                 if (!scan_plan)
9693                         return -ENOBUFS;
9694
9695                 if (!scan_plan ||
9696                     nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
9697                                 req->scan_plans[i].interval) ||
9698                     (req->scan_plans[i].iterations &&
9699                      nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
9700                                  req->scan_plans[i].iterations)))
9701                         return -ENOBUFS;
9702                 nla_nest_end(msg, scan_plan);
9703         }
9704         nla_nest_end(msg, scan_plans);
9705
9706         nla_nest_end(msg, nd);
9707
9708         return 0;
9709 }
9710
9711 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
9712 {
9713         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9714         struct sk_buff *msg;
9715         void *hdr;
9716         u32 size = NLMSG_DEFAULT_SIZE;
9717
9718         if (!rdev->wiphy.wowlan)
9719                 return -EOPNOTSUPP;
9720
9721         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
9722                 /* adjust size to have room for all the data */
9723                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
9724                         rdev->wiphy.wowlan_config->tcp->payload_len +
9725                         rdev->wiphy.wowlan_config->tcp->wake_len +
9726                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
9727         }
9728
9729         msg = nlmsg_new(size, GFP_KERNEL);
9730         if (!msg)
9731                 return -ENOMEM;
9732
9733         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9734                              NL80211_CMD_GET_WOWLAN);
9735         if (!hdr)
9736                 goto nla_put_failure;
9737
9738         if (rdev->wiphy.wowlan_config) {
9739                 struct nlattr *nl_wowlan;
9740
9741                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
9742                 if (!nl_wowlan)
9743                         goto nla_put_failure;
9744
9745                 if ((rdev->wiphy.wowlan_config->any &&
9746                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
9747                     (rdev->wiphy.wowlan_config->disconnect &&
9748                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
9749                     (rdev->wiphy.wowlan_config->magic_pkt &&
9750                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
9751                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
9752                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
9753                     (rdev->wiphy.wowlan_config->eap_identity_req &&
9754                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
9755                     (rdev->wiphy.wowlan_config->four_way_handshake &&
9756                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
9757                     (rdev->wiphy.wowlan_config->rfkill_release &&
9758                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
9759                         goto nla_put_failure;
9760
9761                 if (nl80211_send_wowlan_patterns(msg, rdev))
9762                         goto nla_put_failure;
9763
9764                 if (nl80211_send_wowlan_tcp(msg,
9765                                             rdev->wiphy.wowlan_config->tcp))
9766                         goto nla_put_failure;
9767
9768                 if (nl80211_send_wowlan_nd(
9769                             msg,
9770                             rdev->wiphy.wowlan_config->nd_config))
9771                         goto nla_put_failure;
9772
9773                 nla_nest_end(msg, nl_wowlan);
9774         }
9775
9776         genlmsg_end(msg, hdr);
9777         return genlmsg_reply(msg, info);
9778
9779 nla_put_failure:
9780         nlmsg_free(msg);
9781         return -ENOBUFS;
9782 }
9783
9784 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
9785                                     struct nlattr *attr,
9786                                     struct cfg80211_wowlan *trig)
9787 {
9788         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
9789         struct cfg80211_wowlan_tcp *cfg;
9790         struct nl80211_wowlan_tcp_data_token *tok = NULL;
9791         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
9792         u32 size;
9793         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
9794         int err, port;
9795
9796         if (!rdev->wiphy.wowlan->tcp)
9797                 return -EINVAL;
9798
9799         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
9800                         nla_data(attr), nla_len(attr),
9801                         nl80211_wowlan_tcp_policy);
9802         if (err)
9803                 return err;
9804
9805         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
9806             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
9807             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
9808             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
9809             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
9810             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
9811             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
9812             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
9813                 return -EINVAL;
9814
9815         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
9816         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
9817                 return -EINVAL;
9818
9819         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
9820                         rdev->wiphy.wowlan->tcp->data_interval_max ||
9821             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
9822                 return -EINVAL;
9823
9824         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
9825         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
9826                 return -EINVAL;
9827
9828         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
9829         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
9830                 return -EINVAL;
9831
9832         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
9833                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
9834
9835                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
9836                 tokens_size = tokln - sizeof(*tok);
9837
9838                 if (!tok->len || tokens_size % tok->len)
9839                         return -EINVAL;
9840                 if (!rdev->wiphy.wowlan->tcp->tok)
9841                         return -EINVAL;
9842                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
9843                         return -EINVAL;
9844                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
9845                         return -EINVAL;
9846                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
9847                         return -EINVAL;
9848                 if (tok->offset + tok->len > data_size)
9849                         return -EINVAL;
9850         }
9851
9852         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
9853                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
9854                 if (!rdev->wiphy.wowlan->tcp->seq)
9855                         return -EINVAL;
9856                 if (seq->len == 0 || seq->len > 4)
9857                         return -EINVAL;
9858                 if (seq->len + seq->offset > data_size)
9859                         return -EINVAL;
9860         }
9861
9862         size = sizeof(*cfg);
9863         size += data_size;
9864         size += wake_size + wake_mask_size;
9865         size += tokens_size;
9866
9867         cfg = kzalloc(size, GFP_KERNEL);
9868         if (!cfg)
9869                 return -ENOMEM;
9870         cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
9871         cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
9872         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
9873                ETH_ALEN);
9874         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
9875                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
9876         else
9877                 port = 0;
9878 #ifdef CONFIG_INET
9879         /* allocate a socket and port for it and use it */
9880         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
9881                             IPPROTO_TCP, &cfg->sock, 1);
9882         if (err) {
9883                 kfree(cfg);
9884                 return err;
9885         }
9886         if (inet_csk_get_port(cfg->sock->sk, port)) {
9887                 sock_release(cfg->sock);
9888                 kfree(cfg);
9889                 return -EADDRINUSE;
9890         }
9891         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
9892 #else
9893         if (!port) {
9894                 kfree(cfg);
9895                 return -EINVAL;
9896         }
9897         cfg->src_port = port;
9898 #endif
9899
9900         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
9901         cfg->payload_len = data_size;
9902         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
9903         memcpy((void *)cfg->payload,
9904                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
9905                data_size);
9906         if (seq)
9907                 cfg->payload_seq = *seq;
9908         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
9909         cfg->wake_len = wake_size;
9910         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
9911         memcpy((void *)cfg->wake_data,
9912                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
9913                wake_size);
9914         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
9915                          data_size + wake_size;
9916         memcpy((void *)cfg->wake_mask,
9917                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
9918                wake_mask_size);
9919         if (tok) {
9920                 cfg->tokens_size = tokens_size;
9921                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
9922         }
9923
9924         trig->tcp = cfg;
9925
9926         return 0;
9927 }
9928
9929 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
9930                                    const struct wiphy_wowlan_support *wowlan,
9931                                    struct nlattr *attr,
9932                                    struct cfg80211_wowlan *trig)
9933 {
9934         struct nlattr **tb;
9935         int err;
9936
9937         tb = kzalloc(NUM_NL80211_ATTR * sizeof(*tb), GFP_KERNEL);
9938         if (!tb)
9939                 return -ENOMEM;
9940
9941         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
9942                 err = -EOPNOTSUPP;
9943                 goto out;
9944         }
9945
9946         err = nla_parse(tb, NL80211_ATTR_MAX,
9947                         nla_data(attr), nla_len(attr),
9948                         nl80211_policy);
9949         if (err)
9950                 goto out;
9951
9952         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb);
9953         err = PTR_ERR_OR_ZERO(trig->nd_config);
9954         if (err)
9955                 trig->nd_config = NULL;
9956
9957 out:
9958         kfree(tb);
9959         return err;
9960 }
9961
9962 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
9963 {
9964         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9965         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
9966         struct cfg80211_wowlan new_triggers = {};
9967         struct cfg80211_wowlan *ntrig;
9968         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
9969         int err, i;
9970         bool prev_enabled = rdev->wiphy.wowlan_config;
9971         bool regular = false;
9972
9973         if (!wowlan)
9974                 return -EOPNOTSUPP;
9975
9976         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
9977                 cfg80211_rdev_free_wowlan(rdev);
9978                 rdev->wiphy.wowlan_config = NULL;
9979                 goto set_wakeup;
9980         }
9981
9982         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
9983                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
9984                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
9985                         nl80211_wowlan_policy);
9986         if (err)
9987                 return err;
9988
9989         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
9990                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
9991                         return -EINVAL;
9992                 new_triggers.any = true;
9993         }
9994
9995         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
9996                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
9997                         return -EINVAL;
9998                 new_triggers.disconnect = true;
9999                 regular = true;
10000         }
10001
10002         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
10003                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
10004                         return -EINVAL;
10005                 new_triggers.magic_pkt = true;
10006                 regular = true;
10007         }
10008
10009         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
10010                 return -EINVAL;
10011
10012         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
10013                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
10014                         return -EINVAL;
10015                 new_triggers.gtk_rekey_failure = true;
10016                 regular = true;
10017         }
10018
10019         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
10020                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
10021                         return -EINVAL;
10022                 new_triggers.eap_identity_req = true;
10023                 regular = true;
10024         }
10025
10026         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
10027                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
10028                         return -EINVAL;
10029                 new_triggers.four_way_handshake = true;
10030                 regular = true;
10031         }
10032
10033         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
10034                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
10035                         return -EINVAL;
10036                 new_triggers.rfkill_release = true;
10037                 regular = true;
10038         }
10039
10040         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
10041                 struct nlattr *pat;
10042                 int n_patterns = 0;
10043                 int rem, pat_len, mask_len, pkt_offset;
10044                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
10045
10046                 regular = true;
10047
10048                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
10049                                     rem)
10050                         n_patterns++;
10051                 if (n_patterns > wowlan->n_patterns)
10052                         return -EINVAL;
10053
10054                 new_triggers.patterns = kcalloc(n_patterns,
10055                                                 sizeof(new_triggers.patterns[0]),
10056                                                 GFP_KERNEL);
10057                 if (!new_triggers.patterns)
10058                         return -ENOMEM;
10059
10060                 new_triggers.n_patterns = n_patterns;
10061                 i = 0;
10062
10063                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
10064                                     rem) {
10065                         u8 *mask_pat;
10066
10067                         nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
10068                                   nla_len(pat), nl80211_packet_pattern_policy);
10069                         err = -EINVAL;
10070                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
10071                             !pat_tb[NL80211_PKTPAT_PATTERN])
10072                                 goto error;
10073                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
10074                         mask_len = DIV_ROUND_UP(pat_len, 8);
10075                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
10076                                 goto error;
10077                         if (pat_len > wowlan->pattern_max_len ||
10078                             pat_len < wowlan->pattern_min_len)
10079                                 goto error;
10080
10081                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
10082                                 pkt_offset = 0;
10083                         else
10084                                 pkt_offset = nla_get_u32(
10085                                         pat_tb[NL80211_PKTPAT_OFFSET]);
10086                         if (pkt_offset > wowlan->max_pkt_offset)
10087                                 goto error;
10088                         new_triggers.patterns[i].pkt_offset = pkt_offset;
10089
10090                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
10091                         if (!mask_pat) {
10092                                 err = -ENOMEM;
10093                                 goto error;
10094                         }
10095                         new_triggers.patterns[i].mask = mask_pat;
10096                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
10097                                mask_len);
10098                         mask_pat += mask_len;
10099                         new_triggers.patterns[i].pattern = mask_pat;
10100                         new_triggers.patterns[i].pattern_len = pat_len;
10101                         memcpy(mask_pat,
10102                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
10103                                pat_len);
10104                         i++;
10105                 }
10106         }
10107
10108         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
10109                 regular = true;
10110                 err = nl80211_parse_wowlan_tcp(
10111                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
10112                         &new_triggers);
10113                 if (err)
10114                         goto error;
10115         }
10116
10117         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
10118                 regular = true;
10119                 err = nl80211_parse_wowlan_nd(
10120                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
10121                         &new_triggers);
10122                 if (err)
10123                         goto error;
10124         }
10125
10126         /* The 'any' trigger means the device continues operating more or less
10127          * as in its normal operation mode and wakes up the host on most of the
10128          * normal interrupts (like packet RX, ...)
10129          * It therefore makes little sense to combine with the more constrained
10130          * wakeup trigger modes.
10131          */
10132         if (new_triggers.any && regular) {
10133                 err = -EINVAL;
10134                 goto error;
10135         }
10136
10137         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
10138         if (!ntrig) {
10139                 err = -ENOMEM;
10140                 goto error;
10141         }
10142         cfg80211_rdev_free_wowlan(rdev);
10143         rdev->wiphy.wowlan_config = ntrig;
10144
10145  set_wakeup:
10146         if (rdev->ops->set_wakeup &&
10147             prev_enabled != !!rdev->wiphy.wowlan_config)
10148                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
10149
10150         return 0;
10151  error:
10152         for (i = 0; i < new_triggers.n_patterns; i++)
10153                 kfree(new_triggers.patterns[i].mask);
10154         kfree(new_triggers.patterns);
10155         if (new_triggers.tcp && new_triggers.tcp->sock)
10156                 sock_release(new_triggers.tcp->sock);
10157         kfree(new_triggers.tcp);
10158         kfree(new_triggers.nd_config);
10159         return err;
10160 }
10161 #endif
10162
10163 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
10164                                        struct cfg80211_registered_device *rdev)
10165 {
10166         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
10167         int i, j, pat_len;
10168         struct cfg80211_coalesce_rules *rule;
10169
10170         if (!rdev->coalesce->n_rules)
10171                 return 0;
10172
10173         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
10174         if (!nl_rules)
10175                 return -ENOBUFS;
10176
10177         for (i = 0; i < rdev->coalesce->n_rules; i++) {
10178                 nl_rule = nla_nest_start(msg, i + 1);
10179                 if (!nl_rule)
10180                         return -ENOBUFS;
10181
10182                 rule = &rdev->coalesce->rules[i];
10183                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
10184                                 rule->delay))
10185                         return -ENOBUFS;
10186
10187                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
10188                                 rule->condition))
10189                         return -ENOBUFS;
10190
10191                 nl_pats = nla_nest_start(msg,
10192                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
10193                 if (!nl_pats)
10194                         return -ENOBUFS;
10195
10196                 for (j = 0; j < rule->n_patterns; j++) {
10197                         nl_pat = nla_nest_start(msg, j + 1);
10198                         if (!nl_pat)
10199                                 return -ENOBUFS;
10200                         pat_len = rule->patterns[j].pattern_len;
10201                         if (nla_put(msg, NL80211_PKTPAT_MASK,
10202                                     DIV_ROUND_UP(pat_len, 8),
10203                                     rule->patterns[j].mask) ||
10204                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
10205                                     rule->patterns[j].pattern) ||
10206                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
10207                                         rule->patterns[j].pkt_offset))
10208                                 return -ENOBUFS;
10209                         nla_nest_end(msg, nl_pat);
10210                 }
10211                 nla_nest_end(msg, nl_pats);
10212                 nla_nest_end(msg, nl_rule);
10213         }
10214         nla_nest_end(msg, nl_rules);
10215
10216         return 0;
10217 }
10218
10219 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
10220 {
10221         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10222         struct sk_buff *msg;
10223         void *hdr;
10224
10225         if (!rdev->wiphy.coalesce)
10226                 return -EOPNOTSUPP;
10227
10228         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10229         if (!msg)
10230                 return -ENOMEM;
10231
10232         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10233                              NL80211_CMD_GET_COALESCE);
10234         if (!hdr)
10235                 goto nla_put_failure;
10236
10237         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
10238                 goto nla_put_failure;
10239
10240         genlmsg_end(msg, hdr);
10241         return genlmsg_reply(msg, info);
10242
10243 nla_put_failure:
10244         nlmsg_free(msg);
10245         return -ENOBUFS;
10246 }
10247
10248 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
10249 {
10250         struct cfg80211_coalesce *coalesce = rdev->coalesce;
10251         int i, j;
10252         struct cfg80211_coalesce_rules *rule;
10253
10254         if (!coalesce)
10255                 return;
10256
10257         for (i = 0; i < coalesce->n_rules; i++) {
10258                 rule = &coalesce->rules[i];
10259                 for (j = 0; j < rule->n_patterns; j++)
10260                         kfree(rule->patterns[j].mask);
10261                 kfree(rule->patterns);
10262         }
10263         kfree(coalesce->rules);
10264         kfree(coalesce);
10265         rdev->coalesce = NULL;
10266 }
10267
10268 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
10269                                        struct nlattr *rule,
10270                                        struct cfg80211_coalesce_rules *new_rule)
10271 {
10272         int err, i;
10273         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
10274         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
10275         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
10276         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
10277
10278         err = nla_parse(tb, NL80211_ATTR_COALESCE_RULE_MAX, nla_data(rule),
10279                         nla_len(rule), nl80211_coalesce_policy);
10280         if (err)
10281                 return err;
10282
10283         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
10284                 new_rule->delay =
10285                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
10286         if (new_rule->delay > coalesce->max_delay)
10287                 return -EINVAL;
10288
10289         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
10290                 new_rule->condition =
10291                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
10292         if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
10293             new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
10294                 return -EINVAL;
10295
10296         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
10297                 return -EINVAL;
10298
10299         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
10300                             rem)
10301                 n_patterns++;
10302         if (n_patterns > coalesce->n_patterns)
10303                 return -EINVAL;
10304
10305         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
10306                                      GFP_KERNEL);
10307         if (!new_rule->patterns)
10308                 return -ENOMEM;
10309
10310         new_rule->n_patterns = n_patterns;
10311         i = 0;
10312
10313         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
10314                             rem) {
10315                 u8 *mask_pat;
10316
10317                 nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
10318                           nla_len(pat), nl80211_packet_pattern_policy);
10319                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
10320                     !pat_tb[NL80211_PKTPAT_PATTERN])
10321                         return -EINVAL;
10322                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
10323                 mask_len = DIV_ROUND_UP(pat_len, 8);
10324                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
10325                         return -EINVAL;
10326                 if (pat_len > coalesce->pattern_max_len ||
10327                     pat_len < coalesce->pattern_min_len)
10328                         return -EINVAL;
