net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include "core.h"
  23 #include "nl80211.h"
  24 #include "reg.h"
  25
  26 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  27                                    struct genl_info *info,
  28                                    struct cfg80211_crypto_settings *settings,
  29                                    int cipher_limit);
  30
  31 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
  32                             struct genl_info *info);
  33 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
  34                               struct genl_info *info);
  35
  36 /* the netlink family */
  37 static struct genl_family nl80211_fam = {
  38         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  39         .name = "nl80211",      /* have users key off the name instead */
  40         .hdrsize = 0,           /* no private header */
  41         .version = 1,           /* no particular meaning now */
  42         .maxattr = NL80211_ATTR_MAX,
  43         .netnsok = true,
  44         .pre_doit = nl80211_pre_doit,
  45         .post_doit = nl80211_post_doit,
  46 };
  47
  48 /* returns ERR_PTR values */
  49 static struct wireless_dev *
  50 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  51 {
  52         struct cfg80211_registered_device *rdev;
  53         struct wireless_dev *result = NULL;
  54         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  55         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  56         u64 wdev_id;
  57         int wiphy_idx = -1;
  58         int ifidx = -1;
  59
  60         assert_cfg80211_lock();
  61
  62         if (!have_ifidx && !have_wdev_id)
  63                 return ERR_PTR(-EINVAL);
  64
  65         if (have_ifidx)
  66                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  67         if (have_wdev_id) {
  68                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  69                 wiphy_idx = wdev_id >> 32;
  70         }
  71
  72         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  73                 struct wireless_dev *wdev;
  74
  75                 if (wiphy_net(&rdev->wiphy) != netns)
  76                         continue;
  77
  78                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  79                         continue;
  80
  81                 mutex_lock(&rdev->devlist_mtx);
  82                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
  83                         if (have_ifidx && wdev->netdev &&
  84                             wdev->netdev->ifindex == ifidx) {
  85                                 result = wdev;
  86                                 break;
  87                         }
  88                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
  89                                 result = wdev;
  90                                 break;
  91                         }
  92                 }
  93                 mutex_unlock(&rdev->devlist_mtx);
  94
  95                 if (result)
  96                         break;
  97         }
  98
  99         if (result)
 100                 return result;
 101         return ERR_PTR(-ENODEV);
 102 }
 103
 104 static struct cfg80211_registered_device *
 105 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 106 {
 107         struct cfg80211_registered_device *rdev = NULL, *tmp;
 108         struct net_device *netdev;
 109
 110         assert_cfg80211_lock();
 111
 112         if (!attrs[NL80211_ATTR_WIPHY] &&
 113             !attrs[NL80211_ATTR_IFINDEX] &&
 114             !attrs[NL80211_ATTR_WDEV])
 115                 return ERR_PTR(-EINVAL);
 116
 117         if (attrs[NL80211_ATTR_WIPHY])
 118                 rdev = cfg80211_rdev_by_wiphy_idx(
 119                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 120
 121         if (attrs[NL80211_ATTR_WDEV]) {
 122                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 123                 struct wireless_dev *wdev;
 124                 bool found = false;
 125
 126                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 127                 if (tmp) {
 128                         /* make sure wdev exists */
 129                         mutex_lock(&tmp->devlist_mtx);
 130                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 131                                 if (wdev->identifier != (u32)wdev_id)
 132                                         continue;
 133                                 found = true;
 134                                 break;
 135                         }
 136                         mutex_unlock(&tmp->devlist_mtx);
 137
 138                         if (!found)
 139                                 tmp = NULL;
 140
 141                         if (rdev && tmp != rdev)
 142                                 return ERR_PTR(-EINVAL);
 143                         rdev = tmp;
 144                 }
 145         }
 146
 147         if (attrs[NL80211_ATTR_IFINDEX]) {
 148                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 149                 netdev = dev_get_by_index(netns, ifindex);
 150                 if (netdev) {
 151                         if (netdev->ieee80211_ptr)
 152                                 tmp = wiphy_to_dev(
 153                                                 netdev->ieee80211_ptr->wiphy);
 154                         else
 155                                 tmp = NULL;
 156
 157                         dev_put(netdev);
 158
 159                         /* not wireless device -- return error */
 160                         if (!tmp)
 161                                 return ERR_PTR(-EINVAL);
 162
 163                         /* mismatch -- return error */
 164                         if (rdev && tmp != rdev)
 165                                 return ERR_PTR(-EINVAL);
 166
 167                         rdev = tmp;
 168                 }
 169         }
 170
 171         if (!rdev)
 172                 return ERR_PTR(-ENODEV);
 173
 174         if (netns != wiphy_net(&rdev->wiphy))
 175                 return ERR_PTR(-ENODEV);
 176
 177         return rdev;
 178 }
 179
 180 /*
 181  * This function returns a pointer to the driver
 182  * that the genl_info item that is passed refers to.
 183  * If successful, it returns non-NULL and also locks
 184  * the driver's mutex!
 185  *
 186  * This means that you need to call cfg80211_unlock_rdev()
 187  * before being allowed to acquire &cfg80211_mutex!
 188  *
 189  * This is necessary because we need to lock the global
 190  * mutex to get an item off the list safely, and then
 191  * we lock the rdev mutex so it doesn't go away under us.
 192  *
 193  * We don't want to keep cfg80211_mutex locked
 194  * for all the time in order to allow requests on
 195  * other interfaces to go through at the same time.
 196  *
 197  * The result of this can be a PTR_ERR and hence must
 198  * be checked with IS_ERR() for errors.
 199  */
 200 static struct cfg80211_registered_device *
 201 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 202 {
 203         struct cfg80211_registered_device *rdev;
 204
 205         mutex_lock(&cfg80211_mutex);
 206         rdev = __cfg80211_rdev_from_attrs(netns, info->attrs);
 207
 208         /* if it is not an error we grab the lock on
 209          * it to assure it won't be going away while
 210          * we operate on it */
 211         if (!IS_ERR(rdev))
 212                 mutex_lock(&rdev->mtx);
 213
 214         mutex_unlock(&cfg80211_mutex);
 215
 216         return rdev;
 217 }
 218
 219 /* policy for the attributes */
 220 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
 221         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 222         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 223                                       .len = 20-1 },
 224         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 225         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 226         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 227         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 228         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 229         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 230         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 231         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 232
 233         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 234         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 235         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 236
 237         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 238         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 239
 240         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 241         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 242                                     .len = WLAN_MAX_KEY_LEN },
 243         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 244         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 245         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 246         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 247         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 248
 249         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 250         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 251         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 252                                        .len = IEEE80211_MAX_DATA_LEN },
 253         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 254                                        .len = IEEE80211_MAX_DATA_LEN },
 255         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 256         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 257         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 258         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 259                                                .len = NL80211_MAX_SUPP_RATES },
 260         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 261         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 262         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 263         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 264                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 265         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 266
 267         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 268         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 269
 270         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 271         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 272         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 273         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 274                                            .len = NL80211_MAX_SUPP_RATES },
 275         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 276
 277         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 278         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 279
 280         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 281
 282         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 283         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 284                               .len = IEEE80211_MAX_DATA_LEN },
 285         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 286         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 287
 288         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 289                                 .len = IEEE80211_MAX_SSID_LEN },
 290         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 291         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 292         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 293         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 294         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 295         [NL80211_ATTR_STA_FLAGS2] = {
 296                 .len = sizeof(struct nl80211_sta_flag_update),
 297         },
 298         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 299         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 300         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 301         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 302         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 303         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 304         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 305         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 306         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 307                                  .len = WLAN_PMKID_LEN },
 308         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 309         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 310         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 311         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 312                                  .len = IEEE80211_MAX_DATA_LEN },
 313         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 314         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 315         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 316         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 317         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 318         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 319         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 320         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 321         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 322         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 323         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 324         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 325         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 326         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 327         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 328         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 329         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 330         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 331         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 332         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 333                                          .len = IEEE80211_MAX_DATA_LEN },
 334         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 335                                          .len = IEEE80211_MAX_DATA_LEN },
 336         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 337         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 338         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 339         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 340         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 341         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 342         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 343         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 344         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 345         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 346                                       .len = IEEE80211_MAX_DATA_LEN },
 347         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 348         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 349         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 350                 .len = NL80211_HT_CAPABILITY_LEN
 351         },
 352         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 353         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 354         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 355         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 356         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 357         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 358         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 359         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 360 };
 361
 362 /* policy for the key attributes */
 363 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 364         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 365         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 366         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 367         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 368         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 369         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 370         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 371         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 372 };
 373
 374 /* policy for the key default flags */
 375 static const struct nla_policy
 376 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 377         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 378         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 379 };
 380
 381 /* policy for WoWLAN attributes */
 382 static const struct nla_policy
 383 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 384         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 385         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 386         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 387         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 388         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 389         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 390         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 391         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 392 };
 393
 394 /* policy for GTK rekey offload attributes */
 395 static const struct nla_policy
 396 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 397         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 398         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 399         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 400 };
 401
 402 static const struct nla_policy
 403 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 404         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 405                                                  .len = IEEE80211_MAX_SSID_LEN },
 406         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 407 };
 408
 409 /* ifidx get helper */
 410 static int nl80211_get_ifidx(struct netlink_callback *cb)
 411 {
 412         int res;
 413
 414         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 415                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 416                           nl80211_policy);
 417         if (res)
 418                 return res;
 419
 420         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 421                 return -EINVAL;
 422
 423         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 424         if (!res)
 425                 return -EINVAL;
 426         return res;