10329
10330                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
10331                         pkt_offset = 0;
10332                 else
10333                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
10334                 if (pkt_offset > coalesce->max_pkt_offset)
10335                         return -EINVAL;
10336                 new_rule->patterns[i].pkt_offset = pkt_offset;
10337
10338                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
10339                 if (!mask_pat)
10340                         return -ENOMEM;
10341
10342                 new_rule->patterns[i].mask = mask_pat;
10343                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
10344                        mask_len);
10345
10346                 mask_pat += mask_len;
10347                 new_rule->patterns[i].pattern = mask_pat;
10348                 new_rule->patterns[i].pattern_len = pat_len;
10349                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
10350                        pat_len);
10351                 i++;
10352         }
10353
10354         return 0;
10355 }
10356
10357 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
10358 {
10359         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10360         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
10361         struct cfg80211_coalesce new_coalesce = {};
10362         struct cfg80211_coalesce *n_coalesce;
10363         int err, rem_rule, n_rules = 0, i, j;
10364         struct nlattr *rule;
10365         struct cfg80211_coalesce_rules *tmp_rule;
10366
10367         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
10368                 return -EOPNOTSUPP;
10369
10370         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
10371                 cfg80211_rdev_free_coalesce(rdev);
10372                 rdev_set_coalesce(rdev, NULL);
10373                 return 0;
10374         }
10375
10376         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
10377                             rem_rule)
10378                 n_rules++;
10379         if (n_rules > coalesce->n_rules)
10380                 return -EINVAL;
10381
10382         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
10383                                      GFP_KERNEL);
10384         if (!new_coalesce.rules)
10385                 return -ENOMEM;
10386
10387         new_coalesce.n_rules = n_rules;
10388         i = 0;
10389
10390         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
10391                             rem_rule) {
10392                 err = nl80211_parse_coalesce_rule(rdev, rule,
10393                                                   &new_coalesce.rules[i]);
10394                 if (err)
10395                         goto error;
10396
10397                 i++;
10398         }
10399
10400         err = rdev_set_coalesce(rdev, &new_coalesce);
10401         if (err)
10402                 goto error;
10403
10404         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
10405         if (!n_coalesce) {
10406                 err = -ENOMEM;
10407                 goto error;
10408         }
10409         cfg80211_rdev_free_coalesce(rdev);
10410         rdev->coalesce = n_coalesce;
10411
10412         return 0;
10413 error:
10414         for (i = 0; i < new_coalesce.n_rules; i++) {
10415                 tmp_rule = &new_coalesce.rules[i];
10416                 for (j = 0; j < tmp_rule->n_patterns; j++)
10417                         kfree(tmp_rule->patterns[j].mask);
10418                 kfree(tmp_rule->patterns);
10419         }
10420         kfree(new_coalesce.rules);
10421
10422         return err;
10423 }
10424
10425 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
10426 {
10427         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10428         struct net_device *dev = info->user_ptr[1];
10429         struct wireless_dev *wdev = dev->ieee80211_ptr;
10430         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
10431         struct cfg80211_gtk_rekey_data rekey_data = {};
10432         int err;
10433
10434         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
10435                 return -EINVAL;
10436
10437         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
10438                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
10439                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
10440                         nl80211_rekey_policy);
10441         if (err)
10442                 return err;
10443
10444         if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
10445             !tb[NL80211_REKEY_DATA_KCK])
10446                 return -EINVAL;
10447         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
10448                 return -ERANGE;
10449         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
10450                 return -ERANGE;
10451         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
10452                 return -ERANGE;
10453
10454         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
10455         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
10456         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
10457
10458         wdev_lock(wdev);
10459         if (!wdev->current_bss) {
10460                 err = -ENOTCONN;
10461                 goto out;
10462         }
10463
10464         if (!rdev->ops->set_rekey_data) {
10465                 err = -EOPNOTSUPP;
10466                 goto out;
10467         }
10468
10469         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
10470  out:
10471         wdev_unlock(wdev);
10472         return err;
10473 }
10474
10475 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
10476                                              struct genl_info *info)
10477 {
10478         struct net_device *dev = info->user_ptr[1];
10479         struct wireless_dev *wdev = dev->ieee80211_ptr;
10480
10481         if (wdev->iftype != NL80211_IFTYPE_AP &&
10482             wdev->iftype != NL80211_IFTYPE_P2P_GO)
10483                 return -EINVAL;
10484
10485         if (wdev->ap_unexpected_nlportid)
10486                 return -EBUSY;
10487
10488         wdev->ap_unexpected_nlportid = info->snd_portid;
10489         return 0;
10490 }
10491
10492 static int nl80211_probe_client(struct sk_buff *skb,
10493                                 struct genl_info *info)
10494 {
10495         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10496         struct net_device *dev = info->user_ptr[1];
10497         struct wireless_dev *wdev = dev->ieee80211_ptr;
10498         struct sk_buff *msg;
10499         void *hdr;
10500         const u8 *addr;
10501         u64 cookie;
10502         int err;
10503
10504         if (wdev->iftype != NL80211_IFTYPE_AP &&
10505             wdev->iftype != NL80211_IFTYPE_P2P_GO)
10506                 return -EOPNOTSUPP;
10507
10508         if (!info->attrs[NL80211_ATTR_MAC])
10509                 return -EINVAL;
10510
10511         if (!rdev->ops->probe_client)
10512                 return -EOPNOTSUPP;
10513
10514         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10515         if (!msg)
10516                 return -ENOMEM;
10517
10518         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10519                              NL80211_CMD_PROBE_CLIENT);
10520         if (!hdr) {
10521                 err = -ENOBUFS;
10522                 goto free_msg;
10523         }
10524
10525         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
10526
10527         err = rdev_probe_client(rdev, dev, addr, &cookie);
10528         if (err)
10529                 goto free_msg;
10530
10531         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
10532                               NL80211_ATTR_PAD))
10533                 goto nla_put_failure;
10534
10535         genlmsg_end(msg, hdr);
10536
10537         return genlmsg_reply(msg, info);
10538
10539  nla_put_failure:
10540         err = -ENOBUFS;
10541  free_msg:
10542         nlmsg_free(msg);
10543         return err;
10544 }
10545
10546 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
10547 {
10548         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10549         struct cfg80211_beacon_registration *reg, *nreg;
10550         int rv;
10551
10552         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
10553                 return -EOPNOTSUPP;
10554
10555         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
10556         if (!nreg)
10557                 return -ENOMEM;
10558
10559         /* First, check if already registered. */
10560         spin_lock_bh(&rdev->beacon_registrations_lock);
10561         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
10562                 if (reg->nlportid == info->snd_portid) {
10563                         rv = -EALREADY;
10564                         goto out_err;
10565                 }
10566         }
10567         /* Add it to the list */
10568         nreg->nlportid = info->snd_portid;
10569         list_add(&nreg->list, &rdev->beacon_registrations);
10570
10571         spin_unlock_bh(&rdev->beacon_registrations_lock);
10572
10573         return 0;
10574 out_err:
10575         spin_unlock_bh(&rdev->beacon_registrations_lock);
10576         kfree(nreg);
10577         return rv;
10578 }
10579
10580 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
10581 {
10582         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10583         struct wireless_dev *wdev = info->user_ptr[1];
10584         int err;
10585
10586         if (!rdev->ops->start_p2p_device)
10587                 return -EOPNOTSUPP;
10588
10589         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
10590                 return -EOPNOTSUPP;
10591
10592         if (wdev->p2p_started)
10593                 return 0;
10594
10595         if (rfkill_blocked(rdev->rfkill))
10596                 return -ERFKILL;
10597
10598         err = rdev_start_p2p_device(rdev, wdev);
10599         if (err)
10600                 return err;
10601
10602         wdev->p2p_started = true;
10603         rdev->opencount++;
10604
10605         return 0;
10606 }
10607
10608 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
10609 {
10610         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10611         struct wireless_dev *wdev = info->user_ptr[1];
10612
10613         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
10614                 return -EOPNOTSUPP;
10615
10616         if (!rdev->ops->stop_p2p_device)
10617                 return -EOPNOTSUPP;
10618
10619         cfg80211_stop_p2p_device(rdev, wdev);
10620
10621         return 0;
10622 }
10623
10624 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
10625 {
10626         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10627         struct wireless_dev *wdev = info->user_ptr[1];
10628         struct cfg80211_nan_conf conf = {};
10629         int err;
10630
10631         if (wdev->iftype != NL80211_IFTYPE_NAN)
10632                 return -EOPNOTSUPP;
10633
10634         if (wdev->nan_started)
10635                 return -EEXIST;
10636
10637         if (rfkill_blocked(rdev->rfkill))
10638                 return -ERFKILL;
10639
10640         if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
10641                 return -EINVAL;
10642
10643         if (!info->attrs[NL80211_ATTR_NAN_DUAL])
10644                 return -EINVAL;
10645
10646         conf.master_pref =
10647                 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
10648         if (!conf.master_pref)
10649                 return -EINVAL;
10650
10651         conf.dual = nla_get_u8(info->attrs[NL80211_ATTR_NAN_DUAL]);
10652
10653         err = rdev_start_nan(rdev, wdev, &conf);
10654         if (err)
10655                 return err;
10656
10657         wdev->nan_started = true;
10658         rdev->opencount++;
10659
10660         return 0;
10661 }
10662
10663 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
10664 {
10665         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10666         struct wireless_dev *wdev = info->user_ptr[1];
10667
10668         if (wdev->iftype != NL80211_IFTYPE_NAN)
10669                 return -EOPNOTSUPP;
10670
10671         cfg80211_stop_nan(rdev, wdev);
10672
10673         return 0;
10674 }
10675
10676 static int validate_nan_filter(struct nlattr *filter_attr)
10677 {
10678         struct nlattr *attr;
10679         int len = 0, n_entries = 0, rem;
10680
10681         nla_for_each_nested(attr, filter_attr, rem) {
10682                 len += nla_len(attr);
10683                 n_entries++;
10684         }
10685
10686         if (len >= U8_MAX)
10687                 return -EINVAL;
10688
10689         return n_entries;
10690 }
10691
10692 static int handle_nan_filter(struct nlattr *attr_filter,
10693                              struct cfg80211_nan_func *func,
10694                              bool tx)
10695 {
10696         struct nlattr *attr;
10697         int n_entries, rem, i;
10698         struct cfg80211_nan_func_filter *filter;
10699
10700         n_entries = validate_nan_filter(attr_filter);
10701         if (n_entries < 0)
10702                 return n_entries;
10703
10704         BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
10705
10706         filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
10707         if (!filter)
10708                 return -ENOMEM;
10709
10710         i = 0;
10711         nla_for_each_nested(attr, attr_filter, rem) {
10712                 filter[i].filter = kmemdup(nla_data(attr), nla_len(attr),
10713                                            GFP_KERNEL);
10714                 filter[i].len = nla_len(attr);
10715                 i++;
10716         }
10717         if (tx) {
10718                 func->num_tx_filters = n_entries;
10719                 func->tx_filters = filter;
10720         } else {
10721                 func->num_rx_filters = n_entries;
10722                 func->rx_filters = filter;
10723         }
10724
10725         return 0;
10726 }
10727
10728 static int nl80211_nan_add_func(struct sk_buff *skb,
10729                                 struct genl_info *info)
10730 {
10731         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10732         struct wireless_dev *wdev = info->user_ptr[1];
10733         struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
10734         struct cfg80211_nan_func *func;
10735         struct sk_buff *msg = NULL;
10736         void *hdr = NULL;
10737         int err = 0;
10738
10739         if (wdev->iftype != NL80211_IFTYPE_NAN)
10740                 return -EOPNOTSUPP;
10741
10742         if (!wdev->nan_started)
10743                 return -ENOTCONN;
10744
10745         if (!info->attrs[NL80211_ATTR_NAN_FUNC])
10746                 return -EINVAL;
10747
10748         if (wdev->owner_nlportid &&
10749             wdev->owner_nlportid != info->snd_portid)
10750                 return -ENOTCONN;
10751
10752         err = nla_parse(tb, NL80211_NAN_FUNC_ATTR_MAX,
10753                         nla_data(info->attrs[NL80211_ATTR_NAN_FUNC]),
10754                         nla_len(info->attrs[NL80211_ATTR_NAN_FUNC]),
10755                         nl80211_nan_func_policy);
10756         if (err)
10757                 return err;
10758
10759         func = kzalloc(sizeof(*func), GFP_KERNEL);
10760         if (!func)
10761                 return -ENOMEM;
10762
10763         func->cookie = wdev->wiphy->cookie_counter++;
10764
10765         if (!tb[NL80211_NAN_FUNC_TYPE] ||
10766             nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]) > NL80211_NAN_FUNC_MAX_TYPE) {
10767                 err = -EINVAL;
10768                 goto out;
10769         }
10770
10771
10772         func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
10773
10774         if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
10775                 err = -EINVAL;
10776                 goto out;
10777         }
10778
10779         memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
10780                sizeof(func->service_id));
10781
10782         func->close_range =
10783                 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
10784
10785         if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
10786                 func->serv_spec_info_len =
10787                         nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
10788                 func->serv_spec_info =
10789                         kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
10790                                 func->serv_spec_info_len,
10791                                 GFP_KERNEL);
10792                 if (!func->serv_spec_info) {
10793                         err = -ENOMEM;
10794                         goto out;
10795                 }
10796         }
10797
10798         if (tb[NL80211_NAN_FUNC_TTL])
10799                 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
10800
10801         switch (func->type) {
10802         case NL80211_NAN_FUNC_PUBLISH:
10803                 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
10804                         err = -EINVAL;
10805                         goto out;
10806                 }
10807
10808                 func->publish_type =
10809                         nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
10810                 func->publish_bcast =
10811                         nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
10812
10813                 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
10814                         func->publish_bcast) {
10815                         err = -EINVAL;
10816                         goto out;
10817                 }
10818                 break;
10819         case NL80211_NAN_FUNC_SUBSCRIBE:
10820                 func->subscribe_active =
10821                         nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
10822                 break;
10823         case NL80211_NAN_FUNC_FOLLOW_UP:
10824                 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
10825                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
10826                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
10827                         err = -EINVAL;
10828                         goto out;
10829                 }
10830
10831                 func->followup_id =
10832                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
10833                 func->followup_reqid =
10834                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
10835                 memcpy(func->followup_dest.addr,
10836                        nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
10837                        sizeof(func->followup_dest.addr));
10838                 if (func->ttl) {
10839                         err = -EINVAL;
10840                         goto out;
10841                 }
10842                 break;
10843         default:
10844                 err = -EINVAL;
10845                 goto out;
10846         }
10847
10848         if (tb[NL80211_NAN_FUNC_SRF]) {
10849                 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
10850
10851                 err = nla_parse(srf_tb, NL80211_NAN_SRF_ATTR_MAX,
10852                                 nla_data(tb[NL80211_NAN_FUNC_SRF]),
10853                                 nla_len(tb[NL80211_NAN_FUNC_SRF]), NULL);
10854                 if (err)
10855                         goto out;
10856
10857                 func->srf_include =
10858                         nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
10859
10860                 if (srf_tb[NL80211_NAN_SRF_BF]) {
10861                         if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
10862                             !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
10863                                 err = -EINVAL;
10864                                 goto out;
10865                         }
10866
10867                         func->srf_bf_len =
10868                                 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
10869                         func->srf_bf =
10870                                 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
10871                                         func->srf_bf_len, GFP_KERNEL);
10872                         if (!func->srf_bf) {
10873                                 err = -ENOMEM;
10874                                 goto out;
10875                         }
10876
10877                         func->srf_bf_idx =
10878                                 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
10879                 } else {
10880                         struct nlattr *attr, *mac_attr =
10881                                 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
10882                         int n_entries, rem, i = 0;
10883
10884                         if (!mac_attr) {
10885                                 err = -EINVAL;
10886                                 goto out;
10887                         }
10888
10889                         n_entries = validate_acl_mac_addrs(mac_attr);
10890                         if (n_entries <= 0) {
10891                                 err = -EINVAL;
10892                                 goto out;
10893                         }
10894
10895                         func->srf_num_macs = n_entries;
10896                         func->srf_macs =
10897                                 kzalloc(sizeof(*func->srf_macs) * n_entries,
10898                                         GFP_KERNEL);
10899                         if (!func->srf_macs) {
10900                                 err = -ENOMEM;
10901                                 goto out;
10902                         }
10903
10904                         nla_for_each_nested(attr, mac_attr, rem)
10905                                 memcpy(func->srf_macs[i++].addr, nla_data(attr),
10906                                        sizeof(*func->srf_macs));
10907                 }
10908         }
10909
10910         if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
10911                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
10912                                         func, true);
10913                 if (err)
10914                         goto out;
10915         }
10916
10917         if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
10918                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
10919                                         func, false);
10920                 if (err)
10921                         goto out;
10922         }
10923
10924         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10925         if (!msg) {
10926                 err = -ENOMEM;
10927                 goto out;
10928         }
10929
10930         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10931                              NL80211_CMD_ADD_NAN_FUNCTION);
10932         /* This can't really happen - we just allocated 4KB */
10933         if (WARN_ON(!hdr)) {
10934                 err = -ENOMEM;
10935                 goto out;
10936         }
10937
10938         err = rdev_add_nan_func(rdev, wdev, func);
10939 out:
10940         if (err < 0) {
10941                 cfg80211_free_nan_func(func);
10942                 nlmsg_free(msg);
10943                 return err;
10944         }
10945
10946         /* propagate the instance id and cookie to userspace  */
10947         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
10948                               NL80211_ATTR_PAD))
10949                 goto nla_put_failure;
10950
10951         func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
10952         if (!func_attr)
10953                 goto nla_put_failure;
10954
10955         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
10956                        func->instance_id))
10957                 goto nla_put_failure;
10958
10959         nla_nest_end(msg, func_attr);
10960
10961         genlmsg_end(msg, hdr);
10962         return genlmsg_reply(msg, info);
10963
10964 nla_put_failure:
10965         nlmsg_free(msg);
10966         return -ENOBUFS;
10967 }
10968
10969 static int nl80211_nan_del_func(struct sk_buff *skb,
10970                                struct genl_info *info)
10971 {
10972         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10973         struct wireless_dev *wdev = info->user_ptr[1];
10974         u64 cookie;
10975
10976         if (wdev->iftype != NL80211_IFTYPE_NAN)
10977                 return -EOPNOTSUPP;
10978
10979         if (!wdev->nan_started)
10980                 return -ENOTCONN;
10981
10982         if (!info->attrs[NL80211_ATTR_COOKIE])
10983                 return -EINVAL;
10984
10985         if (wdev->owner_nlportid &&
10986             wdev->owner_nlportid != info->snd_portid)
10987                 return -ENOTCONN;
10988
10989         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
10990
10991         rdev_del_nan_func(rdev, wdev, cookie);
10992
10993         return 0;
10994 }
10995
10996 static int nl80211_nan_change_config(struct sk_buff *skb,
10997                                      struct genl_info *info)
10998 {
10999         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11000         struct wireless_dev *wdev = info->user_ptr[1];
11001         struct cfg80211_nan_conf conf = {};
11002         u32 changed = 0;
11003
11004         if (wdev->iftype != NL80211_IFTYPE_NAN)
11005                 return -EOPNOTSUPP;
11006
11007         if (!wdev->nan_started)
11008                 return -ENOTCONN;
11009
11010         if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
11011                 conf.master_pref =
11012                         nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
11013                 if (conf.master_pref <= 1 || conf.master_pref == 255)
11014                         return -EINVAL;
11015
11016                 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
11017         }
11018
11019         if (info->attrs[NL80211_ATTR_NAN_DUAL]) {
11020                 conf.dual = nla_get_u8(info->attrs[NL80211_ATTR_NAN_DUAL]);
11021                 changed |= CFG80211_NAN_CONF_CHANGED_DUAL;
11022         }
11023
11024         if (!changed)
11025                 return -EINVAL;
11026
11027         return rdev_nan_change_conf(rdev, wdev, &conf, changed);
11028 }
11029
11030 void cfg80211_nan_match(struct wireless_dev *wdev,
11031                         struct cfg80211_nan_match_params *match, gfp_t gfp)
11032 {
11033         struct wiphy *wiphy = wdev->wiphy;
11034         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11035         struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
11036         struct sk_buff *msg;
11037         void *hdr;
11038
11039         if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
11040                 return;
11041
11042         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11043         if (!msg)
11044                 return;
11045
11046         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
11047         if (!hdr) {
11048                 nlmsg_free(msg);
11049                 return;
11050         }
11051
11052         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11053             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11054                                          wdev->netdev->ifindex)) ||
11055             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
11056                               NL80211_ATTR_PAD))
11057                 goto nla_put_failure;
11058
11059         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
11060                               NL80211_ATTR_PAD) ||
11061             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
11062                 goto nla_put_failure;
11063
11064         match_attr = nla_nest_start(msg, NL80211_ATTR_NAN_MATCH);
11065         if (!match_attr)
11066                 goto nla_put_failure;
11067
11068         local_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_LOCAL);
11069         if (!local_func_attr)
11070                 goto nla_put_failure;
11071
11072         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
11073                 goto nla_put_failure;
11074
11075         nla_nest_end(msg, local_func_attr);
11076
11077         peer_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_PEER);
11078         if (!peer_func_attr)
11079                 goto nla_put_failure;
11080
11081         if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
11082             nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
11083                 goto nla_put_failure;
11084
11085         if (match->info && match->info_len &&
11086             nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
11087                     match->info))
11088                 goto nla_put_failure;
11089
11090         nla_nest_end(msg, peer_func_attr);
11091         nla_nest_end(msg, match_attr);
11092         genlmsg_end(msg, hdr);
11093
11094         if (!wdev->owner_nlportid)
11095                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
11096                                         msg, 0, NL80211_MCGRP_NAN, gfp);
11097         else
11098                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
11099                                 wdev->owner_nlportid);
11100
11101         return;
11102
11103 nla_put_failure:
11104         nlmsg_free(msg);
11105 }
11106 EXPORT_SYMBOL(cfg80211_nan_match);
11107
11108 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
11109                                   u8 inst_id,
11110                                   enum nl80211_nan_func_term_reason reason,
11111                                   u64 cookie, gfp_t gfp)
11112 {
11113         struct wiphy *wiphy = wdev->wiphy;
11114         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11115         struct sk_buff *msg;
11116         struct nlattr *func_attr;
11117         void *hdr;
11118
11119         if (WARN_ON(!inst_id))
11120                 return;
11121
11122         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11123         if (!msg)
11124                 return;
11125
11126         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
11127         if (!hdr) {
11128                 nlmsg_free(msg);
11129                 return;
11130         }
11131
11132         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11133             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11134                                          wdev->netdev->ifindex)) ||
11135             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
11136                               NL80211_ATTR_PAD))
11137                 goto nla_put_failure;
11138
11139         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11140                               NL80211_ATTR_PAD))
11141                 goto nla_put_failure;
11142
11143         func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
11144         if (!func_attr)
11145                 goto nla_put_failure;
11146
11147         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
11148             nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
11149                 goto nla_put_failure;
11150
11151         nla_nest_end(msg, func_attr);
11152         genlmsg_end(msg, hdr);
11153
11154         if (!wdev->owner_nlportid)
11155                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
11156                                         msg, 0, NL80211_MCGRP_NAN, gfp);
11157         else
11158                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
11159                                 wdev->owner_nlportid);
11160
11161         return;
11162
11163 nla_put_failure:
11164         nlmsg_free(msg);
11165 }
11166 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
11167
11168 static int nl80211_get_protocol_features(struct sk_buff *skb,
11169                                          struct genl_info *info)
11170 {
11171         void *hdr;
11172         struct sk_buff *msg;
11173
11174         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11175         if (!msg)
11176                 return -ENOMEM;
11177
11178         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11179                              NL80211_CMD_GET_PROTOCOL_FEATURES);
11180         if (!hdr)
11181                 goto nla_put_failure;
11182
11183         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
11184                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
11185                 goto nla_put_failure;
11186
11187         genlmsg_end(msg, hdr);
11188         return genlmsg_reply(msg, info);
11189
11190  nla_put_failure:
11191         kfree_skb(msg);
11192         return -ENOBUFS;
11193 }
11194
11195 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
11196 {
11197         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11198         struct cfg80211_update_ft_ies_params ft_params;
11199         struct net_device *dev = info->user_ptr[1];
11200
11201         if (!rdev->ops->update_ft_ies)
11202                 return -EOPNOTSUPP;
11203
11204         if (!info->attrs[NL80211_ATTR_MDID] ||
11205             !info->attrs[NL80211_ATTR_IE] ||
11206             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
11207                 return -EINVAL;
11208
11209         memset(&ft_params, 0, sizeof(ft_params));
11210         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
11211         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11212         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11213
11214         return rdev_update_ft_ies(rdev, dev, &ft_params);
11215 }
11216
11217 static int nl80211_crit_protocol_start(struct sk_buff *skb,
11218                                        struct genl_info *info)
11219 {
11220         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11221         struct wireless_dev *wdev = info->user_ptr[1];
11222         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
11223         u16 duration;
11224         int ret;
11225
11226         if (!rdev->ops->crit_proto_start)
11227                 return -EOPNOTSUPP;
11228
11229         if (WARN_ON(!rdev->ops->crit_proto_stop))
11230                 return -EINVAL;
11231
11232         if (rdev->crit_proto_nlportid)
11233                 return -EBUSY;
11234
11235         /* determine protocol if provided */
11236         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
11237                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
11238
11239         if (proto >= NUM_NL80211_CRIT_PROTO)
11240                 return -EINVAL;
11241
11242         /* timeout must be provided */
11243         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
11244                 return -EINVAL;
11245
11246         duration =
11247                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
11248
11249         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
11250                 return -ERANGE;
11251
11252         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
11253         if (!ret)
11254                 rdev->crit_proto_nlportid = info->snd_portid;
11255
11256         return ret;
11257 }
11258
11259 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
11260                                       struct genl_info *info)
11261 {
11262         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11263         struct wireless_dev *wdev = info->user_ptr[1];
11264
11265         if (!rdev->ops->crit_proto_stop)
11266                 return -EOPNOTSUPP;
11267
11268         if (rdev->crit_proto_nlportid) {
11269                 rdev->crit_proto_nlportid = 0;
11270                 rdev_crit_proto_stop(rdev, wdev);
11271         }
11272         return 0;
11273 }
11274
11275 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
11276 {
11277         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11278         struct wireless_dev *wdev =
11279                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
11280         int i, err;
11281         u32 vid, subcmd;
11282
11283         if (!rdev->wiphy.vendor_commands)
11284                 return -EOPNOTSUPP;
11285
11286         if (IS_ERR(wdev)) {
11287                 err = PTR_ERR(wdev);
11288                 if (err != -EINVAL)
11289                         return err;
11290                 wdev = NULL;
11291         } else if (wdev->wiphy != &rdev->wiphy) {
11292                 return -EINVAL;
11293         }
11294
11295         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
11296             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
11297                 return -EINVAL;
11298
11299         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
11300         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
11301         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
11302                 const struct wiphy_vendor_command *vcmd;
11303                 void *data = NULL;
11304                 int len = 0;
11305
11306                 vcmd = &rdev->wiphy.vendor_commands[i];
11307
11308                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
11309                         continue;
11310
11311                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
11312                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
11313                         if (!wdev)
11314                                 return -EINVAL;
11315                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
11316                             !wdev->netdev)
11317                                 return -EINVAL;
11318
11319                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
11320                                 if (wdev->netdev &&
11321                                     !netif_running(wdev->netdev))
11322                                         return -ENETDOWN;
11323                                 if (!wdev->netdev && !wdev->p2p_started)
11324                                         return -ENETDOWN;
11325                         }
11326                 } else {
11327                         wdev = NULL;
11328                 }
11329
11330                 if (!vcmd->doit)
11331                         return -EOPNOTSUPP;
11332
11333                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
11334                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
11335                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
11336                 }
11337
11338                 rdev->cur_cmd_info = info;
11339                 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
11340                                                           data, len);
11341                 rdev->cur_cmd_info = NULL;
11342                 return err;
11343         }
11344
11345         return -EOPNOTSUPP;
11346 }
11347
11348 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
11349                                        struct netlink_callback *cb,
11350                                        struct cfg80211_registered_device **rdev,
11351                                        struct wireless_dev **wdev)
11352 {
11353         u32 vid, subcmd;
11354         unsigned int i;
11355         int vcmd_idx = -1;
11356         int err;
11357         void *data = NULL;
11358         unsigned int data_len = 0;
11359
11360         if (cb->args[0]) {
11361                 /* subtract the 1 again here */
11362                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
11363                 struct wireless_dev *tmp;
11364
11365                 if (!wiphy)
11366                         return -ENODEV;
11367                 *rdev = wiphy_to_rdev(wiphy);
11368                 *wdev = NULL;
11369
11370                 if (cb->args[1]) {
11371                         list_for_each_entry(tmp, &wiphy->wdev_list, list) {
11372                                 if (tmp->identifier == cb->args[1] - 1) {
11373                                         *wdev = tmp;
11374                                         break;
11375                                 }
11376                         }
11377                 }
11378
11379                 /* keep rtnl locked in successful case */
11380                 return 0;
11381         }
11382
11383         err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
11384                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
11385                           nl80211_policy);
11386         if (err)
11387                 return err;
11388
11389         if (!nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_ID] ||
11390             !nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_SUBCMD])
11391                 return -EINVAL;
11392
11393         *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
11394                                            nl80211_fam.attrbuf);
11395         if (IS_ERR(*wdev))
11396                 *wdev = NULL;
11397
11398         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
11399                                            nl80211_fam.attrbuf);
11400         if (IS_ERR(*rdev))
11401                 return PTR_ERR(*rdev);
11402
11403         vid = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_ID]);
11404         subcmd = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
11405
11406         for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
11407                 const struct wiphy_vendor_command *vcmd;
11408
11409                 vcmd = &(*rdev)->wiphy.vendor_commands[i];
11410
11411                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
11412                         continue;
11413
11414                 if (!vcmd->dumpit)
11415                         return -EOPNOTSUPP;
11416
11417                 vcmd_idx = i;
11418                 break;
11419         }
11420
11421         if (vcmd_idx < 0)
11422                 return -EOPNOTSUPP;
11423
11424         if (nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_DATA]) {
11425                 data = nla_data(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_DATA]);
11426                 data_len = nla_len(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_DATA]);
11427         }
11428
11429         /* 0 is the first index - add 1 to parse only once */
11430         cb->args[0] = (*rdev)->wiphy_idx + 1;
11431         /* add 1 to know if it was NULL */
11432         cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
11433         cb->args[2] = vcmd_idx;
11434         cb->args[3] = (unsigned long)data;
11435         cb->args[4] = data_len;
11436
11437         /* keep rtnl locked in successful case */
11438         return 0;
11439 }
11440
11441 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
11442                                    struct netlink_callback *cb)
11443 {
11444         struct cfg80211_registered_device *rdev;
11445         struct wireless_dev *wdev;
11446         unsigned int vcmd_idx;
11447         const struct wiphy_vendor_command *vcmd;
11448         void *data;
11449         int data_len;
11450         int err;
11451         struct nlattr *vendor_data;
11452
11453         rtnl_lock();
11454         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
11455         if (err)
11456                 goto out;
11457
11458         vcmd_idx = cb->args[2];
11459         data = (void *)cb->args[3];
11460         data_len = cb->args[4];
11461         vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
11462
11463         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
11464                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
11465                 if (!wdev) {
11466                         err = -EINVAL;
11467                         goto out;
11468                 }
11469                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
11470                     !wdev->netdev) {
11471                         err = -EINVAL;
11472                         goto out;
11473                 }
11474
11475                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
11476                         if (wdev->netdev &&
11477                             !netif_running(wdev->netdev)) {
11478                                 err = -ENETDOWN;
11479                                 goto out;
11480                         }
11481                         if (!wdev->netdev && !wdev->p2p_started) {
11482                                 err = -ENETDOWN;
11483                                 goto out;
11484                         }
11485                 }
11486         }
11487
11488         while (1) {
11489                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
11490                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
11491                                            NL80211_CMD_VENDOR);
11492                 if (!hdr)
11493                         break;
11494
11495                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11496                     (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
11497                                                wdev_id(wdev),
11498                                                NL80211_ATTR_PAD))) {
11499                         genlmsg_cancel(skb, hdr);
11500                         break;
11501                 }
11502
11503                 vendor_data = nla_nest_start(skb, NL80211_ATTR_VENDOR_DATA);
11504                 if (!vendor_data) {
11505                         genlmsg_cancel(skb, hdr);
11506                         break;
11507                 }
11508
11509                 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
11510                                    (unsigned long *)&cb->args[5]);
11511                 nla_nest_end(skb, vendor_data);
11512
11513                 if (err == -ENOBUFS || err == -ENOENT) {
11514                         genlmsg_cancel(skb, hdr);
11515                         break;
11516                 } else if (err) {
11517                         genlmsg_cancel(skb, hdr);
11518                         goto out;
11519                 }
11520
11521                 genlmsg_end(skb, hdr);
11522         }
11523
11524         err = skb->len;
11525  out:
11526         rtnl_unlock();
11527         return err;
11528 }
11529
11530 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
11531                                            enum nl80211_commands cmd,
11532                                            enum nl80211_attrs attr,
11533                                            int approxlen)
11534 {
11535         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11536
11537         if (WARN_ON(!rdev->cur_cmd_info))
11538                 return NULL;
11539
11540         return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
11541                                            rdev->cur_cmd_info->snd_portid,
11542                                            rdev->cur_cmd_info->snd_seq,
11543                                            cmd, attr, NULL, GFP_KERNEL);
11544 }
11545 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
11546
11547 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
11548 {
11549         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
11550         void *hdr = ((void **)skb->cb)[1];
11551         struct nlattr *data = ((void **)skb->cb)[2];
11552
11553         /* clear CB data for netlink core to own from now on */
11554         memset(skb->cb, 0, sizeof(skb->cb));
11555
11556         if (WARN_ON(!rdev->cur_cmd_info)) {
11557                 kfree_skb(skb);
11558                 return -EINVAL;
11559         }
11560
11561         nla_nest_end(skb, data);
11562         genlmsg_end(skb, hdr);
11563         return genlmsg_reply(skb, rdev->cur_cmd_info);
11564 }
11565 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
11566
11567 static int nl80211_set_qos_map(struct sk_buff *skb,
11568                                struct genl_info *info)
11569 {
11570         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11571         struct cfg80211_qos_map *qos_map = NULL;
11572         struct net_device *dev = info->user_ptr[1];
11573         u8 *pos, len, num_des, des_len, des;
11574         int ret;
11575
11576         if (!rdev->ops->set_qos_map)
11577                 return -EOPNOTSUPP;
11578
11579         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
11580                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
11581                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
11582
11583                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
11584                     len > IEEE80211_QOS_MAP_LEN_MAX)
11585                         return -EINVAL;
11586
11587                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
11588                 if (!qos_map)
11589                         return -ENOMEM;
11590
11591                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
11592                 if (num_des) {
11593                         des_len = num_des *
11594                                 sizeof(struct cfg80211_dscp_exception);
11595                         memcpy(qos_map->dscp_exception, pos, des_len);
11596                         qos_map->num_des = num_des;
11597                         for (des = 0; des < num_des; des++) {
11598                                 if (qos_map->dscp_exception[des].up > 7) {
11599                                         kfree(qos_map);
11600                                         return -EINVAL;
11601                                 }
11602                         }
11603                         pos += des_len;
11604                 }
11605                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
11606         }
11607
11608         wdev_lock(dev->ieee80211_ptr);
11609         ret = nl80211_key_allowed(dev->ieee80211_ptr);
11610         if (!ret)
11611                 ret = rdev_set_qos_map(rdev, dev, qos_map);
11612         wdev_unlock(dev->ieee80211_ptr);
11613
11614         kfree(qos_map);
11615         return ret;
11616 }
11617
11618 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
11619 {
11620         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11621         struct net_device *dev = info->user_ptr[1];
11622         struct wireless_dev *wdev = dev->ieee80211_ptr;
11623         const u8 *peer;
11624         u8 tsid, up;
11625         u16 admitted_time = 0;
11626         int err;
11627
11628         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
11629                 return -EOPNOTSUPP;
11630
11631         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
11632             !info->attrs[NL80211_ATTR_USER_PRIO])
11633                 return -EINVAL;
11634
11635         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
11636         if (tsid >= IEEE80211_NUM_TIDS)
11637                 return -EINVAL;
11638
11639         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
11640         if (up >= IEEE80211_NUM_UPS)
11641                 return -EINVAL;
11642
11643         /* WMM uses TIDs 0-7 even for TSPEC */
11644         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
11645                 /* TODO: handle 802.11 TSPEC/admission control
11646                  * need more attributes for that (e.g. BA session requirement);
11647                  * change the WMM adminssion test above to allow both then
11648                  */
11649                 return -EINVAL;
11650         }
11651
11652         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
11653
11654         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
11655                 admitted_time =
11656                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
11657                 if (!admitted_time)
11658                         return -EINVAL;
11659         }
11660
11661         wdev_lock(wdev);
11662         switch (wdev->iftype) {
11663         case NL80211_IFTYPE_STATION:
11664         case NL80211_IFTYPE_P2P_CLIENT:
11665                 if (wdev->current_bss)
11666                         break;
11667                 err = -ENOTCONN;
11668                 goto out;
11669         default:
11670                 err = -EOPNOTSUPP;
11671                 goto out;
11672         }
11673
11674         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
11675
11676  out:
11677         wdev_unlock(wdev);
11678         return err;
11679 }
11680
11681 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
11682 {
11683         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11684         struct net_device *dev = info->user_ptr[1];
11685         struct wireless_dev *wdev = dev->ieee80211_ptr;
11686         const u8 *peer;
11687         u8 tsid;
11688         int err;
11689
11690         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
11691                 return -EINVAL;
11692
11693         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
11694         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
11695
11696         wdev_lock(wdev);
11697         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
11698         wdev_unlock(wdev);
11699
11700         return err;
11701 }
11702
11703 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
11704                                        struct genl_info *info)
11705 {
11706         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11707         struct net_device *dev = info->user_ptr[1];
11708         struct wireless_dev *wdev = dev->ieee80211_ptr;
11709         struct cfg80211_chan_def chandef = {};
11710         const u8 *addr;
11711         u8 oper_class;
11712         int err;
11713
11714         if (!rdev->ops->tdls_channel_switch ||
11715             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
11716                 return -EOPNOTSUPP;
11717
11718         switch (dev->ieee80211_ptr->iftype) {
11719         case NL80211_IFTYPE_STATION:
11720         case NL80211_IFTYPE_P2P_CLIENT:
11721                 break;
11722         default:
11723                 return -EOPNOTSUPP;
11724         }
11725
11726         if (!info->attrs[NL80211_ATTR_MAC] ||
11727             !info->attrs[NL80211_ATTR_OPER_CLASS])
11728                 return -EINVAL;
11729
11730         err = nl80211_parse_chandef(rdev, info, &chandef);
11731         if (err)
11732                 return err;
11733
11734         /*
11735          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
11736          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
11737          * specification is not defined for them.