 427 }
 428
 429 static int nl80211_prepare_netdev_dump(struct sk_buff *skb,
 430                                        struct netlink_callback *cb,
 431                                        struct cfg80211_registered_device **rdev,
 432                                        struct net_device **dev)
 433 {
 434         int ifidx = cb->args[0];
 435         int err;
 436
 437         if (!ifidx)
 438                 ifidx = nl80211_get_ifidx(cb);
 439         if (ifidx < 0)
 440                 return ifidx;
 441
 442         cb->args[0] = ifidx;
 443
 444         rtnl_lock();
 445
 446         *dev = __dev_get_by_index(sock_net(skb->sk), ifidx);
 447         if (!*dev) {
 448                 err = -ENODEV;
 449                 goto out_rtnl;
 450         }
 451
 452         *rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
 453         if (IS_ERR(*rdev)) {
 454                 err = PTR_ERR(*rdev);
 455                 goto out_rtnl;
 456         }
 457
 458         return 0;
 459  out_rtnl:
 460         rtnl_unlock();
 461         return err;
 462 }
 463
 464 static void nl80211_finish_netdev_dump(struct cfg80211_registered_device *rdev)
 465 {
 466         cfg80211_unlock_rdev(rdev);
 467         rtnl_unlock();
 468 }
 469
 470 /* IE validation */
 471 static bool is_valid_ie_attr(const struct nlattr *attr)
 472 {
 473         const u8 *pos;
 474         int len;
 475
 476         if (!attr)
 477                 return true;
 478
 479         pos = nla_data(attr);
 480         len = nla_len(attr);
 481
 482         while (len) {
 483                 u8 elemlen;
 484
 485                 if (len < 2)
 486                         return false;
 487                 len -= 2;
 488
 489                 elemlen = pos[1];
 490                 if (elemlen > len)
 491                         return false;
 492
 493                 len -= elemlen;
 494                 pos += 2 + elemlen;
 495         }
 496
 497         return true;
 498 }
 499
 500 /* message building helper */
 501 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 502                                    int flags, u8 cmd)
 503 {
 504         /* since there is no private header just add the generic one */
 505         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 506 }
 507
 508 static int nl80211_msg_put_channel(struct sk_buff *msg,
 509                                    struct ieee80211_channel *chan)
 510 {
 511         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 512                         chan->center_freq))
 513                 goto nla_put_failure;
 514
 515         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 516             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 517                 goto nla_put_failure;
 518         if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
 519             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN))
 520                 goto nla_put_failure;
 521         if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
 522             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IBSS))
 523                 goto nla_put_failure;
 524         if ((chan->flags & IEEE80211_CHAN_RADAR) &&
 525             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 526                 goto nla_put_failure;
 527
 528         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 529                         DBM_TO_MBM(chan->max_power)))
 530                 goto nla_put_failure;
 531
 532         return 0;
 533
 534  nla_put_failure:
 535         return -ENOBUFS;
 536 }
 537
 538 /* netlink command implementations */
 539
 540 struct key_parse {
 541         struct key_params p;
 542         int idx;
 543         int type;
 544         bool def, defmgmt;
 545         bool def_uni, def_multi;
 546 };
 547
 548 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 549 {
 550         struct nlattr *tb[NL80211_KEY_MAX + 1];
 551         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 552                                    nl80211_key_policy);
 553         if (err)
 554                 return err;
 555
 556         k->def = !!tb[NL80211_KEY_DEFAULT];
 557         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 558
 559         if (k->def) {
 560                 k->def_uni = true;
 561                 k->def_multi = true;
 562         }
 563         if (k->defmgmt)
 564                 k->def_multi = true;
 565
 566         if (tb[NL80211_KEY_IDX])
 567                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 568
 569         if (tb[NL80211_KEY_DATA]) {
 570                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 571                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 572         }
 573
 574         if (tb[NL80211_KEY_SEQ]) {
 575                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 576                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 577         }
 578
 579         if (tb[NL80211_KEY_CIPHER])
 580                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 581
 582         if (tb[NL80211_KEY_TYPE]) {
 583                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 584                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 585                         return -EINVAL;
 586         }
 587
 588         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 589                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 590                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 591                                        tb[NL80211_KEY_DEFAULT_TYPES],
 592                                        nl80211_key_default_policy);
 593                 if (err)
 594                         return err;
 595
 596                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 597                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 598         }
 599
 600         return 0;
 601 }
 602
 603 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 604 {
 605         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 606                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 607                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 608         }
 609
 610         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 611                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 612                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 613         }
 614
 615         if (info->attrs[NL80211_ATTR_KEY_IDX])
 616                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 617
 618         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 619                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 620
 621         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 622         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 623
 624         if (k->def) {
 625                 k->def_uni = true;
 626                 k->def_multi = true;
 627         }
 628         if (k->defmgmt)
 629                 k->def_multi = true;
 630
 631         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 632                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 633                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 634                         return -EINVAL;
 635         }
 636
 637         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 638                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 639                 int err = nla_parse_nested(
 640                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 641                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 642                                 nl80211_key_default_policy);
 643                 if (err)
 644                         return err;
 645
 646                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 647                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 648         }
 649
 650         return 0;
 651 }
 652
 653 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 654 {
 655         int err;
 656
 657         memset(k, 0, sizeof(*k));
 658         k->idx = -1;
 659         k->type = -1;
 660
 661         if (info->attrs[NL80211_ATTR_KEY])
 662                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 663         else
 664                 err = nl80211_parse_key_old(info, k);
 665
 666         if (err)
 667                 return err;
 668
 669         if (k->def && k->defmgmt)
 670                 return -EINVAL;
 671
 672         if (k->defmgmt) {
 673                 if (k->def_uni || !k->def_multi)
 674                         return -EINVAL;
 675         }
 676
 677         if (k->idx != -1) {
 678                 if (k->defmgmt) {
 679                         if (k->idx < 4 || k->idx > 5)
 680                                 return -EINVAL;
 681                 } else if (k->def) {
 682                         if (k->idx < 0 || k->idx > 3)
 683                                 return -EINVAL;
 684                 } else {
 685                         if (k->idx < 0 || k->idx > 5)
 686                                 return -EINVAL;
 687                 }
 688         }
 689
 690         return 0;
 691 }
 692
 693 static struct cfg80211_cached_keys *
 694 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 695                        struct nlattr *keys, bool *no_ht)
 696 {
 697         struct key_parse parse;
 698         struct nlattr *key;
 699         struct cfg80211_cached_keys *result;
 700         int rem, err, def = 0;
 701
 702         result = kzalloc(sizeof(*result), GFP_KERNEL);
 703         if (!result)
 704                 return ERR_PTR(-ENOMEM);
 705
 706         result->def = -1;
 707         result->defmgmt = -1;
 708
 709         nla_for_each_nested(key, keys, rem) {
 710                 memset(&parse, 0, sizeof(parse));
 711                 parse.idx = -1;
 712
 713                 err = nl80211_parse_key_new(key, &parse);
 714                 if (err)
 715                         goto error;
 716                 err = -EINVAL;
 717                 if (!parse.p.key)
 718                         goto error;
 719                 if (parse.idx < 0 || parse.idx > 4)
 720                         goto error;
 721                 if (parse.def) {
 722                         if (def)
 723                                 goto error;
 724                         def = 1;
 725                         result->def = parse.idx;
 726                         if (!parse.def_uni || !parse.def_multi)
 727                                 goto error;
 728                 } else if (parse.defmgmt)
 729                         goto error;
 730                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 731                                                      parse.idx, false, NULL);
 732                 if (err)
 733                         goto error;
 734                 result->params[parse.idx].cipher = parse.p.cipher;
 735                 result->params[parse.idx].key_len = parse.p.key_len;
 736                 result->params[parse.idx].key = result->data[parse.idx];
 737                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 738
 739                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 740                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 741                         if (no_ht)
 742                                 *no_ht = true;
 743                 }
 744         }
 745
 746         return result;
 747  error:
 748         kfree(result);
 749         return ERR_PTR(err);
 750 }
 751
 752 static int nl80211_key_allowed(struct wireless_dev *wdev)
 753 {
 754         ASSERT_WDEV_LOCK(wdev);
 755
 756         switch (wdev->iftype) {
 757         case NL80211_IFTYPE_AP:
 758         case NL80211_IFTYPE_AP_VLAN:
 759         case NL80211_IFTYPE_P2P_GO:
 760         case NL80211_IFTYPE_MESH_POINT:
 761                 break;
 762         case NL80211_IFTYPE_ADHOC:
 763                 if (!wdev->current_bss)
 764                         return -ENOLINK;
 765                 break;
 766         case NL80211_IFTYPE_STATION:
 767         case NL80211_IFTYPE_P2P_CLIENT:
 768                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 769                         return -ENOLINK;
 770                 break;
 771         default:
 772                 return -EINVAL;
 773         }
 774
 775         return 0;
 776 }
 777
 778 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 779 {
 780         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 781         int i;
 782
 783         if (!nl_modes)
 784                 goto nla_put_failure;
 785
 786         i = 0;
 787         while (ifmodes) {
 788                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 789                         goto nla_put_failure;
 790                 ifmodes >>= 1;
 791                 i++;
 792         }
 793
 794         nla_nest_end(msg, nl_modes);
 795         return 0;
 796
 797 nla_put_failure:
 798         return -ENOBUFS;
 799 }
 800
 801 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 802                                           struct sk_buff *msg)
 803 {
 804         struct nlattr *nl_combis;
 805         int i, j;
 806
 807         nl_combis = nla_nest_start(msg,
 808                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 809         if (!nl_combis)
 810                 goto nla_put_failure;
 811
 812         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 813                 const struct ieee80211_iface_combination *c;
 814                 struct nlattr *nl_combi, *nl_limits;
 815
 816                 c = &wiphy->iface_combinations[i];
 817
 818                 nl_combi = nla_nest_start(msg, i + 1);
 819                 if (!nl_combi)
 820                         goto nla_put_failure;
 821
 822                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 823                 if (!nl_limits)
 824                         goto nla_put_failure;
 825
 826                 for (j = 0; j < c->n_limits; j++) {
 827                         struct nlattr *nl_limit;
 828
 829                         nl_limit = nla_nest_start(msg, j + 1);
 830                         if (!nl_limit)
 831                                 goto nla_put_failure;
 832                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 833                                         c->limits[j].max))
 834                                 goto nla_put_failure;
 835                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 836                                                 c->limits[j].types))
 837                                 goto nla_put_failure;
 838                         nla_nest_end(msg, nl_limit);
 839                 }
 840
 841                 nla_nest_end(msg, nl_limits);
 842
 843                 if (c->beacon_int_infra_match &&
 844                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 845                         goto nla_put_failure;
 846                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 847                                 c->num_different_channels) ||
 848                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 849                                 c->max_interfaces))
 850                         goto nla_put_failure;
 851
 852                 nla_nest_end(msg, nl_combi);
 853         }
 854
 855         nla_nest_end(msg, nl_combis);
 856
 857         return 0;
 858 nla_put_failure:
 859         return -ENOBUFS;
 860 }
 861
 862 static int nl80211_send_wiphy(struct sk_buff *msg, u32 portid, u32 seq, int flags,
 863                               struct cfg80211_registered_device *dev)
 864 {
 865         void *hdr;
 866         struct nlattr *nl_bands, *nl_band;
 867         struct nlattr *nl_freqs, *nl_freq;
 868         struct nlattr *nl_rates, *nl_rate;
 869         struct nlattr *nl_cmds;
 870         enum ieee80211_band band;
 871         struct ieee80211_channel *chan;
 872         struct ieee80211_rate *rate;
 873         int i;
 874         const struct ieee80211_txrx_stypes *mgmt_stypes =
 875                                 dev->wiphy.mgmt_stypes;
 876
 877         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
 878         if (!hdr)
 879                 return -1;
 880
 881         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
 882             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy)) ||
 883             nla_put_u32(msg, NL80211_ATTR_GENERATION,
 884                         cfg80211_rdev_list_generation) ||
 885             nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 886                        dev->wiphy.retry_short) ||
 887             nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 888                        dev->wiphy.retry_long) ||
 889             nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 890                         dev->wiphy.frag_threshold) ||
 891             nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 892                         dev->wiphy.rts_threshold) ||
 893             nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
 894                        dev->wiphy.coverage_class) ||
 895             nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 896                        dev->wiphy.max_scan_ssids) ||
 897             nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
 898                        dev->wiphy.max_sched_scan_ssids) ||
 899             nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 900                         dev->wiphy.max_scan_ie_len) ||
 901             nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
 902                         dev->wiphy.max_sched_scan_ie_len) ||
 903             nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
 904                        dev->wiphy.max_match_sets))
 905                 goto nla_put_failure;
 906
 907         if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
 908             nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
 909                 goto nla_put_failure;
 910         if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
 911             nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
 912                 goto nla_put_failure;
 913         if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
 914             nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
 915                 goto nla_put_failure;
 916         if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
 917             nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
 918                 goto nla_put_failure;
 919         if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
 920             nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
 921                 goto nla_put_failure;
 922         if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
 923             nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
 924                 goto nla_put_failure;