11738          */
11739         if (chandef.chan->band == NL80211_BAND_2GHZ &&
11740             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
11741             chandef.width != NL80211_CHAN_WIDTH_20)
11742                 return -EINVAL;
11743
11744         /* we will be active on the TDLS link */
11745         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
11746                                            wdev->iftype))
11747                 return -EINVAL;
11748
11749         /* don't allow switching to DFS channels */
11750         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
11751                 return -EINVAL;
11752
11753         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
11754         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
11755
11756         wdev_lock(wdev);
11757         err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
11758         wdev_unlock(wdev);
11759
11760         return err;
11761 }
11762
11763 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
11764                                               struct genl_info *info)
11765 {
11766         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11767         struct net_device *dev = info->user_ptr[1];
11768         struct wireless_dev *wdev = dev->ieee80211_ptr;
11769         const u8 *addr;
11770
11771         if (!rdev->ops->tdls_channel_switch ||
11772             !rdev->ops->tdls_cancel_channel_switch ||
11773             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
11774                 return -EOPNOTSUPP;
11775
11776         switch (dev->ieee80211_ptr->iftype) {
11777         case NL80211_IFTYPE_STATION:
11778         case NL80211_IFTYPE_P2P_CLIENT:
11779                 break;
11780         default:
11781                 return -EOPNOTSUPP;
11782         }
11783
11784         if (!info->attrs[NL80211_ATTR_MAC])
11785                 return -EINVAL;
11786
11787         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
11788
11789         wdev_lock(wdev);
11790         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
11791         wdev_unlock(wdev);
11792
11793         return 0;
11794 }
11795
11796 #define NL80211_FLAG_NEED_WIPHY         0x01
11797 #define NL80211_FLAG_NEED_NETDEV        0x02
11798 #define NL80211_FLAG_NEED_RTNL          0x04
11799 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
11800 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
11801                                          NL80211_FLAG_CHECK_NETDEV_UP)
11802 #define NL80211_FLAG_NEED_WDEV          0x10
11803 /* If a netdev is associated, it must be UP, P2P must be started */
11804 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
11805                                          NL80211_FLAG_CHECK_NETDEV_UP)
11806 #define NL80211_FLAG_CLEAR_SKB          0x20
11807
11808 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
11809                             struct genl_info *info)
11810 {
11811         struct cfg80211_registered_device *rdev;
11812         struct wireless_dev *wdev;
11813         struct net_device *dev;
11814         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
11815
11816         if (rtnl)
11817                 rtnl_lock();
11818
11819         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
11820                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
11821                 if (IS_ERR(rdev)) {
11822                         if (rtnl)
11823                                 rtnl_unlock();
11824                         return PTR_ERR(rdev);
11825                 }
11826                 info->user_ptr[0] = rdev;
11827         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
11828                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
11829                 ASSERT_RTNL();
11830
11831                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
11832                                                   info->attrs);
11833                 if (IS_ERR(wdev)) {
11834                         if (rtnl)
11835                                 rtnl_unlock();
11836                         return PTR_ERR(wdev);
11837                 }
11838
11839                 dev = wdev->netdev;
11840                 rdev = wiphy_to_rdev(wdev->wiphy);
11841
11842                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
11843                         if (!dev) {
11844                                 if (rtnl)
11845                                         rtnl_unlock();
11846                                 return -EINVAL;
11847                         }
11848
11849                         info->user_ptr[1] = dev;
11850                 } else {
11851                         info->user_ptr[1] = wdev;
11852                 }
11853
11854                 if (dev) {
11855                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
11856                             !netif_running(dev)) {
11857                                 if (rtnl)
11858                                         rtnl_unlock();
11859                                 return -ENETDOWN;
11860                         }
11861
11862                         dev_hold(dev);
11863                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
11864                         if (wdev->iftype == NL80211_IFTYPE_P2P_DEVICE &&
11865                             !wdev->p2p_started) {
11866                                 if (rtnl)
11867                                         rtnl_unlock();
11868                                 return -ENETDOWN;
11869                         }
11870                         if (wdev->iftype == NL80211_IFTYPE_NAN &&
11871                             !wdev->nan_started) {
11872                                 if (rtnl)
11873                                         rtnl_unlock();
11874                                 return -ENETDOWN;
11875                         }
11876                 }
11877
11878                 info->user_ptr[0] = rdev;
11879         }
11880
11881         return 0;
11882 }
11883
11884 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
11885                               struct genl_info *info)
11886 {
11887         if (info->user_ptr[1]) {
11888                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
11889                         struct wireless_dev *wdev = info->user_ptr[1];
11890
11891                         if (wdev->netdev)
11892                                 dev_put(wdev->netdev);
11893                 } else {
11894                         dev_put(info->user_ptr[1]);
11895                 }
11896         }
11897
11898         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
11899                 rtnl_unlock();
11900
11901         /* If needed, clear the netlink message payload from the SKB
11902          * as it might contain key data that shouldn't stick around on
11903          * the heap after the SKB is freed. The netlink message header
11904          * is still needed for further processing, so leave it intact.
11905          */
11906         if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
11907                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
11908
11909                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
11910         }
11911 }
11912
11913 static const struct genl_ops nl80211_ops[] = {
11914         {
11915                 .cmd = NL80211_CMD_GET_WIPHY,
11916                 .doit = nl80211_get_wiphy,
11917                 .dumpit = nl80211_dump_wiphy,
11918                 .done = nl80211_dump_wiphy_done,
11919                 .policy = nl80211_policy,
11920                 /* can be retrieved by unprivileged users */
11921                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11922                                   NL80211_FLAG_NEED_RTNL,
11923         },
11924         {
11925                 .cmd = NL80211_CMD_SET_WIPHY,
11926                 .doit = nl80211_set_wiphy,
11927                 .policy = nl80211_policy,
11928                 .flags = GENL_UNS_ADMIN_PERM,
11929                 .internal_flags = NL80211_FLAG_NEED_RTNL,
11930         },
11931         {
11932                 .cmd = NL80211_CMD_GET_INTERFACE,
11933                 .doit = nl80211_get_interface,
11934                 .dumpit = nl80211_dump_interface,
11935                 .policy = nl80211_policy,
11936                 /* can be retrieved by unprivileged users */
11937                 .internal_flags = NL80211_FLAG_NEED_WDEV |
11938                                   NL80211_FLAG_NEED_RTNL,
11939         },
11940         {
11941                 .cmd = NL80211_CMD_SET_INTERFACE,
11942                 .doit = nl80211_set_interface,
11943                 .policy = nl80211_policy,
11944                 .flags = GENL_UNS_ADMIN_PERM,
11945                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11946                                   NL80211_FLAG_NEED_RTNL,
11947         },
11948         {
11949                 .cmd = NL80211_CMD_NEW_INTERFACE,
11950                 .doit = nl80211_new_interface,
11951                 .policy = nl80211_policy,
11952                 .flags = GENL_UNS_ADMIN_PERM,
11953                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11954                                   NL80211_FLAG_NEED_RTNL,
11955         },
11956         {
11957                 .cmd = NL80211_CMD_DEL_INTERFACE,
11958                 .doit = nl80211_del_interface,
11959                 .policy = nl80211_policy,
11960                 .flags = GENL_UNS_ADMIN_PERM,
11961                 .internal_flags = NL80211_FLAG_NEED_WDEV |
11962                                   NL80211_FLAG_NEED_RTNL,
11963         },
11964         {
11965                 .cmd = NL80211_CMD_GET_KEY,
11966                 .doit = nl80211_get_key,
11967                 .policy = nl80211_policy,
11968                 .flags = GENL_UNS_ADMIN_PERM,
11969                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11970                                   NL80211_FLAG_NEED_RTNL,
11971         },
11972         {
11973                 .cmd = NL80211_CMD_SET_KEY,
11974                 .doit = nl80211_set_key,
11975                 .policy = nl80211_policy,
11976                 .flags = GENL_UNS_ADMIN_PERM,
11977                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11978                                   NL80211_FLAG_NEED_RTNL |
11979                                   NL80211_FLAG_CLEAR_SKB,
11980         },
11981         {
11982                 .cmd = NL80211_CMD_NEW_KEY,
11983                 .doit = nl80211_new_key,
11984                 .policy = nl80211_policy,
11985                 .flags = GENL_UNS_ADMIN_PERM,
11986                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11987                                   NL80211_FLAG_NEED_RTNL |
11988                                   NL80211_FLAG_CLEAR_SKB,
11989         },
11990         {
11991                 .cmd = NL80211_CMD_DEL_KEY,
11992                 .doit = nl80211_del_key,
11993                 .policy = nl80211_policy,
11994                 .flags = GENL_UNS_ADMIN_PERM,
11995                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11996                                   NL80211_FLAG_NEED_RTNL,
11997         },
11998         {
11999                 .cmd = NL80211_CMD_SET_BEACON,
12000                 .policy = nl80211_policy,
12001                 .flags = GENL_UNS_ADMIN_PERM,
12002                 .doit = nl80211_set_beacon,
12003                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12004                                   NL80211_FLAG_NEED_RTNL,
12005         },
12006         {
12007                 .cmd = NL80211_CMD_START_AP,
12008                 .policy = nl80211_policy,
12009                 .flags = GENL_UNS_ADMIN_PERM,
12010                 .doit = nl80211_start_ap,
12011                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12012                                   NL80211_FLAG_NEED_RTNL,
12013         },
12014         {
12015                 .cmd = NL80211_CMD_STOP_AP,
12016                 .policy = nl80211_policy,
12017                 .flags = GENL_UNS_ADMIN_PERM,
12018                 .doit = nl80211_stop_ap,
12019                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12020                                   NL80211_FLAG_NEED_RTNL,
12021         },
12022         {
12023                 .cmd = NL80211_CMD_GET_STATION,
12024                 .doit = nl80211_get_station,
12025                 .dumpit = nl80211_dump_station,
12026                 .policy = nl80211_policy,
12027                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12028                                   NL80211_FLAG_NEED_RTNL,
12029         },
12030         {
12031                 .cmd = NL80211_CMD_SET_STATION,
12032                 .doit = nl80211_set_station,
12033                 .policy = nl80211_policy,
12034                 .flags = GENL_UNS_ADMIN_PERM,
12035                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12036                                   NL80211_FLAG_NEED_RTNL,
12037         },
12038         {
12039                 .cmd = NL80211_CMD_NEW_STATION,
12040                 .doit = nl80211_new_station,
12041                 .policy = nl80211_policy,
12042                 .flags = GENL_UNS_ADMIN_PERM,
12043                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12044                                   NL80211_FLAG_NEED_RTNL,
12045         },
12046         {
12047                 .cmd = NL80211_CMD_DEL_STATION,
12048                 .doit = nl80211_del_station,
12049                 .policy = nl80211_policy,
12050                 .flags = GENL_UNS_ADMIN_PERM,
12051                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12052                                   NL80211_FLAG_NEED_RTNL,
12053         },
12054         {
12055                 .cmd = NL80211_CMD_GET_MPATH,
12056                 .doit = nl80211_get_mpath,
12057                 .dumpit = nl80211_dump_mpath,
12058                 .policy = nl80211_policy,
12059                 .flags = GENL_UNS_ADMIN_PERM,
12060                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12061                                   NL80211_FLAG_NEED_RTNL,
12062         },
12063         {
12064                 .cmd = NL80211_CMD_GET_MPP,
12065                 .doit = nl80211_get_mpp,
12066                 .dumpit = nl80211_dump_mpp,
12067                 .policy = nl80211_policy,
12068                 .flags = GENL_UNS_ADMIN_PERM,
12069                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12070                                   NL80211_FLAG_NEED_RTNL,
12071         },
12072         {
12073                 .cmd = NL80211_CMD_SET_MPATH,
12074                 .doit = nl80211_set_mpath,
12075                 .policy = nl80211_policy,
12076                 .flags = GENL_UNS_ADMIN_PERM,
12077                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12078                                   NL80211_FLAG_NEED_RTNL,
12079         },
12080         {
12081                 .cmd = NL80211_CMD_NEW_MPATH,
12082                 .doit = nl80211_new_mpath,
12083                 .policy = nl80211_policy,
12084                 .flags = GENL_UNS_ADMIN_PERM,
12085                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12086                                   NL80211_FLAG_NEED_RTNL,
12087         },
12088         {
12089                 .cmd = NL80211_CMD_DEL_MPATH,
12090                 .doit = nl80211_del_mpath,
12091                 .policy = nl80211_policy,
12092                 .flags = GENL_UNS_ADMIN_PERM,
12093                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12094                                   NL80211_FLAG_NEED_RTNL,
12095         },
12096         {
12097                 .cmd = NL80211_CMD_SET_BSS,
12098                 .doit = nl80211_set_bss,
12099                 .policy = nl80211_policy,
12100                 .flags = GENL_UNS_ADMIN_PERM,
12101                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12102                                   NL80211_FLAG_NEED_RTNL,
12103         },
12104         {
12105                 .cmd = NL80211_CMD_GET_REG,
12106                 .doit = nl80211_get_reg_do,
12107                 .dumpit = nl80211_get_reg_dump,
12108                 .policy = nl80211_policy,
12109                 .internal_flags = NL80211_FLAG_NEED_RTNL,
12110                 /* can be retrieved by unprivileged users */
12111         },
12112 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
12113         {
12114                 .cmd = NL80211_CMD_SET_REG,
12115                 .doit = nl80211_set_reg,
12116                 .policy = nl80211_policy,
12117                 .flags = GENL_ADMIN_PERM,
12118                 .internal_flags = NL80211_FLAG_NEED_RTNL,
12119         },
12120 #endif
12121         {
12122                 .cmd = NL80211_CMD_REQ_SET_REG,
12123                 .doit = nl80211_req_set_reg,
12124                 .policy = nl80211_policy,
12125                 .flags = GENL_ADMIN_PERM,
12126         },
12127         {
12128                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
12129                 .doit = nl80211_get_mesh_config,
12130                 .policy = nl80211_policy,
12131                 /* can be retrieved by unprivileged users */
12132                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12133                                   NL80211_FLAG_NEED_RTNL,
12134         },
12135         {
12136                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
12137                 .doit = nl80211_update_mesh_config,
12138                 .policy = nl80211_policy,
12139                 .flags = GENL_UNS_ADMIN_PERM,
12140                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12141                                   NL80211_FLAG_NEED_RTNL,
12142         },
12143         {
12144                 .cmd = NL80211_CMD_TRIGGER_SCAN,
12145                 .doit = nl80211_trigger_scan,
12146                 .policy = nl80211_policy,
12147                 .flags = GENL_UNS_ADMIN_PERM,
12148                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12149                                   NL80211_FLAG_NEED_RTNL,
12150         },
12151         {
12152                 .cmd = NL80211_CMD_ABORT_SCAN,
12153                 .doit = nl80211_abort_scan,
12154                 .policy = nl80211_policy,
12155                 .flags = GENL_UNS_ADMIN_PERM,
12156                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12157                                   NL80211_FLAG_NEED_RTNL,
12158         },
12159         {
12160                 .cmd = NL80211_CMD_GET_SCAN,
12161                 .policy = nl80211_policy,
12162                 .dumpit = nl80211_dump_scan,
12163         },
12164         {
12165                 .cmd = NL80211_CMD_START_SCHED_SCAN,
12166                 .doit = nl80211_start_sched_scan,
12167                 .policy = nl80211_policy,
12168                 .flags = GENL_UNS_ADMIN_PERM,
12169                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12170                                   NL80211_FLAG_NEED_RTNL,
12171         },
12172         {
12173                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
12174                 .doit = nl80211_stop_sched_scan,
12175                 .policy = nl80211_policy,
12176                 .flags = GENL_UNS_ADMIN_PERM,
12177                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12178                                   NL80211_FLAG_NEED_RTNL,
12179         },
12180         {
12181                 .cmd = NL80211_CMD_AUTHENTICATE,
12182                 .doit = nl80211_authenticate,
12183                 .policy = nl80211_policy,
12184                 .flags = GENL_UNS_ADMIN_PERM,
12185                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12186                                   NL80211_FLAG_NEED_RTNL |
12187                                   NL80211_FLAG_CLEAR_SKB,
12188         },
12189         {
12190                 .cmd = NL80211_CMD_ASSOCIATE,
12191                 .doit = nl80211_associate,
12192                 .policy = nl80211_policy,
12193                 .flags = GENL_UNS_ADMIN_PERM,
12194                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12195                                   NL80211_FLAG_NEED_RTNL,
12196         },
12197         {
12198                 .cmd = NL80211_CMD_DEAUTHENTICATE,
12199                 .doit = nl80211_deauthenticate,
12200                 .policy = nl80211_policy,
12201                 .flags = GENL_UNS_ADMIN_PERM,
12202                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12203                                   NL80211_FLAG_NEED_RTNL,
12204         },
12205         {
12206                 .cmd = NL80211_CMD_DISASSOCIATE,
12207                 .doit = nl80211_disassociate,
12208                 .policy = nl80211_policy,
12209                 .flags = GENL_UNS_ADMIN_PERM,
12210                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12211                                   NL80211_FLAG_NEED_RTNL,
12212         },
12213         {
12214                 .cmd = NL80211_CMD_JOIN_IBSS,
12215                 .doit = nl80211_join_ibss,
12216                 .policy = nl80211_policy,
12217                 .flags = GENL_UNS_ADMIN_PERM,
12218                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12219                                   NL80211_FLAG_NEED_RTNL,
12220         },
12221         {
12222                 .cmd = NL80211_CMD_LEAVE_IBSS,
12223                 .doit = nl80211_leave_ibss,
12224                 .policy = nl80211_policy,
12225                 .flags = GENL_UNS_ADMIN_PERM,
12226                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12227                                   NL80211_FLAG_NEED_RTNL,
12228         },
12229 #ifdef CONFIG_NL80211_TESTMODE
12230         {
12231                 .cmd = NL80211_CMD_TESTMODE,
12232                 .doit = nl80211_testmode_do,
12233                 .dumpit = nl80211_testmode_dump,
12234                 .policy = nl80211_policy,
12235                 .flags = GENL_UNS_ADMIN_PERM,
12236                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12237                                   NL80211_FLAG_NEED_RTNL,
12238         },
12239 #endif
12240         {
12241                 .cmd = NL80211_CMD_CONNECT,
12242                 .doit = nl80211_connect,
12243                 .policy = nl80211_policy,
12244                 .flags = GENL_UNS_ADMIN_PERM,
12245                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12246                                   NL80211_FLAG_NEED_RTNL,
12247         },
12248         {
12249                 .cmd = NL80211_CMD_DISCONNECT,
12250                 .doit = nl80211_disconnect,
12251                 .policy = nl80211_policy,
12252                 .flags = GENL_UNS_ADMIN_PERM,
12253                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12254                                   NL80211_FLAG_NEED_RTNL,
12255         },
12256         {
12257                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
12258                 .doit = nl80211_wiphy_netns,
12259                 .policy = nl80211_policy,
12260                 .flags = GENL_UNS_ADMIN_PERM,
12261                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12262                                   NL80211_FLAG_NEED_RTNL,
12263         },
12264         {
12265                 .cmd = NL80211_CMD_GET_SURVEY,
12266                 .policy = nl80211_policy,
12267                 .dumpit = nl80211_dump_survey,
12268         },
12269         {
12270                 .cmd = NL80211_CMD_SET_PMKSA,
12271                 .doit = nl80211_setdel_pmksa,
12272                 .policy = nl80211_policy,
12273                 .flags = GENL_UNS_ADMIN_PERM,
12274                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12275                                   NL80211_FLAG_NEED_RTNL,
12276         },
12277         {
12278                 .cmd = NL80211_CMD_DEL_PMKSA,
12279                 .doit = nl80211_setdel_pmksa,
12280                 .policy = nl80211_policy,
12281                 .flags = GENL_UNS_ADMIN_PERM,
12282                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12283                                   NL80211_FLAG_NEED_RTNL,
12284         },
12285         {
12286                 .cmd = NL80211_CMD_FLUSH_PMKSA,
12287                 .doit = nl80211_flush_pmksa,
12288                 .policy = nl80211_policy,
12289                 .flags = GENL_UNS_ADMIN_PERM,
12290                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12291                                   NL80211_FLAG_NEED_RTNL,
12292         },
12293         {
12294                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
12295                 .doit = nl80211_remain_on_channel,
12296                 .policy = nl80211_policy,
12297                 .flags = GENL_UNS_ADMIN_PERM,
12298                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12299                                   NL80211_FLAG_NEED_RTNL,
12300         },
12301         {
12302                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
12303                 .doit = nl80211_cancel_remain_on_channel,
12304                 .policy = nl80211_policy,
12305                 .flags = GENL_UNS_ADMIN_PERM,
12306                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12307                                   NL80211_FLAG_NEED_RTNL,
12308         },
12309         {
12310                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
12311                 .doit = nl80211_set_tx_bitrate_mask,
12312                 .policy = nl80211_policy,
12313                 .flags = GENL_UNS_ADMIN_PERM,
12314                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12315                                   NL80211_FLAG_NEED_RTNL,
12316         },
12317         {
12318                 .cmd = NL80211_CMD_REGISTER_FRAME,
12319                 .doit = nl80211_register_mgmt,
12320                 .policy = nl80211_policy,
12321                 .flags = GENL_UNS_ADMIN_PERM,
12322                 .internal_flags = NL80211_FLAG_NEED_WDEV |
12323                                   NL80211_FLAG_NEED_RTNL,
12324         },
12325         {
12326                 .cmd = NL80211_CMD_FRAME,
12327                 .doit = nl80211_tx_mgmt,
12328                 .policy = nl80211_policy,
12329                 .flags = GENL_UNS_ADMIN_PERM,
12330                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12331                                   NL80211_FLAG_NEED_RTNL,
12332         },
12333         {
12334                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
12335                 .doit = nl80211_tx_mgmt_cancel_wait,
12336                 .policy = nl80211_policy,
12337                 .flags = GENL_UNS_ADMIN_PERM,
12338                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12339                                   NL80211_FLAG_NEED_RTNL,
12340         },
12341         {
12342                 .cmd = NL80211_CMD_SET_POWER_SAVE,
12343                 .doit = nl80211_set_power_save,
12344                 .policy = nl80211_policy,
12345                 .flags = GENL_UNS_ADMIN_PERM,
12346                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12347                                   NL80211_FLAG_NEED_RTNL,
12348         },
12349         {
12350                 .cmd = NL80211_CMD_GET_POWER_SAVE,
12351                 .doit = nl80211_get_power_save,
12352                 .policy = nl80211_policy,
12353                 /* can be retrieved by unprivileged users */
12354                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12355                                   NL80211_FLAG_NEED_RTNL,
12356         },
12357         {
12358                 .cmd = NL80211_CMD_SET_CQM,
12359                 .doit = nl80211_set_cqm,
12360                 .policy = nl80211_policy,
12361                 .flags = GENL_UNS_ADMIN_PERM,
12362                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12363                                   NL80211_FLAG_NEED_RTNL,
12364         },
12365         {
12366                 .cmd = NL80211_CMD_SET_CHANNEL,
12367                 .doit = nl80211_set_channel,
12368                 .policy = nl80211_policy,
12369                 .flags = GENL_UNS_ADMIN_PERM,
12370                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12371                                   NL80211_FLAG_NEED_RTNL,
12372         },
12373         {
12374                 .cmd = NL80211_CMD_SET_WDS_PEER,
12375                 .doit = nl80211_set_wds_peer,
12376                 .policy = nl80211_policy,
12377                 .flags = GENL_UNS_ADMIN_PERM,
12378                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12379                                   NL80211_FLAG_NEED_RTNL,
12380         },
12381         {
12382                 .cmd = NL80211_CMD_JOIN_MESH,
12383                 .doit = nl80211_join_mesh,
12384                 .policy = nl80211_policy,
12385                 .flags = GENL_UNS_ADMIN_PERM,
12386                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12387                                   NL80211_FLAG_NEED_RTNL,
12388         },
12389         {
12390                 .cmd = NL80211_CMD_LEAVE_MESH,
12391                 .doit = nl80211_leave_mesh,
12392                 .policy = nl80211_policy,
12393                 .flags = GENL_UNS_ADMIN_PERM,
12394                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12395                                   NL80211_FLAG_NEED_RTNL,
12396         },
12397         {
12398                 .cmd = NL80211_CMD_JOIN_OCB,
12399                 .doit = nl80211_join_ocb,
12400                 .policy = nl80211_policy,
12401                 .flags = GENL_UNS_ADMIN_PERM,
12402                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12403                                   NL80211_FLAG_NEED_RTNL,
12404         },
12405         {
12406                 .cmd = NL80211_CMD_LEAVE_OCB,
12407                 .doit = nl80211_leave_ocb,
12408                 .policy = nl80211_policy,
12409                 .flags = GENL_UNS_ADMIN_PERM,
12410                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12411                                   NL80211_FLAG_NEED_RTNL,
12412         },
12413 #ifdef CONFIG_PM
12414         {
12415                 .cmd = NL80211_CMD_GET_WOWLAN,
12416                 .doit = nl80211_get_wowlan,
12417                 .policy = nl80211_policy,
12418                 /* can be retrieved by unprivileged users */
12419                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12420                                   NL80211_FLAG_NEED_RTNL,
12421         },
12422         {
12423                 .cmd = NL80211_CMD_SET_WOWLAN,
12424                 .doit = nl80211_set_wowlan,
12425                 .policy = nl80211_policy,
12426                 .flags = GENL_UNS_ADMIN_PERM,
12427                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12428                                   NL80211_FLAG_NEED_RTNL,
12429         },
12430 #endif
12431         {
12432                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
12433                 .doit = nl80211_set_rekey_data,
12434                 .policy = nl80211_policy,
12435                 .flags = GENL_UNS_ADMIN_PERM,
12436                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12437                                   NL80211_FLAG_NEED_RTNL |
12438                                   NL80211_FLAG_CLEAR_SKB,
12439         },
12440         {
12441                 .cmd = NL80211_CMD_TDLS_MGMT,
12442                 .doit = nl80211_tdls_mgmt,
12443                 .policy = nl80211_policy,
12444                 .flags = GENL_UNS_ADMIN_PERM,
12445                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12446                                   NL80211_FLAG_NEED_RTNL,
12447         },
12448         {
12449                 .cmd = NL80211_CMD_TDLS_OPER,
12450                 .doit = nl80211_tdls_oper,
12451                 .policy = nl80211_policy,
12452                 .flags = GENL_UNS_ADMIN_PERM,
12453                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12454                                   NL80211_FLAG_NEED_RTNL,
12455         },
12456         {
12457                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
12458                 .doit = nl80211_register_unexpected_frame,
12459                 .policy = nl80211_policy,
12460                 .flags = GENL_UNS_ADMIN_PERM,
12461                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12462                                   NL80211_FLAG_NEED_RTNL,
12463         },
12464         {
12465                 .cmd = NL80211_CMD_PROBE_CLIENT,
12466                 .doit = nl80211_probe_client,
12467                 .policy = nl80211_policy,
12468                 .flags = GENL_UNS_ADMIN_PERM,
12469                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12470                                   NL80211_FLAG_NEED_RTNL,
12471         },
12472         {
12473                 .cmd = NL80211_CMD_REGISTER_BEACONS,
12474                 .doit = nl80211_register_beacons,
12475                 .policy = nl80211_policy,
12476                 .flags = GENL_UNS_ADMIN_PERM,
12477                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12478                                   NL80211_FLAG_NEED_RTNL,
12479         },
12480         {
12481                 .cmd = NL80211_CMD_SET_NOACK_MAP,
12482                 .doit = nl80211_set_noack_map,
12483                 .policy = nl80211_policy,
12484                 .flags = GENL_UNS_ADMIN_PERM,
12485                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12486                                   NL80211_FLAG_NEED_RTNL,
12487         },
12488         {
12489                 .cmd = NL80211_CMD_START_P2P_DEVICE,
12490                 .doit = nl80211_start_p2p_device,
12491                 .policy = nl80211_policy,
12492                 .flags = GENL_UNS_ADMIN_PERM,
12493                 .internal_flags = NL80211_FLAG_NEED_WDEV |
12494                                   NL80211_FLAG_NEED_RTNL,
12495         },
12496         {
12497                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
12498                 .doit = nl80211_stop_p2p_device,
12499                 .policy = nl80211_policy,
12500                 .flags = GENL_UNS_ADMIN_PERM,
12501                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12502                                   NL80211_FLAG_NEED_RTNL,
12503         },
12504         {
12505                 .cmd = NL80211_CMD_START_NAN,
12506                 .doit = nl80211_start_nan,
12507                 .policy = nl80211_policy,
12508                 .flags = GENL_ADMIN_PERM,
12509                 .internal_flags = NL80211_FLAG_NEED_WDEV |
12510                                   NL80211_FLAG_NEED_RTNL,
12511         },
12512         {
12513                 .cmd = NL80211_CMD_STOP_NAN,
12514                 .doit = nl80211_stop_nan,
12515                 .policy = nl80211_policy,
12516                 .flags = GENL_ADMIN_PERM,
12517                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12518                                   NL80211_FLAG_NEED_RTNL,
12519         },
12520         {
12521                 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
12522                 .doit = nl80211_nan_add_func,
12523                 .policy = nl80211_policy,
12524                 .flags = GENL_ADMIN_PERM,
12525                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12526                                   NL80211_FLAG_NEED_RTNL,
12527         },
12528         {
12529                 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
12530                 .doit = nl80211_nan_del_func,
12531                 .policy = nl80211_policy,
12532                 .flags = GENL_ADMIN_PERM,
12533                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12534                                   NL80211_FLAG_NEED_RTNL,
12535         },
12536         {
12537                 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
12538                 .doit = nl80211_nan_change_config,
12539                 .policy = nl80211_policy,
12540                 .flags = GENL_ADMIN_PERM,
12541                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12542                                   NL80211_FLAG_NEED_RTNL,
12543         },
12544         {
12545                 .cmd = NL80211_CMD_SET_MCAST_RATE,
12546                 .doit = nl80211_set_mcast_rate,
12547                 .policy = nl80211_policy,
12548                 .flags = GENL_UNS_ADMIN_PERM,
12549                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12550                                   NL80211_FLAG_NEED_RTNL,
12551         },
12552         {
12553                 .cmd = NL80211_CMD_SET_MAC_ACL,
12554                 .doit = nl80211_set_mac_acl,
12555                 .policy = nl80211_policy,
12556                 .flags = GENL_UNS_ADMIN_PERM,
12557                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12558                                   NL80211_FLAG_NEED_RTNL,
12559         },
12560         {
12561                 .cmd = NL80211_CMD_RADAR_DETECT,
12562                 .doit = nl80211_start_radar_detection,
12563                 .policy = nl80211_policy,
12564                 .flags = GENL_UNS_ADMIN_PERM,
12565                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12566                                   NL80211_FLAG_NEED_RTNL,
12567         },
12568         {
12569                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
12570                 .doit = nl80211_get_protocol_features,
12571                 .policy = nl80211_policy,
12572         },
12573         {
12574                 .cmd = NL80211_CMD_UPDATE_FT_IES,
12575                 .doit = nl80211_update_ft_ies,
12576                 .policy = nl80211_policy,
12577                 .flags = GENL_UNS_ADMIN_PERM,
12578                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12579                                   NL80211_FLAG_NEED_RTNL,
12580         },
12581         {
12582                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
12583                 .doit = nl80211_crit_protocol_start,
12584                 .policy = nl80211_policy,
12585                 .flags = GENL_UNS_ADMIN_PERM,
12586                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12587                                   NL80211_FLAG_NEED_RTNL,
12588         },
12589         {
12590                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
12591                 .doit = nl80211_crit_protocol_stop,
12592                 .policy = nl80211_policy,
12593                 .flags = GENL_UNS_ADMIN_PERM,
12594                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12595                                   NL80211_FLAG_NEED_RTNL,
12596         },
12597         {
12598                 .cmd = NL80211_CMD_GET_COALESCE,
12599                 .doit = nl80211_get_coalesce,
12600                 .policy = nl80211_policy,
12601                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12602                                   NL80211_FLAG_NEED_RTNL,
12603         },
12604         {
12605                 .cmd = NL80211_CMD_SET_COALESCE,
12606                 .doit = nl80211_set_coalesce,
12607                 .policy = nl80211_policy,
12608                 .flags = GENL_UNS_ADMIN_PERM,
12609                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12610                                   NL80211_FLAG_NEED_RTNL,
12611         },
12612         {
12613                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
12614                 .doit = nl80211_channel_switch,
12615                 .policy = nl80211_policy,
12616                 .flags = GENL_UNS_ADMIN_PERM,
12617                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12618                                   NL80211_FLAG_NEED_RTNL,
12619         },
12620         {
12621                 .cmd = NL80211_CMD_VENDOR,
12622                 .doit = nl80211_vendor_cmd,
12623                 .dumpit = nl80211_vendor_cmd_dump,
12624                 .policy = nl80211_policy,
12625                 .flags = GENL_UNS_ADMIN_PERM,
12626                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12627                                   NL80211_FLAG_NEED_RTNL,
12628         },
12629         {
12630                 .cmd = NL80211_CMD_SET_QOS_MAP,
12631                 .doit = nl80211_set_qos_map,
12632                 .policy = nl80211_policy,
12633                 .flags = GENL_UNS_ADMIN_PERM,
12634                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12635                                   NL80211_FLAG_NEED_RTNL,
12636         },
12637         {
12638                 .cmd = NL80211_CMD_ADD_TX_TS,
12639                 .doit = nl80211_add_tx_ts,
12640                 .policy = nl80211_policy,
12641                 .flags = GENL_UNS_ADMIN_PERM,
12642                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12643                                   NL80211_FLAG_NEED_RTNL,
12644         },
12645         {
12646                 .cmd = NL80211_CMD_DEL_TX_TS,
12647                 .doit = nl80211_del_tx_ts,
12648                 .policy = nl80211_policy,
12649                 .flags = GENL_UNS_ADMIN_PERM,
12650                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12651                                   NL80211_FLAG_NEED_RTNL,
12652         },
12653         {
12654                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
12655                 .doit = nl80211_tdls_channel_switch,
12656                 .policy = nl80211_policy,
12657                 .flags = GENL_UNS_ADMIN_PERM,
12658                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12659                                   NL80211_FLAG_NEED_RTNL,
12660         },
12661         {
12662                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
12663                 .doit = nl80211_tdls_cancel_channel_switch,
12664                 .policy = nl80211_policy,
12665                 .flags = GENL_UNS_ADMIN_PERM,
12666                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12667                                   NL80211_FLAG_NEED_RTNL,
12668         },
12669 };
12670
12671 /* notification functions */
12672
12673 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
12674                           enum nl80211_commands cmd)
12675 {
12676         struct sk_buff *msg;
12677         struct nl80211_dump_wiphy_state state = {};
12678
12679         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
12680                 cmd != NL80211_CMD_DEL_WIPHY);
12681
12682         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12683         if (!msg)
12684                 return;
12685
12686         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
12687                 nlmsg_free(msg);
12688                 return;
12689         }
12690
12691         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12692                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
12693 }
12694
12695 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
12696                                 struct wireless_dev *wdev,
12697                                 enum nl80211_commands cmd)
12698 {
12699         struct sk_buff *msg;
12700
12701         WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
12702                 cmd != NL80211_CMD_DEL_INTERFACE);
12703
12704         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12705         if (!msg)
12706                 return;
12707
12708         if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev,
12709                                cmd == NL80211_CMD_DEL_INTERFACE) < 0) {
12710                 nlmsg_free(msg);
12711                 return;
12712         }
12713
12714         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12715                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
12716 }
12717
12718 static int nl80211_add_scan_req(struct sk_buff *msg,
12719                                 struct cfg80211_registered_device *rdev)
12720 {
12721         struct cfg80211_scan_request *req = rdev->scan_req;
12722         struct nlattr *nest;
12723         int i;
12724
12725         if (WARN_ON(!req))
12726                 return 0;
12727
12728         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
12729         if (!nest)
12730                 goto nla_put_failure;
12731         for (i = 0; i < req->n_ssids; i++) {
12732                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
12733                         goto nla_put_failure;
12734         }
12735         nla_nest_end(msg, nest);
12736
12737         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
12738         if (!nest)
12739                 goto nla_put_failure;
12740         for (i = 0; i < req->n_channels; i++) {
12741                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
12742                         goto nla_put_failure;
12743         }
12744         nla_nest_end(msg, nest);
12745
12746         if (req->ie &&
12747             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
12748                 goto nla_put_failure;
12749
12750         if (req->flags &&
12751             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
12752                 goto nla_put_failure;
12753
12754         if (req->info.scan_start_tsf &&
12755             (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
12756                                req->info.scan_start_tsf, NL80211_BSS_PAD) ||
12757              nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
12758                      req->info.tsf_bssid)))
12759                 goto nla_put_failure;
12760
12761         return 0;
12762  nla_put_failure:
12763         return -ENOBUFS;
12764 }
12765
12766 static int nl80211_send_scan_msg(struct sk_buff *msg,
12767                                  struct cfg80211_registered_device *rdev,
12768                                  struct wireless_dev *wdev,
12769                                  u32 portid, u32 seq, int flags,
12770                                  u32 cmd)
12771 {
12772         void *hdr;
12773
12774         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
12775         if (!hdr)
12776                 return -1;
12777
12778         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12779             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12780                                          wdev->netdev->ifindex)) ||
12781             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12782                               NL80211_ATTR_PAD))
12783                 goto nla_put_failure;
12784
12785         /* ignore errors and send incomplete event anyway */
12786         nl80211_add_scan_req(msg, rdev);
12787
12788         genlmsg_end(msg, hdr);
12789         return 0;
12790
12791  nla_put_failure:
12792         genlmsg_cancel(msg, hdr);
12793         return -EMSGSIZE;
12794 }
12795
12796 static int
12797 nl80211_send_sched_scan_msg(struct sk_buff *msg,