 925
 926         if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
 927                     sizeof(u32) * dev->wiphy.n_cipher_suites,
 928                     dev->wiphy.cipher_suites))
 929                 goto nla_put_failure;
 930
 931         if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
 932                        dev->wiphy.max_num_pmkids))
 933                 goto nla_put_failure;
 934
 935         if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
 936             nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
 937                 goto nla_put_failure;
 938
 939         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
 940                         dev->wiphy.available_antennas_tx) ||
 941             nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
 942                         dev->wiphy.available_antennas_rx))
 943                 goto nla_put_failure;
 944
 945         if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
 946             nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
 947                         dev->wiphy.probe_resp_offload))
 948                 goto nla_put_failure;
 949
 950         if ((dev->wiphy.available_antennas_tx ||
 951              dev->wiphy.available_antennas_rx) && dev->ops->get_antenna) {
 952                 u32 tx_ant = 0, rx_ant = 0;
 953                 int res;
 954                 res = dev->ops->get_antenna(&dev->wiphy, &tx_ant, &rx_ant);
 955                 if (!res) {
 956                         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_TX,
 957                                         tx_ant) ||
 958                             nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_RX,
 959                                         rx_ant))
 960                                 goto nla_put_failure;
 961                 }
 962         }
 963
 964         if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
 965                                 dev->wiphy.interface_modes))
 966                 goto nla_put_failure;
 967
 968         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 969         if (!nl_bands)
 970                 goto nla_put_failure;
 971
 972         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 973                 if (!dev->wiphy.bands[band])
 974                         continue;
 975
 976                 nl_band = nla_nest_start(msg, band);
 977                 if (!nl_band)
 978                         goto nla_put_failure;
 979
 980                 /* add HT info */
 981                 if (dev->wiphy.bands[band]->ht_cap.ht_supported &&
 982                     (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 983                              sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 984                              &dev->wiphy.bands[band]->ht_cap.mcs) ||
 985                      nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
 986                                  dev->wiphy.bands[band]->ht_cap.cap) ||
 987                      nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 988                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor) ||
 989                      nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 990                                 dev->wiphy.bands[band]->ht_cap.ampdu_density)))
 991                         goto nla_put_failure;
 992
 993                 /* add VHT info */
 994                 if (dev->wiphy.bands[band]->vht_cap.vht_supported &&
 995                     (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
 996                              sizeof(dev->wiphy.bands[band]->vht_cap.vht_mcs),
 997                              &dev->wiphy.bands[band]->vht_cap.vht_mcs) ||
 998                      nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
 999                                  dev->wiphy.bands[band]->vht_cap.cap)))
1000                         goto nla_put_failure;
1001
1002                 /* add frequencies */
1003                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
1004                 if (!nl_freqs)
1005                         goto nla_put_failure;
1006
1007                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
1008                         nl_freq = nla_nest_start(msg, i);
1009                         if (!nl_freq)
1010                                 goto nla_put_failure;
1011
1012                         chan = &dev->wiphy.bands[band]->channels[i];
1013
1014                         if (nl80211_msg_put_channel(msg, chan))
1015                                 goto nla_put_failure;
1016
1017                         nla_nest_end(msg, nl_freq);
1018                 }
1019
1020                 nla_nest_end(msg, nl_freqs);
1021
1022                 /* add bitrates */
1023                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1024                 if (!nl_rates)
1025                         goto nla_put_failure;
1026
1027                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
1028                         nl_rate = nla_nest_start(msg, i);
1029                         if (!nl_rate)
1030                                 goto nla_put_failure;
1031
1032                         rate = &dev->wiphy.bands[band]->bitrates[i];
1033                         if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1034                                         rate->bitrate))
1035                                 goto nla_put_failure;
1036                         if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1037                             nla_put_flag(msg,
1038                                          NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1039                                 goto nla_put_failure;
1040
1041                         nla_nest_end(msg, nl_rate);
1042                 }
1043
1044                 nla_nest_end(msg, nl_rates);
1045
1046                 nla_nest_end(msg, nl_band);
1047         }
1048         nla_nest_end(msg, nl_bands);
1049
1050         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1051         if (!nl_cmds)
1052                 goto nla_put_failure;
1053
1054         i = 0;
1055 #define CMD(op, n)                                              \
1056          do {                                                   \
1057                 if (dev->ops->op) {                             \
1058                         i++;                                    \
1059                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1060                                 goto nla_put_failure;           \
1061                 }                                               \
1062         } while (0)
1063
1064         CMD(add_virtual_intf, NEW_INTERFACE);
1065         CMD(change_virtual_intf, SET_INTERFACE);
1066         CMD(add_key, NEW_KEY);
1067         CMD(start_ap, START_AP);
1068         CMD(add_station, NEW_STATION);
1069         CMD(add_mpath, NEW_MPATH);
1070         CMD(update_mesh_config, SET_MESH_CONFIG);
1071         CMD(change_bss, SET_BSS);
1072         CMD(auth, AUTHENTICATE);
1073         CMD(assoc, ASSOCIATE);
1074         CMD(deauth, DEAUTHENTICATE);
1075         CMD(disassoc, DISASSOCIATE);
1076         CMD(join_ibss, JOIN_IBSS);
1077         CMD(join_mesh, JOIN_MESH);
1078         CMD(set_pmksa, SET_PMKSA);
1079         CMD(del_pmksa, DEL_PMKSA);
1080         CMD(flush_pmksa, FLUSH_PMKSA);
1081         if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1082                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1083         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1084         CMD(mgmt_tx, FRAME);
1085         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1086         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1087                 i++;
1088                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1089                         goto nla_put_failure;
1090         }
1091         if (dev->ops->set_monitor_channel || dev->ops->start_ap ||
1092             dev->ops->join_mesh) {
1093                 i++;
1094                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1095                         goto nla_put_failure;
1096         }
1097         CMD(set_wds_peer, SET_WDS_PEER);
1098         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1099                 CMD(tdls_mgmt, TDLS_MGMT);
1100                 CMD(tdls_oper, TDLS_OPER);
1101         }
1102         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1103                 CMD(sched_scan_start, START_SCHED_SCAN);
1104         CMD(probe_client, PROBE_CLIENT);
1105         CMD(set_noack_map, SET_NOACK_MAP);
1106         if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1107                 i++;
1108                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1109                         goto nla_put_failure;
1110         }
1111         CMD(start_p2p_device, START_P2P_DEVICE);
1112
1113 #ifdef CONFIG_NL80211_TESTMODE
1114         CMD(testmode_cmd, TESTMODE);
1115 #endif
1116
1117 #undef CMD
1118
1119         if (dev->ops->connect || dev->ops->auth) {
1120                 i++;
1121                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1122                         goto nla_put_failure;
1123         }
1124
1125         if (dev->ops->disconnect || dev->ops->deauth) {
1126                 i++;
1127                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1128                         goto nla_put_failure;
1129         }
1130
1131         nla_nest_end(msg, nl_cmds);
1132
1133         if (dev->ops->remain_on_channel &&
1134             (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1135             nla_put_u32(msg, NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1136                         dev->wiphy.max_remain_on_channel_duration))
1137                 goto nla_put_failure;
1138
1139         if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1140             nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1141                 goto nla_put_failure;
1142
1143         if (mgmt_stypes) {
1144                 u16 stypes;
1145                 struct nlattr *nl_ftypes, *nl_ifs;
1146                 enum nl80211_iftype ift;
1147
1148                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1149                 if (!nl_ifs)
1150                         goto nla_put_failure;
1151
1152                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1153                         nl_ftypes = nla_nest_start(msg, ift);
1154                         if (!nl_ftypes)
1155                                 goto nla_put_failure;
1156                         i = 0;
1157                         stypes = mgmt_stypes[ift].tx;
1158                         while (stypes) {
1159                                 if ((stypes & 1) &&
1160                                     nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1161                                                 (i << 4) | IEEE80211_FTYPE_MGMT))
1162                                         goto nla_put_failure;
1163                                 stypes >>= 1;
1164                                 i++;
1165                         }
1166                         nla_nest_end(msg, nl_ftypes);
1167                 }
1168
1169                 nla_nest_end(msg, nl_ifs);
1170
1171                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1172                 if (!nl_ifs)
1173                         goto nla_put_failure;
1174
1175                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1176                         nl_ftypes = nla_nest_start(msg, ift);
1177                         if (!nl_ftypes)
1178                                 goto nla_put_failure;
1179                         i = 0;
1180                         stypes = mgmt_stypes[ift].rx;
1181                         while (stypes) {
1182                                 if ((stypes & 1) &&
1183                                     nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1184                                                 (i << 4) | IEEE80211_FTYPE_MGMT))
1185                                         goto nla_put_failure;
1186                                 stypes >>= 1;
1187                                 i++;
1188                         }
1189                         nla_nest_end(msg, nl_ftypes);
1190                 }
1191                 nla_nest_end(msg, nl_ifs);
1192         }
1193
1194 #ifdef CONFIG_PM
1195         if (dev->wiphy.wowlan.flags || dev->wiphy.wowlan.n_patterns) {
1196                 struct nlattr *nl_wowlan;
1197
1198                 nl_wowlan = nla_nest_start(msg,
1199                                 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1200                 if (!nl_wowlan)
1201                         goto nla_put_failure;
1202
1203                 if (((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY) &&
1204                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1205                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT) &&
1206                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1207                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1208                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1209                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1210                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1211                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1212                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1213                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1214                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1215                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1216                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1217                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1218                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1219                     goto nla_put_failure;
1220                 if (dev->wiphy.wowlan.n_patterns) {
1221                         struct nl80211_wowlan_pattern_support pat = {
1222                                 .max_patterns = dev->wiphy.wowlan.n_patterns,
1223                                 .min_pattern_len =
1224                                         dev->wiphy.wowlan.pattern_min_len,
1225                                 .max_pattern_len =
1226                                         dev->wiphy.wowlan.pattern_max_len,
1227                         };
1228                         if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1229                                     sizeof(pat), &pat))
1230                                 goto nla_put_failure;
1231                 }
1232
1233                 nla_nest_end(msg, nl_wowlan);
1234         }
1235 #endif
1236
1237         if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1238                                 dev->wiphy.software_iftypes))
1239                 goto nla_put_failure;
1240
1241         if (nl80211_put_iface_combinations(&dev->wiphy, msg))
1242                 goto nla_put_failure;
1243
1244         if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1245             nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1246                         dev->wiphy.ap_sme_capa))
1247                 goto nla_put_failure;
1248
1249         if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS,
1250                         dev->wiphy.features))
1251                 goto nla_put_failure;
1252
1253         if (dev->wiphy.ht_capa_mod_mask &&
1254             nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1255                     sizeof(*dev->wiphy.ht_capa_mod_mask),
1256                     dev->wiphy.ht_capa_mod_mask))
1257                 goto nla_put_failure;
1258
1259         return genlmsg_end(msg, hdr);
1260
1261  nla_put_failure:
1262         genlmsg_cancel(msg, hdr);
1263         return -EMSGSIZE;
1264 }
1265
1266 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1267 {
1268         int idx = 0;
1269         int start = cb->args[0];
1270         struct cfg80211_registered_device *dev;
1271
1272         mutex_lock(&cfg80211_mutex);
1273         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1274                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1275                         continue;
1276                 if (++idx <= start)
1277                         continue;
1278                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).portid,
1279                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
1280                                        dev) < 0) {
1281                         idx--;
1282                         break;
1283                 }
1284         }
1285         mutex_unlock(&cfg80211_mutex);
1286
1287         cb->args[0] = idx;
1288
1289         return skb->len;
1290 }
1291
1292 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1293 {
1294         struct sk_buff *msg;
1295         struct cfg80211_registered_device *dev = info->user_ptr[0];
1296
1297         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1298         if (!msg)
1299                 return -ENOMEM;
1300
1301         if (nl80211_send_wiphy(msg, info->snd_portid, info->snd_seq, 0, dev) < 0) {
1302                 nlmsg_free(msg);
1303                 return -ENOBUFS;
1304         }
1305
1306         return genlmsg_reply(msg, info);
1307 }
1308
1309 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1310         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1311         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1312         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1313         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1314         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1315 };
1316
1317 static int parse_txq_params(struct nlattr *tb[],
1318                             struct ieee80211_txq_params *txq_params)
1319 {
1320         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1321             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1322             !tb[NL80211_TXQ_ATTR_AIFS])
1323                 return -EINVAL;
1324
1325         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1326         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1327         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1328         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1329         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1330
1331         if (txq_params->ac >= NL80211_NUM_ACS)
1332                 return -EINVAL;
1333
1334         return 0;
1335 }
1336
1337 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1338 {
1339         /*
1340          * You can only set the channel explicitly for WDS interfaces,
1341          * all others have their channel managed via their respective
1342          * "establish a connection" command (connect, join, ...)
1343          *
1344          * For AP/GO and mesh mode, the channel can be set with the
1345          * channel userspace API, but is only stored and passed to the
1346          * low-level driver when the AP starts or the mesh is joined.
1347          * This is for backward compatibility, userspace can also give
1348          * the channel in the start-ap or join-mesh commands instead.
1349          *
1350          * Monitors are special as they are normally slaved to
1351          * whatever else is going on, so they have their own special
1352          * operation to set the monitor channel if possible.
1353          */
1354         return !wdev ||
1355                 wdev->iftype == NL80211_IFTYPE_AP ||
1356                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1357                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1358                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1359 }
1360
1361 static bool nl80211_valid_channel_type(struct genl_info *info,
1362                                        enum nl80211_channel_type *channel_type)
1363 {
1364         enum nl80211_channel_type tmp;
1365
1366         if (!info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE])
1367                 return false;
1368
1369         tmp = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1370         if (tmp != NL80211_CHAN_NO_HT &&
1371             tmp != NL80211_CHAN_HT20 &&
1372             tmp != NL80211_CHAN_HT40PLUS &&
1373             tmp != NL80211_CHAN_HT40MINUS)
1374                 return false;
1375
1376         if (channel_type)
1377                 *channel_type = tmp;
1378
1379         return true;
1380 }
1381
1382 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1383                                  struct wireless_dev *wdev,
1384                                  struct genl_info *info)
1385 {
1386         struct ieee80211_channel *channel;
1387         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
1388         u32 freq;
1389         int result;
1390         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1391
1392         if (wdev)
1393                 iftype = wdev->iftype;
1394
1395         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1396                 return -EINVAL;
1397
1398         if (!nl80211_can_set_dev_channel(wdev))
1399                 return -EOPNOTSUPP;
1400
1401         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
1402             !nl80211_valid_channel_type(info, &channel_type))
1403                 return -EINVAL;
1404
1405         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1406
1407         mutex_lock(&rdev->devlist_mtx);
1408         switch (iftype) {
1409         case NL80211_IFTYPE_AP:
1410         case NL80211_IFTYPE_P2P_GO:
1411                 if (wdev->beacon_interval) {
1412                         result = -EBUSY;
1413                         break;
1414                 }
1415                 channel = rdev_freq_to_chan(rdev, freq, channel_type);
1416                 if (!channel || !cfg80211_can_beacon_sec_chan(&rdev->wiphy,
1417                                                               channel,
1418                                                               channel_type)) {
1419                         result = -EINVAL;
1420                         break;
1421                 }
1422                 wdev->preset_chan = channel;
1423                 wdev->preset_chantype = channel_type;
1424                 result = 0;
1425                 break;
1426         case NL80211_IFTYPE_MESH_POINT:
1427                 result = cfg80211_set_mesh_freq(rdev, wdev, freq, channel_type);
1428                 break;
1429         case NL80211_IFTYPE_MONITOR:
1430                 result = cfg80211_set_monitor_channel(rdev, freq, channel_type);
1431                 break;
1432         default:
1433                 result = -EINVAL;
1434         }
1435         mutex_unlock(&rdev->devlist_mtx);
1436
1437         return result;
1438 }
1439
1440 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1441 {
1442         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1443         struct net_device *netdev = info->user_ptr[1];
1444
1445         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1446 }
1447
1448 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1449 {
1450         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1451         struct net_device *dev = info->user_ptr[1];
1452         struct wireless_dev *wdev = dev->ieee80211_ptr;
1453         const u8 *bssid;
1454
1455         if (!info->attrs[NL80211_ATTR_MAC])
1456                 return -EINVAL;
1457
1458         if (netif_running(dev))
1459                 return -EBUSY;
1460
1461         if (!rdev->ops->set_wds_peer)
1462                 return -EOPNOTSUPP;
1463
1464         if (wdev->iftype != NL80211_IFTYPE_WDS)
1465                 return -EOPNOTSUPP;
1466
1467         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1468         return rdev->ops->set_wds_peer(wdev->wiphy, dev, bssid);
1469 }
1470
1471
1472 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1473 {
1474         struct cfg80211_registered_device *rdev;
1475         struct net_device *netdev = NULL;
1476         struct wireless_dev *wdev;
1477         int result = 0, rem_txq_params = 0;
1478         struct nlattr *nl_txq_params;
1479         u32 changed;
1480         u8 retry_short = 0, retry_long = 0;
1481         u32 frag_threshold = 0, rts_threshold = 0;
1482         u8 coverage_class = 0;
1483
1484         /*
1485          * Try to find the wiphy and netdev. Normally this
1486          * function shouldn't need the netdev, but this is
1487          * done for backward compatibility -- previously
1488          * setting the channel was done per wiphy, but now
1489          * it is per netdev. Previous userland like hostapd
1490          * also passed a netdev to set_wiphy, so that it is
1491          * possible to let that go to the right netdev!
1492          */
1493         mutex_lock(&cfg80211_mutex);
1494
1495         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1496                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1497
1498                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1499                 if (netdev && netdev->ieee80211_ptr) {
1500                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1501                         mutex_lock(&rdev->mtx);
1502                 } else
1503                         netdev = NULL;
1504         }
1505
1506         if (!netdev) {
1507                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
1508                                                   info->attrs);
1509                 if (IS_ERR(rdev)) {
1510                         mutex_unlock(&cfg80211_mutex);
1511                         return PTR_ERR(rdev);
1512                 }
1513                 wdev = NULL;
1514                 netdev = NULL;
1515                 result = 0;
1516
1517                 mutex_lock(&rdev->mtx);
1518         } else if (nl80211_can_set_dev_channel(netdev->ieee80211_ptr))
1519                 wdev = netdev->ieee80211_ptr;
1520         else
1521                 wdev = NULL;
1522
1523         /*
1524          * end workaround code, by now the rdev is available
1525          * and locked, and wdev may or may not be NULL.
1526          */
1527
1528         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1529                 result = cfg80211_dev_rename(
1530                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1531
1532         mutex_unlock(&cfg80211_mutex);
1533
1534         if (result)
1535                 goto bad_res;
1536
1537         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1538                 struct ieee80211_txq_params txq_params;
1539                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1540
1541                 if (!rdev->ops->set_txq_params) {
1542                         result = -EOPNOTSUPP;
1543                         goto bad_res;
1544                 }
1545
1546                 if (!netdev) {
1547                         result = -EINVAL;
1548                         goto bad_res;
1549                 }
1550
1551                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1552                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
1553                         result = -EINVAL;
1554                         goto bad_res;
1555                 }
1556
1557                 if (!netif_running(netdev)) {
1558                         result = -ENETDOWN;
1559                         goto bad_res;
1560                 }
1561
1562                 nla_for_each_nested(nl_txq_params,
1563                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1564                                     rem_txq_params) {
1565                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1566                                   nla_data(nl_txq_params),
1567                                   nla_len(nl_txq_params),
1568                                   txq_params_policy);
1569                         result = parse_txq_params(tb, &txq_params);
1570                         if (result)
1571                                 goto bad_res;
1572
1573                         result = rdev->ops->set_txq_params(&rdev->wiphy,
1574                                                            netdev,
1575                                                            &txq_params);
1576                         if (result)
1577                                 goto bad_res;
1578                 }
1579         }
1580
1581         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1582                 result = __nl80211_set_channel(rdev, wdev, info);
1583                 if (result)
1584                         goto bad_res;
1585         }
1586
1587         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1588                 enum nl80211_tx_power_setting type;
1589                 int idx, mbm = 0;
1590
1591                 if (!rdev->ops->set_tx_power) {
1592                         result = -EOPNOTSUPP;
1593                         goto bad_res;
1594                 }
1595
1596                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1597                 type = nla_get_u32(info->attrs[idx]);
1598
1599                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1600                     (type != NL80211_TX_POWER_AUTOMATIC)) {
1601                         result = -EINVAL;
1602                         goto bad_res;
1603                 }
1604
1605                 if (type != NL80211_TX_POWER_AUTOMATIC) {
1606                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1607                         mbm = nla_get_u32(info->attrs[idx]);
1608                 }
1609
1610                 result = rdev->ops->set_tx_power(&rdev->wiphy, type, mbm);
1611                 if (result)
1612                         goto bad_res;
1613         }
1614
1615         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
1616             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
1617                 u32 tx_ant, rx_ant;
1618                 if ((!rdev->wiphy.available_antennas_tx &&
1619                      !rdev->wiphy.available_antennas_rx) ||
1620                     !rdev->ops->set_antenna) {
1621                         result = -EOPNOTSUPP;
1622                         goto bad_res;
1623                 }
1624
1625                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
1626                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
1627
1628                 /* reject antenna configurations which don't match the
1629                  * available antenna masks, except for the "all" mask */
1630                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
1631                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
1632                         result = -EINVAL;
1633                         goto bad_res;
1634                 }
1635
1636                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
1637                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
1638
1639                 result = rdev->ops->set_antenna(&rdev->wiphy, tx_ant, rx_ant);
1640                 if (result)
1641                         goto bad_res;
1642         }
1643
1644         changed = 0;
1645
1646         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
1647                 retry_short = nla_get_u8(
1648                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
1649                 if (retry_short == 0) {
1650                         result = -EINVAL;
1651                         goto bad_res;
1652                 }
1653                 changed |= WIPHY_PARAM_RETRY_SHORT;
1654         }
1655
1656         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
1657                 retry_long = nla_get_u8(
1658                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
1659                 if (retry_long == 0) {
1660                         result = -EINVAL;
1661                         goto bad_res;
1662                 }
1663                 changed |= WIPHY_PARAM_RETRY_LONG;
1664         }
1665
1666         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
1667                 frag_threshold = nla_get_u32(
1668                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
1669                 if (frag_threshold < 256) {
1670                         result = -EINVAL;
1671                         goto bad_res;
1672                 }
1673                 if (frag_threshold != (u32) -1) {
1674                         /*
1675                          * Fragments (apart from the last one) are required to
1676                          * have even length. Make the fragmentation code
1677                          * simpler by stripping LSB should someone try to use
1678                          * odd threshold value.