12798                             struct cfg80211_registered_device *rdev,
12799                             struct net_device *netdev,
12800                             u32 portid, u32 seq, int flags, u32 cmd)
12801 {
12802         void *hdr;
12803
12804         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
12805         if (!hdr)
12806                 return -1;
12807
12808         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12809             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
12810                 goto nla_put_failure;
12811
12812         genlmsg_end(msg, hdr);
12813         return 0;
12814
12815  nla_put_failure:
12816         genlmsg_cancel(msg, hdr);
12817         return -EMSGSIZE;
12818 }
12819
12820 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
12821                              struct wireless_dev *wdev)
12822 {
12823         struct sk_buff *msg;
12824
12825         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12826         if (!msg)
12827                 return;
12828
12829         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
12830                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
12831                 nlmsg_free(msg);
12832                 return;
12833         }
12834
12835         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12836                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
12837 }
12838
12839 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
12840                                        struct wireless_dev *wdev, bool aborted)
12841 {
12842         struct sk_buff *msg;
12843
12844         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12845         if (!msg)
12846                 return NULL;
12847
12848         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
12849                                   aborted ? NL80211_CMD_SCAN_ABORTED :
12850                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
12851                 nlmsg_free(msg);
12852                 return NULL;
12853         }
12854
12855         return msg;
12856 }
12857
12858 void nl80211_send_scan_result(struct cfg80211_registered_device *rdev,
12859                               struct sk_buff *msg)
12860 {
12861         if (!msg)
12862                 return;
12863
12864         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12865                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
12866 }
12867
12868 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
12869                                      struct net_device *netdev)
12870 {
12871         struct sk_buff *msg;
12872
12873         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12874         if (!msg)
12875                 return;
12876
12877         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
12878                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
12879                 nlmsg_free(msg);
12880                 return;
12881         }
12882
12883         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12884                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
12885 }
12886
12887 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
12888                              struct net_device *netdev, u32 cmd)
12889 {
12890         struct sk_buff *msg;
12891
12892         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12893         if (!msg)
12894                 return;
12895
12896         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
12897                 nlmsg_free(msg);
12898                 return;
12899         }
12900
12901         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12902                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
12903 }
12904
12905 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
12906                                           struct regulatory_request *request)
12907 {
12908         /* Userspace can always count this one always being set */
12909         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
12910                 goto nla_put_failure;
12911
12912         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
12913                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
12914                                NL80211_REGDOM_TYPE_WORLD))
12915                         goto nla_put_failure;
12916         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
12917                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
12918                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
12919                         goto nla_put_failure;
12920         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
12921                    request->intersect) {
12922                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
12923                                NL80211_REGDOM_TYPE_INTERSECTION))
12924                         goto nla_put_failure;
12925         } else {
12926                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
12927                                NL80211_REGDOM_TYPE_COUNTRY) ||
12928                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
12929                                    request->alpha2))
12930                         goto nla_put_failure;
12931         }
12932
12933         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
12934                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
12935
12936                 if (wiphy &&
12937                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
12938                         goto nla_put_failure;
12939
12940                 if (wiphy &&
12941                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
12942                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
12943                         goto nla_put_failure;
12944         }
12945
12946         return true;
12947
12948 nla_put_failure:
12949         return false;
12950 }
12951
12952 /*
12953  * This can happen on global regulatory changes or device specific settings
12954  * based on custom regulatory domains.
12955  */
12956 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
12957                                      struct regulatory_request *request)
12958 {
12959         struct sk_buff *msg;
12960         void *hdr;
12961
12962         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12963         if (!msg)
12964                 return;
12965
12966         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
12967         if (!hdr) {
12968                 nlmsg_free(msg);
12969                 return;
12970         }
12971
12972         if (nl80211_reg_change_event_fill(msg, request) == false)
12973                 goto nla_put_failure;
12974
12975         genlmsg_end(msg, hdr);
12976
12977         rcu_read_lock();
12978         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
12979                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
12980         rcu_read_unlock();
12981
12982         return;
12983
12984 nla_put_failure:
12985         genlmsg_cancel(msg, hdr);
12986         nlmsg_free(msg);
12987 }
12988
12989 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
12990                                     struct net_device *netdev,
12991                                     const u8 *buf, size_t len,
12992                                     enum nl80211_commands cmd, gfp_t gfp,
12993                                     int uapsd_queues)
12994 {
12995         struct sk_buff *msg;
12996         void *hdr;
12997
12998         msg = nlmsg_new(100 + len, gfp);
12999         if (!msg)
13000                 return;
13001
13002         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
13003         if (!hdr) {
13004                 nlmsg_free(msg);
13005                 return;
13006         }
13007
13008         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13009             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13010             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
13011                 goto nla_put_failure;
13012
13013         if (uapsd_queues >= 0) {
13014                 struct nlattr *nla_wmm =
13015                         nla_nest_start(msg, NL80211_ATTR_STA_WME);
13016                 if (!nla_wmm)
13017                         goto nla_put_failure;
13018
13019                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
13020                                uapsd_queues))
13021                         goto nla_put_failure;
13022
13023                 nla_nest_end(msg, nla_wmm);
13024         }
13025
13026         genlmsg_end(msg, hdr);
13027
13028         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13029                                 NL80211_MCGRP_MLME, gfp);
13030         return;
13031
13032  nla_put_failure:
13033         genlmsg_cancel(msg, hdr);
13034         nlmsg_free(msg);
13035 }
13036
13037 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
13038                           struct net_device *netdev, const u8 *buf,
13039                           size_t len, gfp_t gfp)
13040 {
13041         nl80211_send_mlme_event(rdev, netdev, buf, len,
13042                                 NL80211_CMD_AUTHENTICATE, gfp, -1);
13043 }
13044
13045 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
13046                            struct net_device *netdev, const u8 *buf,
13047                            size_t len, gfp_t gfp, int uapsd_queues)
13048 {
13049         nl80211_send_mlme_event(rdev, netdev, buf, len,
13050                                 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues);
13051 }
13052
13053 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
13054                          struct net_device *netdev, const u8 *buf,
13055                          size_t len, gfp_t gfp)
13056 {
13057         nl80211_send_mlme_event(rdev, netdev, buf, len,
13058                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1);
13059 }
13060
13061 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
13062                            struct net_device *netdev, const u8 *buf,
13063                            size_t len, gfp_t gfp)
13064 {
13065         nl80211_send_mlme_event(rdev, netdev, buf, len,
13066                                 NL80211_CMD_DISASSOCIATE, gfp, -1);
13067 }
13068
13069 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
13070                                   size_t len)
13071 {
13072         struct wireless_dev *wdev = dev->ieee80211_ptr;
13073         struct wiphy *wiphy = wdev->wiphy;
13074         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13075         const struct ieee80211_mgmt *mgmt = (void *)buf;
13076         u32 cmd;
13077
13078         if (WARN_ON(len < 2))
13079                 return;
13080
13081         if (ieee80211_is_deauth(mgmt->frame_control))
13082                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
13083         else
13084                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
13085
13086         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
13087         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1);
13088 }
13089 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
13090
13091 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
13092                                       struct net_device *netdev, int cmd,
13093                                       const u8 *addr, gfp_t gfp)
13094 {
13095         struct sk_buff *msg;
13096         void *hdr;
13097
13098         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13099         if (!msg)
13100                 return;
13101
13102         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
13103         if (!hdr) {
13104                 nlmsg_free(msg);
13105                 return;
13106         }
13107
13108         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13109             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13110             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
13111             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
13112                 goto nla_put_failure;
13113
13114         genlmsg_end(msg, hdr);
13115
13116         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13117                                 NL80211_MCGRP_MLME, gfp);
13118         return;
13119
13120  nla_put_failure:
13121         genlmsg_cancel(msg, hdr);
13122         nlmsg_free(msg);
13123 }
13124
13125 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
13126                                struct net_device *netdev, const u8 *addr,
13127                                gfp_t gfp)
13128 {
13129         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
13130                                   addr, gfp);
13131 }
13132
13133 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
13134                                 struct net_device *netdev, const u8 *addr,
13135                                 gfp_t gfp)
13136 {
13137         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
13138                                   addr, gfp);
13139 }
13140
13141 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
13142                                  struct net_device *netdev, const u8 *bssid,
13143                                  const u8 *req_ie, size_t req_ie_len,
13144                                  const u8 *resp_ie, size_t resp_ie_len,
13145                                  int status, gfp_t gfp)
13146 {
13147         struct sk_buff *msg;
13148         void *hdr;
13149
13150         msg = nlmsg_new(100 + req_ie_len + resp_ie_len, gfp);
13151         if (!msg)
13152                 return;
13153
13154         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
13155         if (!hdr) {
13156                 nlmsg_free(msg);
13157                 return;
13158         }
13159
13160         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13161             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13162             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
13163             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
13164                         status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
13165                         status) ||
13166             (status < 0 && nla_put_flag(msg, NL80211_ATTR_TIMED_OUT)) ||
13167             (req_ie &&
13168              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
13169             (resp_ie &&
13170              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
13171                 goto nla_put_failure;
13172
13173         genlmsg_end(msg, hdr);
13174
13175         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13176                                 NL80211_MCGRP_MLME, gfp);
13177         return;
13178
13179  nla_put_failure:
13180         genlmsg_cancel(msg, hdr);
13181         nlmsg_free(msg);
13182 }
13183
13184 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
13185                          struct net_device *netdev, const u8 *bssid,
13186                          const u8 *req_ie, size_t req_ie_len,
13187                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
13188 {
13189         struct sk_buff *msg;
13190         void *hdr;
13191
13192         msg = nlmsg_new(100 + req_ie_len + resp_ie_len, gfp);
13193         if (!msg)
13194                 return;
13195
13196         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
13197         if (!hdr) {
13198                 nlmsg_free(msg);
13199                 return;
13200         }
13201
13202         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13203             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13204             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
13205             (req_ie &&
13206              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
13207             (resp_ie &&
13208              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
13209                 goto nla_put_failure;
13210
13211         genlmsg_end(msg, hdr);
13212
13213         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13214                                 NL80211_MCGRP_MLME, gfp);
13215         return;
13216
13217  nla_put_failure:
13218         genlmsg_cancel(msg, hdr);
13219         nlmsg_free(msg);
13220 }
13221
13222 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
13223                                struct net_device *netdev, u16 reason,
13224                                const u8 *ie, size_t ie_len, bool from_ap)
13225 {
13226         struct sk_buff *msg;
13227         void *hdr;
13228
13229         msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
13230         if (!msg)
13231                 return;
13232
13233         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
13234         if (!hdr) {
13235                 nlmsg_free(msg);
13236                 return;
13237         }
13238
13239         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13240             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13241             (from_ap && reason &&
13242              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
13243             (from_ap &&
13244              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
13245             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
13246                 goto nla_put_failure;
13247
13248         genlmsg_end(msg, hdr);
13249
13250         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13251                                 NL80211_MCGRP_MLME, GFP_KERNEL);
13252         return;
13253
13254  nla_put_failure:
13255         genlmsg_cancel(msg, hdr);
13256         nlmsg_free(msg);
13257 }
13258
13259 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
13260                              struct net_device *netdev, const u8 *bssid,
13261                              gfp_t gfp)
13262 {
13263         struct sk_buff *msg;
13264         void *hdr;
13265
13266         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13267         if (!msg)
13268                 return;
13269
13270         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
13271         if (!hdr) {
13272                 nlmsg_free(msg);
13273                 return;
13274         }
13275
13276         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13277             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13278             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
13279                 goto nla_put_failure;
13280
13281         genlmsg_end(msg, hdr);
13282
13283         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13284                                 NL80211_MCGRP_MLME, gfp);
13285         return;
13286
13287  nla_put_failure:
13288         genlmsg_cancel(msg, hdr);
13289         nlmsg_free(msg);
13290 }
13291
13292 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
13293                                         const u8* ie, u8 ie_len, gfp_t gfp)
13294 {
13295         struct wireless_dev *wdev = dev->ieee80211_ptr;
13296         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
13297         struct sk_buff *msg;
13298         void *hdr;
13299
13300         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
13301                 return;
13302
13303         trace_cfg80211_notify_new_peer_candidate(dev, addr);
13304
13305         msg = nlmsg_new(100 + ie_len, gfp);
13306         if (!msg)
13307                 return;
13308
13309         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
13310         if (!hdr) {
13311                 nlmsg_free(msg);
13312                 return;
13313         }
13314
13315         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13316             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
13317             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
13318             (ie_len && ie &&
13319              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
13320                 goto nla_put_failure;
13321
13322         genlmsg_end(msg, hdr);
13323
13324         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13325                                 NL80211_MCGRP_MLME, gfp);
13326         return;
13327
13328  nla_put_failure:
13329         genlmsg_cancel(msg, hdr);
13330         nlmsg_free(msg);
13331 }
13332 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
13333
13334 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
13335                                  struct net_device *netdev, const u8 *addr,
13336                                  enum nl80211_key_type key_type, int key_id,
13337                                  const u8 *tsc, gfp_t gfp)
13338 {
13339         struct sk_buff *msg;
13340         void *hdr;
13341
13342         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13343         if (!msg)
13344                 return;
13345
13346         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
13347         if (!hdr) {
13348                 nlmsg_free(msg);
13349                 return;
13350         }
13351
13352         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13353             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13354             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
13355             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
13356             (key_id != -1 &&
13357              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
13358             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
13359                 goto nla_put_failure;
13360
13361         genlmsg_end(msg, hdr);
13362
13363         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13364                                 NL80211_MCGRP_MLME, gfp);
13365         return;
13366
13367  nla_put_failure:
13368         genlmsg_cancel(msg, hdr);
13369         nlmsg_free(msg);
13370 }
13371
13372 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
13373                                     struct ieee80211_channel *channel_before,
13374                                     struct ieee80211_channel *channel_after)
13375 {
13376         struct sk_buff *msg;
13377         void *hdr;
13378         struct nlattr *nl_freq;
13379
13380         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
13381         if (!msg)
13382                 return;
13383
13384         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
13385         if (!hdr) {
13386                 nlmsg_free(msg);
13387                 return;
13388         }
13389
13390         /*
13391          * Since we are applying the beacon hint to a wiphy we know its
13392          * wiphy_idx is valid
13393          */
13394         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
13395                 goto nla_put_failure;
13396
13397         /* Before */
13398         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
13399         if (!nl_freq)
13400                 goto nla_put_failure;
13401         if (nl80211_msg_put_channel(msg, channel_before, false))
13402                 goto nla_put_failure;
13403         nla_nest_end(msg, nl_freq);
13404
13405         /* After */
13406         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
13407         if (!nl_freq)
13408                 goto nla_put_failure;
13409         if (nl80211_msg_put_channel(msg, channel_after, false))
13410                 goto nla_put_failure;
13411         nla_nest_end(msg, nl_freq);
13412
13413         genlmsg_end(msg, hdr);
13414
13415         rcu_read_lock();
13416         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
13417                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
13418         rcu_read_unlock();
13419
13420         return;
13421