1679                          */
1680                         frag_threshold &= ~0x1;
1681                 }
1682                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
1683         }
1684
1685         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
1686                 rts_threshold = nla_get_u32(
1687                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
1688                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
1689         }
1690
1691         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
1692                 coverage_class = nla_get_u8(
1693                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
1694                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
1695         }
1696
1697         if (changed) {
1698                 u8 old_retry_short, old_retry_long;
1699                 u32 old_frag_threshold, old_rts_threshold;
1700                 u8 old_coverage_class;
1701
1702                 if (!rdev->ops->set_wiphy_params) {
1703                         result = -EOPNOTSUPP;
1704                         goto bad_res;
1705                 }
1706
1707                 old_retry_short = rdev->wiphy.retry_short;
1708                 old_retry_long = rdev->wiphy.retry_long;
1709                 old_frag_threshold = rdev->wiphy.frag_threshold;
1710                 old_rts_threshold = rdev->wiphy.rts_threshold;
1711                 old_coverage_class = rdev->wiphy.coverage_class;
1712
1713                 if (changed & WIPHY_PARAM_RETRY_SHORT)
1714                         rdev->wiphy.retry_short = retry_short;
1715                 if (changed & WIPHY_PARAM_RETRY_LONG)
1716                         rdev->wiphy.retry_long = retry_long;
1717                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
1718                         rdev->wiphy.frag_threshold = frag_threshold;
1719                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
1720                         rdev->wiphy.rts_threshold = rts_threshold;
1721                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
1722                         rdev->wiphy.coverage_class = coverage_class;
1723
1724                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
1725                 if (result) {
1726                         rdev->wiphy.retry_short = old_retry_short;
1727                         rdev->wiphy.retry_long = old_retry_long;
1728                         rdev->wiphy.frag_threshold = old_frag_threshold;
1729                         rdev->wiphy.rts_threshold = old_rts_threshold;
1730                         rdev->wiphy.coverage_class = old_coverage_class;
1731                 }
1732         }
1733
1734  bad_res:
1735         mutex_unlock(&rdev->mtx);
1736         if (netdev)
1737                 dev_put(netdev);
1738         return result;
1739 }
1740
1741 static inline u64 wdev_id(struct wireless_dev *wdev)
1742 {
1743         return (u64)wdev->identifier |
1744                ((u64)wiphy_to_dev(wdev->wiphy)->wiphy_idx << 32);
1745 }
1746
1747 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
1748                               struct cfg80211_registered_device *rdev,
1749                               struct wireless_dev *wdev)
1750 {
1751         struct net_device *dev = wdev->netdev;
1752         void *hdr;
1753
1754         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
1755         if (!hdr)
1756                 return -1;
1757
1758         if (dev &&
1759             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
1760              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
1761                 goto nla_put_failure;
1762
1763         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1764             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
1765             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
1766             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
1767             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1768                         rdev->devlist_generation ^
1769                         (cfg80211_rdev_list_generation << 2)))
1770                 goto nla_put_failure;
1771
1772         if (rdev->ops->get_channel) {
1773                 struct ieee80211_channel *chan;
1774                 enum nl80211_channel_type channel_type;
1775
1776                 chan = rdev->ops->get_channel(&rdev->wiphy, wdev,
1777                                               &channel_type);
1778                 if (chan &&
1779                     (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
1780                                  chan->center_freq) ||
1781                      nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
1782                                  channel_type)))
1783                         goto nla_put_failure;
1784         }
1785
1786         return genlmsg_end(msg, hdr);
1787
1788  nla_put_failure:
1789         genlmsg_cancel(msg, hdr);
1790         return -EMSGSIZE;
1791 }
1792
1793 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
1794 {
1795         int wp_idx = 0;
1796         int if_idx = 0;
1797         int wp_start = cb->args[0];
1798         int if_start = cb->args[1];
1799         struct cfg80211_registered_device *rdev;
1800         struct wireless_dev *wdev;
1801
1802         mutex_lock(&cfg80211_mutex);
1803         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1804                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1805                         continue;
1806                 if (wp_idx < wp_start) {
1807                         wp_idx++;
1808                         continue;
1809                 }
1810                 if_idx = 0;
1811
1812                 mutex_lock(&rdev->devlist_mtx);
1813                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
1814                         if (if_idx < if_start) {
1815                                 if_idx++;
1816                                 continue;
1817                         }
1818                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
1819                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
1820                                                rdev, wdev) < 0) {
1821                                 mutex_unlock(&rdev->devlist_mtx);
1822                                 goto out;
1823                         }
1824                         if_idx++;
1825                 }
1826                 mutex_unlock(&rdev->devlist_mtx);
1827
1828                 wp_idx++;
1829         }
1830  out:
1831         mutex_unlock(&cfg80211_mutex);
1832
1833         cb->args[0] = wp_idx;
1834         cb->args[1] = if_idx;
1835
1836         return skb->len;
1837 }
1838
1839 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
1840 {
1841         struct sk_buff *msg;
1842         struct cfg80211_registered_device *dev = info->user_ptr[0];
1843         struct wireless_dev *wdev = info->user_ptr[1];
1844
1845         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1846         if (!msg)
1847                 return -ENOMEM;
1848
1849         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
1850                                dev, wdev) < 0) {
1851                 nlmsg_free(msg);
1852                 return -ENOBUFS;
1853         }
1854
1855         return genlmsg_reply(msg, info);
1856 }
1857
1858 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
1859         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
1860         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
1861         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
1862         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
1863         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
1864 };
1865
1866 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
1867 {
1868         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
1869         int flag;
1870
1871         *mntrflags = 0;
1872
1873         if (!nla)
1874                 return -EINVAL;
1875
1876         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
1877                              nla, mntr_flags_policy))
1878                 return -EINVAL;
1879
1880         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
1881                 if (flags[flag])
1882                         *mntrflags |= (1<<flag);
1883
1884         return 0;
1885 }
1886
1887 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
1888                                struct net_device *netdev, u8 use_4addr,
1889                                enum nl80211_iftype iftype)
1890 {
1891         if (!use_4addr) {
1892                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
1893                         return -EBUSY;
1894                 return 0;
1895         }
1896
1897         switch (iftype) {
1898         case NL80211_IFTYPE_AP_VLAN:
1899                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
1900                         return 0;
1901                 break;
1902         case NL80211_IFTYPE_STATION:
1903                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
1904                         return 0;
1905                 break;
1906         default:
1907                 break;
1908         }
1909
1910         return -EOPNOTSUPP;
1911 }
1912
1913 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
1914 {
1915         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1916         struct vif_params params;
1917         int err;
1918         enum nl80211_iftype otype, ntype;
1919         struct net_device *dev = info->user_ptr[1];
1920         u32 _flags, *flags = NULL;
1921         bool change = false;
1922
1923         memset(&params, 0, sizeof(params));
1924
1925         otype = ntype = dev->ieee80211_ptr->iftype;
1926
1927         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1928                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1929                 if (otype != ntype)
1930                         change = true;
1931                 if (ntype > NL80211_IFTYPE_MAX)
1932                         return -EINVAL;
1933         }
1934
1935         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1936                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1937
1938                 if (ntype != NL80211_IFTYPE_MESH_POINT)
1939                         return -EINVAL;
1940                 if (netif_running(dev))
1941                         return -EBUSY;
1942
1943                 wdev_lock(wdev);
1944                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1945                              IEEE80211_MAX_MESH_ID_LEN);
1946                 wdev->mesh_id_up_len =
1947                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1948                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1949                        wdev->mesh_id_up_len);
1950                 wdev_unlock(wdev);
1951         }
1952
1953         if (info->attrs[NL80211_ATTR_4ADDR]) {
1954                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1955                 change = true;
1956                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
1957                 if (err)
1958                         return err;
1959         } else {
1960                 params.use_4addr = -1;
1961         }
1962
1963         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1964                 if (ntype != NL80211_IFTYPE_MONITOR)
1965                         return -EINVAL;
1966                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1967                                           &_flags);
1968                 if (err)
1969                         return err;
1970
1971                 flags = &_flags;
1972                 change = true;
1973         }
1974
1975         if (change)
1976                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
1977         else
1978                 err = 0;
1979
1980         if (!err && params.use_4addr != -1)
1981                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
1982
1983         return err;
1984 }
1985
1986 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1987 {
1988         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1989         struct vif_params params;
1990         struct wireless_dev *wdev;
1991         struct sk_buff *msg;
1992         int err;
1993         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
1994         u32 flags;
1995
1996         memset(&params, 0, sizeof(params));
1997
1998         if (!info->attrs[NL80211_ATTR_IFNAME])
1999                 return -EINVAL;
2000
2001         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2002                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2003                 if (type > NL80211_IFTYPE_MAX)
2004                         return -EINVAL;
2005         }
2006
2007         if (!rdev->ops->add_virtual_intf ||
2008             !(rdev->wiphy.interface_modes & (1 << type)))
2009                 return -EOPNOTSUPP;
2010
2011         if (info->attrs[NL80211_ATTR_4ADDR]) {
2012                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2013                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2014                 if (err)
2015                         return err;
2016         }
2017
2018         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2019         if (!msg)
2020                 return -ENOMEM;
2021
2022         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2023                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2024                                   &flags);
2025         wdev = rdev->ops->add_virtual_intf(&rdev->wiphy,
2026                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2027                 type, err ? NULL : &flags, &params);
2028         if (IS_ERR(wdev)) {
2029                 nlmsg_free(msg);
2030                 return PTR_ERR(wdev);
2031         }
2032
2033         switch (type) {
2034         case NL80211_IFTYPE_MESH_POINT:
2035                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2036                         break;
2037                 wdev_lock(wdev);
2038                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2039                              IEEE80211_MAX_MESH_ID_LEN);
2040                 wdev->mesh_id_up_len =
2041                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2042                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2043                        wdev->mesh_id_up_len);
2044                 wdev_unlock(wdev);
2045                 break;
2046         case NL80211_IFTYPE_P2P_DEVICE:
2047                 /*
2048                  * P2P Device doesn't have a netdev, so doesn't go
2049                  * through the netdev notifier and must be added here
2050                  */
2051                 mutex_init(&wdev->mtx);
2052                 INIT_LIST_HEAD(&wdev->event_list);
2053                 spin_lock_init(&wdev->event_lock);
2054                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2055                 spin_lock_init(&wdev->mgmt_registrations_lock);
2056
2057                 mutex_lock(&rdev->devlist_mtx);
2058                 wdev->identifier = ++rdev->wdev_id;
2059                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2060                 rdev->devlist_generation++;
2061                 mutex_unlock(&rdev->devlist_mtx);
2062                 break;
2063         default:
2064                 break;
2065         }
2066
2067         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2068                                rdev, wdev) < 0) {
2069                 nlmsg_free(msg);
2070                 return -ENOBUFS;
2071         }
2072
2073         return genlmsg_reply(msg, info);
2074 }
2075
2076 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2077 {
2078         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2079         struct wireless_dev *wdev = info->user_ptr[1];
2080
2081         if (!rdev->ops->del_virtual_intf)
2082                 return -EOPNOTSUPP;
2083
2084         /*
2085          * If we remove a wireless device without a netdev then clear
2086          * user_ptr[1] so that nl80211_post_doit won't dereference it
2087          * to check if it needs to do dev_put(). Otherwise it crashes
2088          * since the wdev has been freed, unlike with a netdev where
2089          * we need the dev_put() for the netdev to really be freed.
2090          */
2091         if (!wdev->netdev)
2092                 info->user_ptr[1] = NULL;
2093
2094         return rdev->ops->del_virtual_intf(&rdev->wiphy, wdev);
2095 }
2096
2097 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2098 {
2099         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2100         struct net_device *dev = info->user_ptr[1];
2101         u16 noack_map;
2102
2103         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2104                 return -EINVAL;
2105
2106         if (!rdev->ops->set_noack_map)
2107                 return -EOPNOTSUPP;
2108
2109         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2110
2111         return rdev->ops->set_noack_map(&rdev->wiphy, dev, noack_map);
2112 }
2113
2114 struct get_key_cookie {
2115         struct sk_buff *msg;
2116         int error;
2117         int idx;
2118 };
2119
2120 static void get_key_callback(void *c, struct key_params *params)
2121 {
2122         struct nlattr *key;
2123         struct get_key_cookie *cookie = c;
2124
2125         if ((params->key &&
2126              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2127                      params->key_len, params->key)) ||
2128             (params->seq &&
2129              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2130                      params->seq_len, params->seq)) ||
2131             (params->cipher &&
2132              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2133                          params->cipher)))
2134                 goto nla_put_failure;
2135
2136         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2137         if (!key)
2138                 goto nla_put_failure;
2139
2140         if ((params->key &&
2141              nla_put(cookie->msg, NL80211_KEY_DATA,
2142                      params->key_len, params->key)) ||
2143             (params->seq &&
2144              nla_put(cookie->msg, NL80211_KEY_SEQ,
2145                      params->seq_len, params->seq)) ||
2146             (params->cipher &&
2147              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2148                          params->cipher)))
2149                 goto nla_put_failure;
2150
2151         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2152                 goto nla_put_failure;
2153
2154         nla_nest_end(cookie->msg, key);
2155
2156         return;
2157  nla_put_failure:
2158         cookie->error = 1;
2159 }
2160
2161 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2162 {
2163         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2164         int err;
2165         struct net_device *dev = info->user_ptr[1];
2166         u8 key_idx = 0;
2167         const u8 *mac_addr = NULL;
2168         bool pairwise;
2169         struct get_key_cookie cookie = {
2170                 .error = 0,
2171         };
2172         void *hdr;
2173         struct sk_buff *msg;
2174
2175         if (info->attrs[NL80211_ATTR_KEY_IDX])
2176                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2177
2178         if (key_idx > 5)
2179                 return -EINVAL;
2180
2181         if (info->attrs[NL80211_ATTR_MAC])
2182                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2183
2184         pairwise = !!mac_addr;
2185         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2186                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2187                 if (kt >= NUM_NL80211_KEYTYPES)
2188                         return -EINVAL;
2189                 if (kt != NL80211_KEYTYPE_GROUP &&
2190                     kt != NL80211_KEYTYPE_PAIRWISE)
2191                         return -EINVAL;
2192                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2193         }
2194
2195         if (!rdev->ops->get_key)
2196                 return -EOPNOTSUPP;
2197
2198         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2199         if (!msg)
2200                 return -ENOMEM;
2201
2202         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2203                              NL80211_CMD_NEW_KEY);
2204         if (IS_ERR(hdr))
2205                 return PTR_ERR(hdr);
2206
2207         cookie.msg = msg;
2208         cookie.idx = key_idx;
2209
2210         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2211             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2212                 goto nla_put_failure;
2213         if (mac_addr &&
2214             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2215                 goto nla_put_failure;
2216
2217         if (pairwise && mac_addr &&
2218             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2219                 return -ENOENT;
2220
2221         err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, pairwise,
2222                                  mac_addr, &cookie, get_key_callback);
2223
2224         if (err)
2225                 goto free_msg;
2226
2227         if (cookie.error)
2228                 goto nla_put_failure;
2229
2230         genlmsg_end(msg, hdr);
2231         return genlmsg_reply(msg, info);
2232
2233  nla_put_failure:
2234         err = -ENOBUFS;
2235  free_msg:
2236         nlmsg_free(msg);
2237         return err;
2238 }
2239
2240 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2241 {
2242         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2243         struct key_parse key;
2244         int err;
2245         struct net_device *dev = info->user_ptr[1];
2246
2247         err = nl80211_parse_key(info, &key);
2248         if (err)
2249                 return err;
2250
2251         if (key.idx < 0)
2252                 return -EINVAL;
2253
2254         /* only support setting default key */
2255         if (!key.def && !key.defmgmt)
2256                 return -EINVAL;
2257
2258         wdev_lock(dev->ieee80211_ptr);
2259
2260         if (key.def) {
2261                 if (!rdev->ops->set_default_key) {
2262                         err = -EOPNOTSUPP;
2263                         goto out;
2264                 }
2265
2266                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2267                 if (err)
2268                         goto out;
2269
2270                 err = rdev->ops->set_default_key(&rdev->wiphy, dev, key.idx,
2271                                                  key.def_uni, key.def_multi);
2272
2273                 if (err)
2274                         goto out;
2275
2276 #ifdef CONFIG_CFG80211_WEXT
2277                 dev->ieee80211_ptr->wext.default_key = key.idx;
2278 #endif
2279         } else {
2280                 if (key.def_uni || !key.def_multi) {
2281                         err = -EINVAL;
2282                         goto out;
2283                 }
2284
2285                 if (!rdev->ops->set_default_mgmt_key) {
2286                         err = -EOPNOTSUPP;
2287                         goto out;
2288                 }
2289
2290                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2291                 if (err)
2292                         goto out;
2293
2294                 err = rdev->ops->set_default_mgmt_key(&rdev->wiphy,
2295                                                       dev, key.idx);
2296                 if (err)
2297                         goto out;
2298
2299 #ifdef CONFIG_CFG80211_WEXT
2300                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2301 #endif
2302         }
2303
2304  out:
2305         wdev_unlock(dev->ieee80211_ptr);
2306
2307         return err;
2308 }
2309
2310 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2311 {
2312         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2313         int err;
2314         struct net_device *dev = info->user_ptr[1];
2315         struct key_parse key;
2316         const u8 *mac_addr = NULL;
2317
2318         err = nl80211_parse_key(info, &key);
2319         if (err)
2320                 return err;
2321
2322         if (!key.p.key)
2323                 return -EINVAL;
2324
2325         if (info->attrs[NL80211_ATTR_MAC])
2326                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2327
2328         if (key.type == -1) {
2329                 if (mac_addr)
2330                         key.type = NL80211_KEYTYPE_PAIRWISE;
2331                 else
2332                         key.type = NL80211_KEYTYPE_GROUP;
2333         }
2334
2335         /* for now */
2336         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2337             key.type != NL80211_KEYTYPE_GROUP)
2338                 return -EINVAL;
2339
2340         if (!rdev->ops->add_key)
2341                 return -EOPNOTSUPP;
2342
2343         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2344                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2345                                            mac_addr))
2346                 return -EINVAL;
2347
2348         wdev_lock(dev->ieee80211_ptr);
2349         err = nl80211_key_allowed(dev->ieee80211_ptr);
2350         if (!err)
2351                 err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
2352                                          key.type == NL80211_KEYTYPE_PAIRWISE,
2353                                          mac_addr, &key.p);
2354         wdev_unlock(dev->ieee80211_ptr);
2355
2356         return err;
2357 }
2358
2359 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2360 {
2361         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2362         int err;
2363         struct net_device *dev = info->user_ptr[1];
2364         u8 *mac_addr = NULL;
2365         struct key_parse key;
2366
2367         err = nl80211_parse_key(info, &key);
2368         if (err)
2369                 return err;
2370
2371         if (info->attrs[NL80211_ATTR_MAC])
2372                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2373
2374         if (key.type == -1) {
2375                 if (mac_addr)
2376                         key.type = NL80211_KEYTYPE_PAIRWISE;
2377                 else
2378                         key.type = NL80211_KEYTYPE_GROUP;
2379         }
2380
2381         /* for now */
2382         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2383             key.type != NL80211_KEYTYPE_GROUP)
2384                 return -EINVAL;
2385
2386         if (!rdev->ops->del_key)
2387                 return -EOPNOTSUPP;
2388
2389         wdev_lock(dev->ieee80211_ptr);
2390         err = nl80211_key_allowed(dev->ieee80211_ptr);
2391
2392         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2393             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2394                 err = -ENOENT;
2395
2396         if (!err)
2397                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx,
2398                                          key.type == NL80211_KEYTYPE_PAIRWISE,
2399                                          mac_addr);
2400
2401 #ifdef CONFIG_CFG80211_WEXT
2402         if (!err) {
2403                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
2404                         dev->ieee80211_ptr->wext.default_key = -1;
2405                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2406                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2407         }
2408 #endif
2409         wdev_unlock(dev->ieee80211_ptr);
2410
2411         return err;
2412 }
2413
2414 static int nl80211_parse_beacon(struct genl_info *info,
2415                                 struct cfg80211_beacon_data *bcn)
2416 {
2417         bool haveinfo = false;
2418
2419         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]) ||
2420             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]) ||
2421             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
2422             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2423                 return -EINVAL;
2424
2425         memset(bcn, 0, sizeof(*bcn));
2426
2427         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
2428                 bcn->head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2429                 bcn->head_len = nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2430                 if (!bcn->head_len)
2431                         return -EINVAL;
2432                 haveinfo = true;
2433         }
2434
2435         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
2436                 bcn->tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2437                 bcn->tail_len =
2438                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2439                 haveinfo = true;
2440         }
2441
2442         if (!haveinfo)
2443                 return -EINVAL;
2444
2445         if (info->attrs[NL80211_ATTR_IE]) {
2446                 bcn->beacon_ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2447                 bcn->beacon_ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2448         }
2449
2450         if (info->attrs[NL80211_ATTR_IE_PROBE_RESP]) {
2451                 bcn->proberesp_ies =
2452                         nla_data(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2453                 bcn->proberesp_ies_len =
2454                         nla_len(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2455         }
2456
2457         if (info->attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
2458                 bcn->assocresp_ies =
2459                         nla_data(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2460                 bcn->assocresp_ies_len =
2461                         nla_len(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2462         }
2463
2464         if (info->attrs[NL80211_ATTR_PROBE_RESP]) {
2465                 bcn->probe_resp =
2466                         nla_data(info->attrs[NL80211_ATTR_PROBE_RESP]);
2467                 bcn->probe_resp_len =
2468                         nla_len(info->attrs[NL80211_ATTR_PROBE_RESP]);
2469         }
2470
2471         return 0;
2472 }
2473
2474 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
2475                                    struct cfg80211_ap_settings *params)
2476 {
2477         struct wireless_dev *wdev;
2478         bool ret = false;
2479
2480         mutex_lock(&rdev->devlist_mtx);
2481
2482         list_for_each_entry(wdev, &rdev->wdev_list, list) {
2483                 if (wdev->iftype != NL80211_IFTYPE_AP &&
2484                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
2485                         continue;
2486
2487                 if (!wdev->preset_chan)
2488                         continue;
2489
2490                 params->channel = wdev->preset_chan;
2491                 params->channel_type = wdev->preset_chantype;
2492                 ret = true;
2493                 break;
2494         }
2495
2496         mutex_unlock(&rdev->devlist_mtx);
2497
2498         return ret;
2499 }
2500
2501 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
2502                                     enum nl80211_auth_type auth_type,
2503                                     enum nl80211_commands cmd)
2504 {
2505         if (auth_type > NL80211_AUTHTYPE_MAX)
2506                 return false;
2507
2508         switch (cmd) {
2509         case NL80211_CMD_AUTHENTICATE:
2510                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
2511                     auth_type == NL80211_AUTHTYPE_SAE)
2512                         return false;
2513                 return true;
2514         case NL80211_CMD_CONNECT:
2515         case NL80211_CMD_START_AP:
2516                 /* SAE not supported yet */
2517                 if (auth_type == NL80211_AUTHTYPE_SAE)
2518                         return false;
2519                 return true;
2520         default:
2521                 return false;
2522         }
2523 }
2524
2525 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
2526 {
2527         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2528         struct net_device *dev = info->user_ptr[1];
2529         struct wireless_dev *wdev = dev->ieee80211_ptr;
2530         struct cfg80211_ap_settings params;
2531         int err;
2532
2533         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2534             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2535                 return -EOPNOTSUPP;
2536
2537         if (!rdev->ops->start_ap)
2538                 return -EOPNOTSUPP;
2539
2540         if (wdev->beacon_interval)
2541                 return -EALREADY;
2542
2543         memset(&params, 0, sizeof(params));
2544
2545         /* these are required for START_AP */
2546         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
2547             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
2548             !info->attrs[NL80211_ATTR_BEACON_HEAD])
2549                 return -EINVAL;
2550
2551         err = nl80211_parse_beacon(info, &params.beacon);
2552         if (err)
2553                 return err;
2554
2555         params.beacon_interval =
2556                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
2557         params.dtim_period =
2558                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
2559
2560         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
2561         if (err)
2562                 return err;
2563
2564         /*
2565          * In theory, some of these attributes should be required here
2566          * but since they were not used when the command was originally
2567          * added, keep them optional for old user space programs to let
2568          * them continue to work with drivers that do not need the
2569          * additional information -- drivers must check!