13422 nla_put_failure:
13423         genlmsg_cancel(msg, hdr);
13424         nlmsg_free(msg);
13425 }
13426
13427 static void nl80211_send_remain_on_chan_event(
13428         int cmd, struct cfg80211_registered_device *rdev,
13429         struct wireless_dev *wdev, u64 cookie,
13430         struct ieee80211_channel *chan,
13431         unsigned int duration, gfp_t gfp)
13432 {
13433         struct sk_buff *msg;
13434         void *hdr;
13435
13436         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13437         if (!msg)
13438                 return;
13439
13440         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
13441         if (!hdr) {
13442                 nlmsg_free(msg);
13443                 return;
13444         }
13445
13446         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13447             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13448                                          wdev->netdev->ifindex)) ||
13449             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13450                               NL80211_ATTR_PAD) ||
13451             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
13452             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
13453                         NL80211_CHAN_NO_HT) ||
13454             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
13455                               NL80211_ATTR_PAD))
13456                 goto nla_put_failure;
13457
13458         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
13459             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
13460                 goto nla_put_failure;
13461
13462         genlmsg_end(msg, hdr);
13463
13464         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13465                                 NL80211_MCGRP_MLME, gfp);
13466         return;
13467
13468  nla_put_failure:
13469         genlmsg_cancel(msg, hdr);
13470         nlmsg_free(msg);
13471 }
13472
13473 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
13474                                struct ieee80211_channel *chan,
13475                                unsigned int duration, gfp_t gfp)
13476 {
13477         struct wiphy *wiphy = wdev->wiphy;
13478         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13479
13480         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
13481         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
13482                                           rdev, wdev, cookie, chan,
13483                                           duration, gfp);
13484 }
13485 EXPORT_SYMBOL(cfg80211_ready_on_channel);
13486
13487 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
13488                                         struct ieee80211_channel *chan,
13489                                         gfp_t gfp)
13490 {
13491         struct wiphy *wiphy = wdev->wiphy;
13492         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13493
13494         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
13495         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
13496                                           rdev, wdev, cookie, chan, 0, gfp);
13497 }
13498 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
13499
13500 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
13501                       struct station_info *sinfo, gfp_t gfp)
13502 {
13503         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
13504         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13505         struct sk_buff *msg;
13506
13507         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
13508
13509         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13510         if (!msg)
13511                 return;
13512
13513         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
13514                                  rdev, dev, mac_addr, sinfo) < 0) {
13515                 nlmsg_free(msg);
13516                 return;
13517         }
13518
13519         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13520                                 NL80211_MCGRP_MLME, gfp);
13521 }
13522 EXPORT_SYMBOL(cfg80211_new_sta);
13523
13524 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
13525                             struct station_info *sinfo, gfp_t gfp)
13526 {
13527         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
13528         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13529         struct sk_buff *msg;
13530         struct station_info empty_sinfo = {};
13531
13532         if (!sinfo)
13533                 sinfo = &empty_sinfo;
13534
13535         trace_cfg80211_del_sta(dev, mac_addr);
13536
13537         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13538         if (!msg)
13539                 return;
13540
13541         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
13542                                  rdev, dev, mac_addr, sinfo) < 0) {
13543                 nlmsg_free(msg);
13544                 return;
13545         }
13546
13547         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13548                                 NL80211_MCGRP_MLME, gfp);
13549 }
13550 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
13551
13552 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
13553                           enum nl80211_connect_failed_reason reason,
13554                           gfp_t gfp)
13555 {
13556         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
13557         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13558         struct sk_buff *msg;
13559         void *hdr;
13560
13561         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
13562         if (!msg)
13563                 return;
13564
13565         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
13566         if (!hdr) {
13567                 nlmsg_free(msg);
13568                 return;
13569         }
13570
13571         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
13572             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
13573             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
13574                 goto nla_put_failure;
13575
13576         genlmsg_end(msg, hdr);
13577
13578         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13579                                 NL80211_MCGRP_MLME, gfp);
13580         return;
13581
13582  nla_put_failure:
13583         genlmsg_cancel(msg, hdr);
13584         nlmsg_free(msg);
13585 }
13586 EXPORT_SYMBOL(cfg80211_conn_failed);
13587
13588 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
13589                                        const u8 *addr, gfp_t gfp)
13590 {
13591         struct wireless_dev *wdev = dev->ieee80211_ptr;
13592         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
13593         struct sk_buff *msg;
13594         void *hdr;
13595         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
13596
13597         if (!nlportid)
13598                 return false;
13599
13600         msg = nlmsg_new(100, gfp);
13601         if (!msg)
13602                 return true;
13603
13604         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
13605         if (!hdr) {
13606                 nlmsg_free(msg);
13607                 return true;
13608         }
13609
13610         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13611             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
13612             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
13613                 goto nla_put_failure;
13614
13615         genlmsg_end(msg, hdr);
13616         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
13617         return true;
13618
13619  nla_put_failure:
13620         genlmsg_cancel(msg, hdr);
13621         nlmsg_free(msg);
13622         return true;
13623 }
13624
13625 bool cfg80211_rx_spurious_frame(struct net_device *dev,
13626                                 const u8 *addr, gfp_t gfp)
13627 {
13628         struct wireless_dev *wdev = dev->ieee80211_ptr;
13629         bool ret;
13630
13631         trace_cfg80211_rx_spurious_frame(dev, addr);
13632
13633         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
13634                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
13635                 trace_cfg80211_return_bool(false);
13636                 return false;
13637         }
13638         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
13639                                          addr, gfp);
13640         trace_cfg80211_return_bool(ret);
13641         return ret;
13642 }
13643 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
13644
13645 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
13646                                         const u8 *addr, gfp_t gfp)
13647 {
13648         struct wireless_dev *wdev = dev->ieee80211_ptr;
13649         bool ret;
13650
13651         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
13652
13653         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
13654                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
13655                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
13656                 trace_cfg80211_return_bool(false);
13657                 return false;
13658         }
13659         ret = __nl80211_unexpected_frame(dev,
13660                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
13661                                          addr, gfp);
13662         trace_cfg80211_return_bool(ret);
13663         return ret;
13664 }
13665 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
13666
13667 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
13668                       struct wireless_dev *wdev, u32 nlportid,
13669                       int freq, int sig_dbm,
13670                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
13671 {
13672         struct net_device *netdev = wdev->netdev;
13673         struct sk_buff *msg;
13674         void *hdr;
13675
13676         msg = nlmsg_new(100 + len, gfp);
13677         if (!msg)
13678                 return -ENOMEM;
13679
13680         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
13681         if (!hdr) {
13682                 nlmsg_free(msg);
13683                 return -ENOMEM;
13684         }
13685
13686         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13687             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13688                                         netdev->ifindex)) ||
13689             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13690                               NL80211_ATTR_PAD) ||
13691             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
13692             (sig_dbm &&
13693              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
13694             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
13695             (flags &&
13696              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
13697                 goto nla_put_failure;
13698
13699         genlmsg_end(msg, hdr);
13700
13701         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
13702
13703  nla_put_failure:
13704         genlmsg_cancel(msg, hdr);
13705         nlmsg_free(msg);
13706         return -ENOBUFS;
13707 }
13708
13709 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
13710                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
13711 {
13712         struct wiphy *wiphy = wdev->wiphy;
13713         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13714         struct net_device *netdev = wdev->netdev;
13715         struct sk_buff *msg;
13716         void *hdr;
13717
13718         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
13719
13720         msg = nlmsg_new(100 + len, gfp);
13721         if (!msg)
13722                 return;
13723
13724         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
13725         if (!hdr) {
13726                 nlmsg_free(msg);
13727                 return;
13728         }
13729
13730         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13731             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13732                                    netdev->ifindex)) ||
13733             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13734                               NL80211_ATTR_PAD) ||
13735             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
13736             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
13737                               NL80211_ATTR_PAD) ||
13738             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
13739                 goto nla_put_failure;
13740
13741         genlmsg_end(msg, hdr);
13742
13743         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13744                                 NL80211_MCGRP_MLME, gfp);
13745         return;
13746
13747  nla_put_failure:
13748         genlmsg_cancel(msg, hdr);
13749         nlmsg_free(msg);
13750 }
13751 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
13752
13753 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
13754                                             const char *mac, gfp_t gfp)
13755 {
13756         struct wireless_dev *wdev = dev->ieee80211_ptr;
13757         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
13758         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13759         void **cb;
13760
13761         if (!msg)
13762                 return NULL;
13763
13764         cb = (void **)msg->cb;
13765
13766         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
13767         if (!cb[0]) {
13768                 nlmsg_free(msg);
13769                 return NULL;
13770         }
13771
13772         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13773             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
13774                 goto nla_put_failure;
13775
13776         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
13777                 goto nla_put_failure;
13778
13779         cb[1] = nla_nest_start(msg, NL80211_ATTR_CQM);
13780         if (!cb[1])
13781                 goto nla_put_failure;
13782
13783         cb[2] = rdev;
13784
13785         return msg;
13786  nla_put_failure:
13787         nlmsg_free(msg);
13788         return NULL;
13789 }
13790
13791 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
13792 {
13793         void **cb = (void **)msg->cb;
13794         struct cfg80211_registered_device *rdev = cb[2];
13795
13796         nla_nest_end(msg, cb[1]);
13797         genlmsg_end(msg, cb[0]);
13798
13799         memset(msg->cb, 0, sizeof(msg->cb));
13800
13801         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13802                                 NL80211_MCGRP_MLME, gfp);
13803 }
13804
13805 void cfg80211_cqm_rssi_notify(struct net_device *dev,
13806                               enum nl80211_cqm_rssi_threshold_event rssi_event,
13807                               gfp_t gfp)
13808 {
13809         struct sk_buff *msg;
13810
13811         trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
13812
13813         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
13814                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
13815                 return;
13816
13817         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
13818         if (!msg)
13819                 return;
13820
13821         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
13822                         rssi_event))
13823                 goto nla_put_failure;
13824
13825         cfg80211_send_cqm(msg, gfp);
13826
13827         return;
13828
13829  nla_put_failure:
13830         nlmsg_free(msg);
13831 }
13832 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
13833
13834 void cfg80211_cqm_txe_notify(struct net_device *dev,
13835                              const u8 *peer, u32 num_packets,
13836                              u32 rate, u32 intvl, gfp_t gfp)
13837 {
13838         struct sk_buff *msg;
13839
13840         msg = cfg80211_prepare_cqm(dev, peer, gfp);
13841         if (!msg)
13842                 return;
13843
13844         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
13845                 goto nla_put_failure;
13846
13847         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
13848                 goto nla_put_failure;
13849
13850         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
13851                 goto nla_put_failure;
13852
13853         cfg80211_send_cqm(msg, gfp);
13854         return;
13855
13856  nla_put_failure:
13857         nlmsg_free(msg);
13858 }
13859 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
13860
13861 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
13862                                  const u8 *peer, u32 num_packets, gfp_t gfp)
13863 {
13864         struct sk_buff *msg;
13865
13866         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
13867
13868         msg = cfg80211_prepare_cqm(dev, peer, gfp);
13869         if (!msg)
13870                 return;
13871
13872         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
13873                 goto nla_put_failure;
13874
13875         cfg80211_send_cqm(msg, gfp);
13876         return;
13877
13878  nla_put_failure:
13879         nlmsg_free(msg);
13880 }
13881 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
13882
13883 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
13884 {
13885         struct sk_buff *msg;
13886
13887         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
13888         if (!msg)
13889                 return;
13890
13891         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
13892                 goto nla_put_failure;
13893
13894         cfg80211_send_cqm(msg, gfp);
13895         return;
13896
13897  nla_put_failure:
13898         nlmsg_free(msg);
13899 }
13900 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
13901
13902 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
13903                                      struct net_device *netdev, const u8 *bssid,
13904                                      const u8 *replay_ctr, gfp_t gfp)
13905 {
13906         struct sk_buff *msg;
13907         struct nlattr *rekey_attr;
13908         void *hdr;
13909
13910         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13911         if (!msg)
13912                 return;
13913
13914         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
13915         if (!hdr) {
13916                 nlmsg_free(msg);
13917                 return;
13918         }
13919
13920         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13921             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13922             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
13923                 goto nla_put_failure;
13924
13925         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
13926         if (!rekey_attr)
13927                 goto nla_put_failure;
13928
13929         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
13930                     NL80211_REPLAY_CTR_LEN, replay_ctr))
13931                 goto nla_put_failure;
13932
13933         nla_nest_end(msg, rekey_attr);
13934
13935         genlmsg_end(msg, hdr);
13936
13937         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13938                                 NL80211_MCGRP_MLME, gfp);
13939         return;
13940
13941  nla_put_failure:
13942         genlmsg_cancel(msg, hdr);
13943         nlmsg_free(msg);
13944 }
13945
13946 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
13947                                const u8 *replay_ctr, gfp_t gfp)
13948 {
13949         struct wireless_dev *wdev = dev->ieee80211_ptr;
13950         struct wiphy *wiphy = wdev->wiphy;
13951         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13952
13953         trace_cfg80211_gtk_rekey_notify(dev, bssid);
13954         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
13955 }
13956 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
13957
13958 static void
13959 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
13960                                struct net_device *netdev, int index,
13961                                const u8 *bssid, bool preauth, gfp_t gfp)
13962 {
13963         struct sk_buff *msg;
13964         struct nlattr *attr;
13965         void *hdr;
13966
13967         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13968         if (!msg)
13969                 return;
13970
13971         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
13972         if (!hdr) {
13973                 nlmsg_free(msg);
13974                 return;
13975         }
13976
13977         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13978             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
13979                 goto nla_put_failure;
13980
13981         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
13982         if (!attr)
13983                 goto nla_put_failure;
13984
13985         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
13986             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
13987             (preauth &&
13988              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
13989                 goto nla_put_failure;
13990
13991         nla_nest_end(msg, attr);
13992
13993         genlmsg_end(msg, hdr);
13994
13995         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13996                                 NL80211_MCGRP_MLME, gfp);
13997         return;
13998
13999  nla_put_failure:
14000         genlmsg_cancel(msg, hdr);
14001         nlmsg_free(msg);
14002 }
14003
14004 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
14005                                      const u8 *bssid, bool preauth, gfp_t gfp)
14006 {
14007         struct wireless_dev *wdev = dev->ieee80211_ptr;
14008         struct wiphy *wiphy = wdev->wiphy;
14009         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14010
14011         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
14012         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
14013 }
14014 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
14015
14016 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
14017                                      struct net_device *netdev,
14018                                      struct cfg80211_chan_def *chandef,
14019                                      gfp_t gfp,
14020                                      enum nl80211_commands notif,
14021                                      u8 count)
14022 {
14023         struct sk_buff *msg;
14024         void *hdr;
14025
14026         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14027         if (!msg)
14028                 return;
14029
14030         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
14031         if (!hdr) {
14032                 nlmsg_free(msg);
14033                 return;
14034         }
14035
14036         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
14037                 goto nla_put_failure;
14038
14039         if (nl80211_send_chandef(msg, chandef))
14040                 goto nla_put_failure;
14041
14042         if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
14043             (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
14044                         goto nla_put_failure;
14045
14046         genlmsg_end(msg, hdr);
14047
14048         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14049                                 NL80211_MCGRP_MLME, gfp);
14050         return;
14051
14052  nla_put_failure:
14053         genlmsg_cancel(msg, hdr);
14054         nlmsg_free(msg);
14055 }
14056
14057 void cfg80211_ch_switch_notify(struct net_device *dev,
14058                                struct cfg80211_chan_def *chandef)
14059 {