2570          */
2571         if (info->attrs[NL80211_ATTR_SSID]) {
2572                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2573                 params.ssid_len =
2574                         nla_len(info->attrs[NL80211_ATTR_SSID]);
2575                 if (params.ssid_len == 0 ||
2576                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
2577                         return -EINVAL;
2578         }
2579
2580         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
2581                 params.hidden_ssid = nla_get_u32(
2582                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
2583                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
2584                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
2585                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
2586                         return -EINVAL;
2587         }
2588
2589         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
2590
2591         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
2592                 params.auth_type = nla_get_u32(
2593                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
2594                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
2595                                              NL80211_CMD_START_AP))
2596                         return -EINVAL;
2597         } else
2598                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
2599
2600         err = nl80211_crypto_settings(rdev, info, &params.crypto,
2601                                       NL80211_MAX_NR_CIPHER_SUITES);
2602         if (err)
2603                 return err;
2604
2605         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
2606                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
2607                         return -EOPNOTSUPP;
2608                 params.inactivity_timeout = nla_get_u16(
2609                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
2610         }
2611
2612         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2613                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
2614
2615                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
2616                     !nl80211_valid_channel_type(info, &channel_type))
2617                         return -EINVAL;
2618
2619                 params.channel = rdev_freq_to_chan(rdev,
2620                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]),
2621                         channel_type);
2622                 if (!params.channel)
2623                         return -EINVAL;
2624                 params.channel_type = channel_type;
2625         } else if (wdev->preset_chan) {
2626                 params.channel = wdev->preset_chan;
2627                 params.channel_type = wdev->preset_chantype;
2628         } else if (!nl80211_get_ap_channel(rdev, &params))
2629                 return -EINVAL;
2630
2631         if (!cfg80211_can_beacon_sec_chan(&rdev->wiphy, params.channel,
2632                                           params.channel_type))
2633                 return -EINVAL;
2634
2635         mutex_lock(&rdev->devlist_mtx);
2636         err = cfg80211_can_use_chan(rdev, wdev, params.channel,
2637                                     CHAN_MODE_SHARED);
2638         mutex_unlock(&rdev->devlist_mtx);
2639
2640         if (err)
2641                 return err;
2642
2643         err = rdev->ops->start_ap(&rdev->wiphy, dev, &params);
2644         if (!err) {
2645                 wdev->preset_chan = params.channel;
2646                 wdev->preset_chantype = params.channel_type;
2647                 wdev->beacon_interval = params.beacon_interval;
2648                 wdev->channel = params.channel;
2649         }
2650         return err;
2651 }
2652
2653 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
2654 {
2655         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2656         struct net_device *dev = info->user_ptr[1];
2657         struct wireless_dev *wdev = dev->ieee80211_ptr;
2658         struct cfg80211_beacon_data params;
2659         int err;
2660
2661         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2662             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2663                 return -EOPNOTSUPP;
2664
2665         if (!rdev->ops->change_beacon)
2666                 return -EOPNOTSUPP;
2667
2668         if (!wdev->beacon_interval)
2669                 return -EINVAL;
2670
2671         err = nl80211_parse_beacon(info, &params);
2672         if (err)
2673                 return err;
2674
2675         return rdev->ops->change_beacon(&rdev->wiphy, dev, &params);
2676 }
2677
2678 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
2679 {
2680         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2681         struct net_device *dev = info->user_ptr[1];
2682
2683         return cfg80211_stop_ap(rdev, dev);
2684 }
2685
2686 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
2687         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
2688         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
2689         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
2690         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
2691         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
2692         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
2693 };
2694
2695 static int parse_station_flags(struct genl_info *info,
2696                                enum nl80211_iftype iftype,
2697                                struct station_parameters *params)
2698 {
2699         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
2700         struct nlattr *nla;
2701         int flag;
2702
2703         /*
2704          * Try parsing the new attribute first so userspace
2705          * can specify both for older kernels.
2706          */
2707         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
2708         if (nla) {
2709                 struct nl80211_sta_flag_update *sta_flags;
2710
2711                 sta_flags = nla_data(nla);
2712                 params->sta_flags_mask = sta_flags->mask;
2713                 params->sta_flags_set = sta_flags->set;
2714                 if ((params->sta_flags_mask |
2715                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
2716                         return -EINVAL;
2717                 return 0;
2718         }
2719
2720         /* if present, parse the old attribute */
2721
2722         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
2723         if (!nla)
2724                 return 0;
2725
2726         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
2727                              nla, sta_flags_policy))
2728                 return -EINVAL;
2729
2730         /*
2731          * Only allow certain flags for interface types so that
2732          * other attributes are silently ignored. Remember that
2733          * this is backward compatibility code with old userspace
2734          * and shouldn't be hit in other cases anyway.
2735          */
2736         switch (iftype) {
2737         case NL80211_IFTYPE_AP:
2738         case NL80211_IFTYPE_AP_VLAN:
2739         case NL80211_IFTYPE_P2P_GO:
2740                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
2741                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
2742                                          BIT(NL80211_STA_FLAG_WME) |
2743                                          BIT(NL80211_STA_FLAG_MFP);
2744                 break;
2745         case NL80211_IFTYPE_P2P_CLIENT:
2746         case NL80211_IFTYPE_STATION:
2747                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
2748                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
2749                 break;
2750         case NL80211_IFTYPE_MESH_POINT:
2751                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
2752                                          BIT(NL80211_STA_FLAG_MFP) |
2753                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
2754         default:
2755                 return -EINVAL;
2756         }
2757
2758         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
2759                 if (flags[flag]) {
2760                         params->sta_flags_set |= (1<<flag);
2761
2762                         /* no longer support new API additions in old API */
2763                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
2764                                 return -EINVAL;
2765                 }
2766         }
2767
2768         return 0;
2769 }
2770
2771 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
2772                                  int attr)
2773 {
2774         struct nlattr *rate;
2775         u32 bitrate;
2776         u16 bitrate_compat;
2777
2778         rate = nla_nest_start(msg, attr);
2779         if (!rate)
2780                 goto nla_put_failure;
2781
2782         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
2783         bitrate = cfg80211_calculate_bitrate(info);
2784         /* report 16-bit bitrate only if we can */
2785         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
2786         if ((bitrate > 0 &&
2787              nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate)) ||
2788             (bitrate_compat > 0 &&
2789              nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat)) ||
2790             ((info->flags & RATE_INFO_FLAGS_MCS) &&
2791              nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs)) ||
2792             ((info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) &&
2793              nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH)) ||
2794             ((info->flags & RATE_INFO_FLAGS_SHORT_GI) &&
2795              nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)))
2796                 goto nla_put_failure;
2797
2798         nla_nest_end(msg, rate);
2799         return true;
2800
2801 nla_put_failure:
2802         return false;
2803 }
2804
2805 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
2806                                 int flags,
2807                                 struct cfg80211_registered_device *rdev,
2808                                 struct net_device *dev,
2809                                 const u8 *mac_addr, struct station_info *sinfo)
2810 {
2811         void *hdr;
2812         struct nlattr *sinfoattr, *bss_param;
2813
2814         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
2815         if (!hdr)
2816                 return -1;
2817
2818         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2819             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
2820             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
2821                 goto nla_put_failure;
2822
2823         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
2824         if (!sinfoattr)
2825                 goto nla_put_failure;
2826         if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
2827             nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
2828                         sinfo->connected_time))
2829                 goto nla_put_failure;
2830         if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
2831             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
2832                         sinfo->inactive_time))
2833                 goto nla_put_failure;
2834         if ((sinfo->filled & STATION_INFO_RX_BYTES) &&
2835             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
2836                         sinfo->rx_bytes))
2837                 goto nla_put_failure;
2838         if ((sinfo->filled & STATION_INFO_TX_BYTES) &&
2839             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
2840                         sinfo->tx_bytes))
2841                 goto nla_put_failure;
2842         if ((sinfo->filled & STATION_INFO_LLID) &&
2843             nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
2844                 goto nla_put_failure;
2845         if ((sinfo->filled & STATION_INFO_PLID) &&
2846             nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
2847                 goto nla_put_failure;
2848         if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
2849             nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
2850                        sinfo->plink_state))
2851                 goto nla_put_failure;
2852         switch (rdev->wiphy.signal_type) {
2853         case CFG80211_SIGNAL_TYPE_MBM:
2854                 if ((sinfo->filled & STATION_INFO_SIGNAL) &&
2855                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
2856                                sinfo->signal))
2857                         goto nla_put_failure;
2858                 if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
2859                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
2860                                sinfo->signal_avg))
2861                         goto nla_put_failure;
2862                 break;
2863         default:
2864                 break;
2865         }
2866         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
2867                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
2868                                           NL80211_STA_INFO_TX_BITRATE))
2869                         goto nla_put_failure;
2870         }
2871         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
2872                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
2873                                           NL80211_STA_INFO_RX_BITRATE))
2874                         goto nla_put_failure;
2875         }
2876         if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
2877             nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
2878                         sinfo->rx_packets))
2879                 goto nla_put_failure;
2880         if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
2881             nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
2882                         sinfo->tx_packets))
2883                 goto nla_put_failure;
2884         if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
2885             nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
2886                         sinfo->tx_retries))
2887                 goto nla_put_failure;
2888         if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
2889             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
2890                         sinfo->tx_failed))
2891                 goto nla_put_failure;
2892         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
2893             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
2894                         sinfo->beacon_loss_count))
2895                 goto nla_put_failure;
2896         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
2897                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
2898                 if (!bss_param)
2899                         goto nla_put_failure;
2900
2901                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
2902                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
2903                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
2904                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
2905                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
2906                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
2907                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
2908                                sinfo->bss_param.dtim_period) ||
2909                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
2910                                 sinfo->bss_param.beacon_interval))
2911                         goto nla_put_failure;
2912
2913                 nla_nest_end(msg, bss_param);
2914         }
2915         if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
2916             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
2917                     sizeof(struct nl80211_sta_flag_update),
2918                     &sinfo->sta_flags))
2919                 goto nla_put_failure;
2920         if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
2921                 nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
2922                             sinfo->t_offset))
2923                 goto nla_put_failure;
2924         nla_nest_end(msg, sinfoattr);
2925
2926         if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
2927             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
2928                     sinfo->assoc_req_ies))
2929                 goto nla_put_failure;
2930
2931         return genlmsg_end(msg, hdr);
2932
2933  nla_put_failure:
2934         genlmsg_cancel(msg, hdr);
2935         return -EMSGSIZE;
2936 }
2937
2938 static int nl80211_dump_station(struct sk_buff *skb,
2939                                 struct netlink_callback *cb)
2940 {
2941         struct station_info sinfo;
2942         struct cfg80211_registered_device *dev;
2943         struct net_device *netdev;
2944         u8 mac_addr[ETH_ALEN];
2945         int sta_idx = cb->args[1];
2946         int err;
2947
2948         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2949         if (err)
2950                 return err;
2951
2952         if (!dev->ops->dump_station) {
2953                 err = -EOPNOTSUPP;
2954                 goto out_err;
2955         }
2956
2957         while (1) {
2958                 memset(&sinfo, 0, sizeof(sinfo));
2959                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
2960                                              mac_addr, &sinfo);
2961                 if (err == -ENOENT)
2962                         break;
2963                 if (err)
2964                         goto out_err;
2965
2966                 if (nl80211_send_station(skb,
2967                                 NETLINK_CB(cb->skb).portid,
2968                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2969                                 dev, netdev, mac_addr,
2970                                 &sinfo) < 0)
2971                         goto out;
2972
2973                 sta_idx++;
2974         }
2975
2976
2977  out:
2978         cb->args[1] = sta_idx;
2979         err = skb->len;
2980  out_err:
2981         nl80211_finish_netdev_dump(dev);
2982
2983         return err;
2984 }
2985
2986 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
2987 {
2988         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2989         struct net_device *dev = info->user_ptr[1];
2990         struct station_info sinfo;
2991         struct sk_buff *msg;
2992         u8 *mac_addr = NULL;
2993         int err;
2994
2995         memset(&sinfo, 0, sizeof(sinfo));
2996
2997         if (!info->attrs[NL80211_ATTR_MAC])
2998                 return -EINVAL;
2999
3000         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3001
3002         if (!rdev->ops->get_station)
3003                 return -EOPNOTSUPP;
3004
3005         err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
3006         if (err)
3007                 return err;
3008
3009         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3010         if (!msg)
3011                 return -ENOMEM;
3012
3013         if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3014                                  rdev, dev, mac_addr, &sinfo) < 0) {
3015                 nlmsg_free(msg);
3016                 return -ENOBUFS;
3017         }
3018
3019         return genlmsg_reply(msg, info);
3020 }
3021
3022 /*
3023  * Get vlan interface making sure it is running and on the right wiphy.