14060         struct wireless_dev *wdev = dev->ieee80211_ptr;
14061         struct wiphy *wiphy = wdev->wiphy;
14062         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14063
14064         ASSERT_WDEV_LOCK(wdev);
14065
14066         trace_cfg80211_ch_switch_notify(dev, chandef);
14067
14068         wdev->chandef = *chandef;
14069         wdev->preset_chandef = *chandef;
14070
14071         if (wdev->iftype == NL80211_IFTYPE_STATION &&
14072             !WARN_ON(!wdev->current_bss))
14073                 wdev->current_bss->pub.channel = chandef->chan;
14074
14075         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
14076                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0);
14077 }
14078 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
14079
14080 void cfg80211_ch_switch_started_notify(struct net_device *dev,
14081                                        struct cfg80211_chan_def *chandef,
14082                                        u8 count)
14083 {
14084         struct wireless_dev *wdev = dev->ieee80211_ptr;
14085         struct wiphy *wiphy = wdev->wiphy;
14086         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14087
14088         trace_cfg80211_ch_switch_started_notify(dev, chandef);
14089
14090         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
14091                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
14092 }
14093 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
14094
14095 void
14096 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
14097                      const struct cfg80211_chan_def *chandef,
14098                      enum nl80211_radar_event event,
14099                      struct net_device *netdev, gfp_t gfp)
14100 {
14101         struct sk_buff *msg;
14102         void *hdr;
14103
14104         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14105         if (!msg)
14106                 return;
14107
14108         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
14109         if (!hdr) {
14110                 nlmsg_free(msg);
14111                 return;
14112         }
14113
14114         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
14115                 goto nla_put_failure;
14116
14117         /* NOP and radar events don't need a netdev parameter */
14118         if (netdev) {
14119                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
14120
14121                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14122                     nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14123                                       NL80211_ATTR_PAD))
14124                         goto nla_put_failure;
14125         }
14126
14127         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
14128                 goto nla_put_failure;
14129
14130         if (nl80211_send_chandef(msg, chandef))
14131                 goto nla_put_failure;
14132
14133         genlmsg_end(msg, hdr);
14134
14135         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14136                                 NL80211_MCGRP_MLME, gfp);
14137         return;
14138
14139  nla_put_failure:
14140         genlmsg_cancel(msg, hdr);
14141         nlmsg_free(msg);
14142 }
14143
14144 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
14145                            u64 cookie, bool acked, gfp_t gfp)
14146 {
14147         struct wireless_dev *wdev = dev->ieee80211_ptr;
14148         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14149         struct sk_buff *msg;
14150         void *hdr;
14151
14152         trace_cfg80211_probe_status(dev, addr, cookie, acked);
14153
14154         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14155
14156         if (!msg)
14157                 return;
14158
14159         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
14160         if (!hdr) {
14161                 nlmsg_free(msg);
14162                 return;
14163         }
14164
14165         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14166             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14167             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
14168             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14169                               NL80211_ATTR_PAD) ||
14170             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
14171                 goto nla_put_failure;
14172
14173         genlmsg_end(msg, hdr);
14174
14175         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14176                                 NL80211_MCGRP_MLME, gfp);
14177         return;
14178
14179  nla_put_failure:
14180         genlmsg_cancel(msg, hdr);
14181         nlmsg_free(msg);
14182 }
14183 EXPORT_SYMBOL(cfg80211_probe_status);
14184
14185 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
14186                                  const u8 *frame, size_t len,
14187                                  int freq, int sig_dbm)
14188 {
14189         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14190         struct sk_buff *msg;
14191         void *hdr;
14192         struct cfg80211_beacon_registration *reg;
14193
14194         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
14195
14196         spin_lock_bh(&rdev->beacon_registrations_lock);
14197         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
14198                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
14199                 if (!msg) {
14200                         spin_unlock_bh(&rdev->beacon_registrations_lock);
14201                         return;
14202                 }
14203
14204                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
14205                 if (!hdr)
14206                         goto nla_put_failure;
14207
14208                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14209                     (freq &&
14210                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
14211                     (sig_dbm &&
14212                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
14213                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
14214                         goto nla_put_failure;
14215
14216                 genlmsg_end(msg, hdr);
14217
14218                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
14219         }
14220         spin_unlock_bh(&rdev->beacon_registrations_lock);
14221         return;
14222
14223  nla_put_failure:
14224         spin_unlock_bh(&rdev->beacon_registrations_lock);
14225         if (hdr)
14226                 genlmsg_cancel(msg, hdr);
14227         nlmsg_free(msg);
14228 }
14229 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
14230
14231 #ifdef CONFIG_PM
14232 static int cfg80211_net_detect_results(struct sk_buff *msg,
14233                                        struct cfg80211_wowlan_wakeup *wakeup)
14234 {
14235         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
14236         struct nlattr *nl_results, *nl_match, *nl_freqs;
14237         int i, j;
14238
14239         nl_results = nla_nest_start(
14240                 msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
14241         if (!nl_results)
14242                 return -EMSGSIZE;
14243
14244         for (i = 0; i < nd->n_matches; i++) {
14245                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
14246
14247                 nl_match = nla_nest_start(msg, i);
14248                 if (!nl_match)
14249                         break;
14250
14251                 /* The SSID attribute is optional in nl80211, but for
14252                  * simplicity reasons it's always present in the
14253                  * cfg80211 structure.  If a driver can't pass the
14254                  * SSID, that needs to be changed.  A zero length SSID
14255                  * is still a valid SSID (wildcard), so it cannot be
14256                  * used for this purpose.
14257                  */
14258                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
14259                             match->ssid.ssid)) {
14260                         nla_nest_cancel(msg, nl_match);
14261                         goto out;
14262                 }
14263
14264                 if (match->n_channels) {
14265                         nl_freqs = nla_nest_start(
14266                                 msg, NL80211_ATTR_SCAN_FREQUENCIES);
14267                         if (!nl_freqs) {
14268                                 nla_nest_cancel(msg, nl_match);
14269                                 goto out;
14270                         }
14271
14272                         for (j = 0; j < match->n_channels; j++) {
14273                                 if (nla_put_u32(msg, j, match->channels[j])) {
14274                                         nla_nest_cancel(msg, nl_freqs);
14275                                         nla_nest_cancel(msg, nl_match);
14276                                         goto out;
14277                                 }
14278                         }
14279
14280                         nla_nest_end(msg, nl_freqs);
14281                 }
14282
14283                 nla_nest_end(msg, nl_match);
14284         }
14285
14286 out:
14287         nla_nest_end(msg, nl_results);
14288         return 0;
14289 }
14290
14291 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
14292                                    struct cfg80211_wowlan_wakeup *wakeup,
14293                                    gfp_t gfp)
14294 {
14295         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14296         struct sk_buff *msg;
14297         void *hdr;
14298         int size = 200;
14299
14300         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
14301
14302         if (wakeup)
14303                 size += wakeup->packet_present_len;
14304
14305         msg = nlmsg_new(size, gfp);
14306         if (!msg)
14307                 return;
14308
14309         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
14310         if (!hdr)
14311                 goto free_msg;
14312
14313         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14314             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14315                               NL80211_ATTR_PAD))
14316                 goto free_msg;
14317
14318         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14319                                         wdev->netdev->ifindex))
14320                 goto free_msg;
14321
14322         if (wakeup) {
14323                 struct nlattr *reasons;
14324
14325                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
14326                 if (!reasons)
14327                         goto free_msg;
14328
14329                 if (wakeup->disconnect &&
14330                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
14331                         goto free_msg;
14332                 if (wakeup->magic_pkt &&
14333                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
14334                         goto free_msg;
14335                 if (wakeup->gtk_rekey_failure &&
14336                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
14337                         goto free_msg;
14338                 if (wakeup->eap_identity_req &&
14339                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
14340                         goto free_msg;
14341                 if (wakeup->four_way_handshake &&
14342                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
14343                         goto free_msg;
14344                 if (wakeup->rfkill_release &&
14345                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
14346                         goto free_msg;
14347
14348                 if (wakeup->pattern_idx >= 0 &&
14349                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
14350                                 wakeup->pattern_idx))
14351                         goto free_msg;
14352
14353                 if (wakeup->tcp_match &&
14354                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
14355                         goto free_msg;
14356
14357                 if (wakeup->tcp_connlost &&
14358                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
14359                         goto free_msg;
14360
14361                 if (wakeup->tcp_nomoretokens &&
14362                     nla_put_flag(msg,
14363                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
14364                         goto free_msg;
14365
14366                 if (wakeup->packet) {
14367                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
14368                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
14369
14370                         if (!wakeup->packet_80211) {
14371                                 pkt_attr =
14372                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
14373                                 len_attr =
14374                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
14375                         }
14376
14377                         if (wakeup->packet_len &&
14378                             nla_put_u32(msg, len_attr, wakeup->packet_len))
14379                                 goto free_msg;
14380
14381                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
14382                                     wakeup->packet))
14383                                 goto free_msg;
14384                 }
14385
14386                 if (wakeup->net_detect &&
14387                     cfg80211_net_detect_results(msg, wakeup))
14388                                 goto free_msg;
14389
14390                 nla_nest_end(msg, reasons);
14391         }
14392
14393         genlmsg_end(msg, hdr);
14394
14395         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14396                                 NL80211_MCGRP_MLME, gfp);
14397         return;
14398
14399  free_msg:
14400         nlmsg_free(msg);
14401 }
14402 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
14403 #endif
14404
14405 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
14406                                 enum nl80211_tdls_operation oper,
14407                                 u16 reason_code, gfp_t gfp)
14408 {
14409         struct wireless_dev *wdev = dev->ieee80211_ptr;
14410         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14411         struct sk_buff *msg;
14412         void *hdr;
14413
14414         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
14415                                          reason_code);
14416
14417         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14418         if (!msg)
14419                 return;
14420
14421         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
14422         if (!hdr) {
14423                 nlmsg_free(msg);
14424                 return;
14425         }
14426
14427         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14428             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14429             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
14430             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
14431             (reason_code > 0 &&
14432              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
14433                 goto nla_put_failure;
14434
14435         genlmsg_end(msg, hdr);
14436
14437         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14438                                 NL80211_MCGRP_MLME, gfp);
14439         return;
14440
14441  nla_put_failure:
14442         genlmsg_cancel(msg, hdr);
14443         nlmsg_free(msg);
14444 }
14445 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
14446
14447 static int nl80211_netlink_notify(struct notifier_block * nb,
14448                                   unsigned long state,
14449                                   void *_notify)
14450 {
14451         struct netlink_notify *notify = _notify;
14452         struct cfg80211_registered_device *rdev;
14453         struct wireless_dev *wdev;
14454         struct cfg80211_beacon_registration *reg, *tmp;
14455
14456         if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
14457                 return NOTIFY_DONE;
14458
14459         rcu_read_lock();
14460
14461         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
14462                 bool schedule_destroy_work = false;
14463                 struct cfg80211_sched_scan_request *sched_scan_req =
14464                         rcu_dereference(rdev->sched_scan_req);
14465
14466                 if (sched_scan_req && notify->portid &&
14467                     sched_scan_req->owner_nlportid == notify->portid) {
14468                         sched_scan_req->owner_nlportid = 0;
14469
14470                         if (rdev->ops->sched_scan_stop &&
14471                             rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
14472                                 schedule_work(&rdev->sched_scan_stop_wk);
14473                 }
14474
14475                 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
14476                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
14477
14478                         if (wdev->owner_nlportid == notify->portid)
14479                                 schedule_destroy_work = true;
14480                 }
14481
14482                 spin_lock_bh(&rdev->beacon_registrations_lock);
14483                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
14484                                          list) {
14485                         if (reg->nlportid == notify->portid) {
14486                                 list_del(&reg->list);
14487                                 kfree(reg);
14488                                 break;
14489                         }
14490                 }
14491                 spin_unlock_bh(&rdev->beacon_registrations_lock);
14492
14493                 if (schedule_destroy_work) {
14494                         struct cfg80211_iface_destroy *destroy;
14495
14496                         destroy = kzalloc(sizeof(*destroy), GFP_ATOMIC);
14497                         if (destroy) {
14498                                 destroy->nlportid = notify->portid;
14499                                 spin_lock(&rdev->destroy_list_lock);
14500                                 list_add(&destroy->list, &rdev->destroy_list);
14501                                 spin_unlock(&rdev->destroy_list_lock);
14502                                 schedule_work(&rdev->destroy_work);
14503                         }
14504                 }
14505         }
14506
14507         rcu_read_unlock();
14508
14509         /*
14510          * It is possible that the user space process that is controlling the
14511          * indoor setting disappeared, so notify the regulatory core.
14512          */
14513         regulatory_netlink_notify(notify->portid);
14514         return NOTIFY_OK;
14515 }
14516
14517 static struct notifier_block nl80211_netlink_notifier = {
14518         .notifier_call = nl80211_netlink_notify,
14519 };
14520
14521 void cfg80211_ft_event(struct net_device *netdev,
14522                        struct cfg80211_ft_event_params *ft_event)
14523 {
14524         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
14525         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14526         struct sk_buff *msg;
14527         void *hdr;
14528
14529         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
14530
14531         if (!ft_event->target_ap)
14532                 return;
14533
14534         msg = nlmsg_new(100 + ft_event->ric_ies_len, GFP_KERNEL);
14535         if (!msg)
14536                 return;
14537
14538         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
14539         if (!hdr)
14540                 goto out;
14541
14542         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14543             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14544             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
14545                 goto out;
14546
14547         if (ft_event->ies &&
14548             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
14549                 goto out;
14550         if (ft_event->ric_ies &&
14551             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
14552                     ft_event->ric_ies))
14553                 goto out;
14554
14555         genlmsg_end(msg, hdr);
14556
14557         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14558                                 NL80211_MCGRP_MLME, GFP_KERNEL);
14559         return;
14560  out:
14561         nlmsg_free(msg);
14562 }
14563 EXPORT_SYMBOL(cfg80211_ft_event);
14564
14565 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
14566 {
14567         struct cfg80211_registered_device *rdev;
14568         struct sk_buff *msg;
14569         void *hdr;
14570         u32 nlportid;
14571
14572         rdev = wiphy_to_rdev(wdev->wiphy);
14573         if (!rdev->crit_proto_nlportid)
14574                 return;
14575
14576         nlportid = rdev->crit_proto_nlportid;
14577         rdev->crit_proto_nlportid = 0;
14578
14579         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14580         if (!msg)
14581                 return;
14582
14583         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
14584         if (!hdr)
14585                 goto nla_put_failure;
14586
14587         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14588             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14589                               NL80211_ATTR_PAD))
14590                 goto nla_put_failure;
14591
14592         genlmsg_end(msg, hdr);
14593
14594         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
14595         return;
14596
14597  nla_put_failure:
14598         if (hdr)
14599                 genlmsg_cancel(msg, hdr);
14600         nlmsg_free(msg);
14601 }
14602 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
14603
14604 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
14605 {
14606         struct wiphy *wiphy = wdev->wiphy;
14607         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14608         struct sk_buff *msg;
14609         void *hdr;
14610
14611         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14612         if (!msg)
14613                 return;
14614
14615         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
14616         if (!hdr)
14617                 goto out;
14618
14619         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14620             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
14621             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14622                               NL80211_ATTR_PAD))
14623                 goto out;
14624
14625         genlmsg_end(msg, hdr);
14626
14627         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
14628                                 NL80211_MCGRP_MLME, GFP_KERNEL);
14629         return;
14630  out:
14631         nlmsg_free(msg);
14632 }
14633
14634 /* initialisation/exit functions */
14635
14636 int nl80211_init(void)
14637 {
14638         int err;
14639
14640         err = genl_register_family_with_ops_groups(&nl80211_fam, nl80211_ops,
14641                                                    nl80211_mcgrps);
14642         if (err)
14643                 return err;
14644
14645         err = netlink_register_notifier(&nl80211_netlink_notifier);
14646         if (err)
14647                 goto err_out;
14648
14649         return 0;
14650  err_out:
14651         genl_unregister_family(&nl80211_fam);
14652         return err;
14653 }
14654
14655 void nl80211_exit(void)
14656 {
14657         netlink_unregister_notifier(&nl80211_netlink_notifier);
14658         genl_unregister_family(&nl80211_fam);
14659 }