3024  */
3025 static struct net_device *get_vlan(struct genl_info *info,
3026                                    struct cfg80211_registered_device *rdev)
3027 {
3028         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
3029         struct net_device *v;
3030         int ret;
3031
3032         if (!vlanattr)
3033                 return NULL;
3034
3035         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
3036         if (!v)
3037                 return ERR_PTR(-ENODEV);
3038
3039         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
3040                 ret = -EINVAL;
3041                 goto error;
3042         }
3043
3044         if (!netif_running(v)) {
3045                 ret = -ENETDOWN;
3046                 goto error;
3047         }
3048
3049         return v;
3050  error:
3051         dev_put(v);
3052         return ERR_PTR(ret);
3053 }
3054
3055 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
3056 {
3057         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3058         int err;
3059         struct net_device *dev = info->user_ptr[1];
3060         struct station_parameters params;
3061         u8 *mac_addr = NULL;
3062
3063         memset(&params, 0, sizeof(params));
3064
3065         params.listen_interval = -1;
3066         params.plink_state = -1;
3067
3068         if (info->attrs[NL80211_ATTR_STA_AID])
3069                 return -EINVAL;
3070
3071         if (!info->attrs[NL80211_ATTR_MAC])
3072                 return -EINVAL;
3073
3074         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3075
3076         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
3077                 params.supported_rates =
3078                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3079                 params.supported_rates_len =
3080                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3081         }
3082
3083         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3084                 params.listen_interval =
3085                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
3086
3087         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3088                 params.ht_capa =
3089                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3090
3091         if (!rdev->ops->change_station)
3092                 return -EOPNOTSUPP;
3093
3094         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3095                 return -EINVAL;
3096
3097         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
3098                 params.plink_action =
3099                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3100
3101         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE])
3102                 params.plink_state =
3103                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
3104
3105         switch (dev->ieee80211_ptr->iftype) {
3106         case NL80211_IFTYPE_AP:
3107         case NL80211_IFTYPE_AP_VLAN:
3108         case NL80211_IFTYPE_P2P_GO:
3109                 /* disallow mesh-specific things */
3110                 if (params.plink_action)
3111                         return -EINVAL;
3112
3113                 /* TDLS can't be set, ... */
3114                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3115                         return -EINVAL;
3116                 /*
3117                  * ... but don't bother the driver with it. This works around
3118                  * a hostapd/wpa_supplicant issue -- it always includes the
3119                  * TLDS_PEER flag in the mask even for AP mode.
3120                  */
3121                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3122
3123                 /* accept only the listed bits */
3124                 if (params.sta_flags_mask &
3125                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3126                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3127                                   BIT(NL80211_STA_FLAG_WME) |
3128                                   BIT(NL80211_STA_FLAG_MFP)))
3129                         return -EINVAL;
3130
3131                 /* must be last in here for error handling */
3132                 params.vlan = get_vlan(info, rdev);
3133                 if (IS_ERR(params.vlan))
3134                         return PTR_ERR(params.vlan);
3135                 break;
3136         case NL80211_IFTYPE_P2P_CLIENT:
3137         case NL80211_IFTYPE_STATION:
3138                 /*
3139                  * Don't allow userspace to change the TDLS_PEER flag,
3140                  * but silently ignore attempts to change it since we
3141                  * don't have state here to verify that it doesn't try
3142                  * to change the flag.
3143                  */
3144                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3145                 /* fall through */
3146         case NL80211_IFTYPE_ADHOC:
3147                 /* disallow things sta doesn't support */
3148                 if (params.plink_action)
3149                         return -EINVAL;
3150                 if (params.ht_capa)
3151                         return -EINVAL;
3152                 if (params.listen_interval >= 0)
3153                         return -EINVAL;
3154                 /* reject any changes other than AUTHORIZED */
3155                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
3156                         return -EINVAL;
3157                 break;
3158         case NL80211_IFTYPE_MESH_POINT:
3159                 /* disallow things mesh doesn't support */
3160                 if (params.vlan)
3161                         return -EINVAL;
3162                 if (params.ht_capa)
3163                         return -EINVAL;
3164                 if (params.listen_interval >= 0)
3165                         return -EINVAL;
3166                 /*
3167                  * No special handling for TDLS here -- the userspace
3168                  * mesh code doesn't have this bug.
3169                  */
3170                 if (params.sta_flags_mask &
3171                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3172                                   BIT(NL80211_STA_FLAG_MFP) |
3173                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3174                         return -EINVAL;
3175                 break;
3176         default:
3177                 return -EOPNOTSUPP;
3178         }
3179
3180         /* be aware of params.vlan when changing code here */
3181
3182         err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
3183
3184         if (params.vlan)
3185                 dev_put(params.vlan);
3186
3187         return err;
3188 }
3189
3190 static struct nla_policy
3191 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
3192         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
3193         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
3194 };
3195
3196 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
3197 {
3198         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3199         int err;
3200         struct net_device *dev = info->user_ptr[1];
3201         struct station_parameters params;
3202         u8 *mac_addr = NULL;
3203
3204         memset(&params, 0, sizeof(params));
3205
3206         if (!info->attrs[NL80211_ATTR_MAC])
3207                 return -EINVAL;
3208
3209         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3210                 return -EINVAL;
3211
3212         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
3213                 return -EINVAL;
3214
3215         if (!info->attrs[NL80211_ATTR_STA_AID])
3216                 return -EINVAL;
3217
3218         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3219         params.supported_rates =
3220                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3221         params.supported_rates_len =
3222                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3223         params.listen_interval =
3224                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
3225
3226         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
3227         if (!params.aid || params.aid > IEEE80211_MAX_AID)
3228                 return -EINVAL;
3229
3230         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3231                 params.ht_capa =
3232                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3233
3234         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
3235                 params.vht_capa =
3236                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
3237
3238         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
3239                 params.plink_action =
3240                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3241
3242         if (!rdev->ops->add_station)
3243                 return -EOPNOTSUPP;
3244
3245         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3246                 return -EINVAL;
3247
3248         switch (dev->ieee80211_ptr->iftype) {
3249         case NL80211_IFTYPE_AP:
3250         case NL80211_IFTYPE_AP_VLAN:
3251         case NL80211_IFTYPE_P2P_GO:
3252                 /* parse WME attributes if sta is WME capable */
3253                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
3254                     (params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)) &&
3255                     info->attrs[NL80211_ATTR_STA_WME]) {
3256                         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
3257                         struct nlattr *nla;
3258
3259                         nla = info->attrs[NL80211_ATTR_STA_WME];
3260                         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
3261                                                nl80211_sta_wme_policy);
3262                         if (err)
3263                                 return err;
3264
3265                         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
3266                                 params.uapsd_queues =
3267                                      nla_get_u8(tb[NL80211_STA_WME_UAPSD_QUEUES]);
3268                         if (params.uapsd_queues &
3269                                         ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
3270                                 return -EINVAL;
3271
3272                         if (tb[NL80211_STA_WME_MAX_SP])
3273                                 params.max_sp =
3274                                      nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
3275
3276                         if (params.max_sp &
3277                                         ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
3278                                 return -EINVAL;
3279
3280                         params.sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
3281                 }
3282                 /* TDLS peers cannot be added */
3283                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3284                         return -EINVAL;
3285                 /* but don't bother the driver with it */
3286                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3287
3288                 /* must be last in here for error handling */
3289                 params.vlan = get_vlan(info, rdev);
3290                 if (IS_ERR(params.vlan))
3291                         return PTR_ERR(params.vlan);
3292                 break;
3293         case NL80211_IFTYPE_MESH_POINT:
3294                 /* TDLS peers cannot be added */
3295                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3296                         return -EINVAL;
3297                 break;
3298         case NL80211_IFTYPE_STATION:
3299                 /* Only TDLS peers can be added */
3300                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3301                         return -EINVAL;
3302                 /* Can only add if TDLS ... */
3303                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
3304                         return -EOPNOTSUPP;
3305                 /* ... with external setup is supported */
3306                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
3307                         return -EOPNOTSUPP;
3308                 break;
3309         default:
3310                 return -EOPNOTSUPP;
3311         }
3312
3313         /* be aware of params.vlan when changing code here */
3314
3315         err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
3316
3317         if (params.vlan)
3318                 dev_put(params.vlan);
3319         return err;
3320 }
3321
3322 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
3323 {
3324         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3325         struct net_device *dev = info->user_ptr[1];
3326         u8 *mac_addr = NULL;
3327
3328         if (info->attrs[NL80211_ATTR_MAC])
3329                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3330
3331         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3332             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
3333             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
3334             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3335                 return -EINVAL;
3336
3337         if (!rdev->ops->del_station)
3338                 return -EOPNOTSUPP;
3339
3340         return rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
3341 }
3342
3343 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
3344                                 int flags, struct net_device *dev,
3345                                 u8 *dst, u8 *next_hop,
3346                                 struct mpath_info *pinfo)
3347 {
3348         void *hdr;
3349         struct nlattr *pinfoattr;
3350
3351         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3352         if (!hdr)
3353                 return -1;
3354
3355         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3356             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
3357             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
3358             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
3359                 goto nla_put_failure;
3360
3361         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
3362         if (!pinfoattr)
3363                 goto nla_put_failure;
3364         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
3365             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
3366                         pinfo->frame_qlen))
3367                 goto nla_put_failure;
3368         if (((pinfo->filled & MPATH_INFO_SN) &&
3369              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
3370             ((pinfo->filled & MPATH_INFO_METRIC) &&
3371              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
3372                          pinfo->metric)) ||
3373             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
3374              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
3375                          pinfo->exptime)) ||
3376             ((pinfo->filled & MPATH_INFO_FLAGS) &&
3377              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
3378                         pinfo->flags)) ||
3379             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
3380              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
3381                          pinfo->discovery_timeout)) ||
3382             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
3383              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
3384                         pinfo->discovery_retries)))
3385                 goto nla_put_failure;
3386
3387         nla_nest_end(msg, pinfoattr);
3388
3389         return genlmsg_end(msg, hdr);
3390
3391  nla_put_failure:
3392         genlmsg_cancel(msg, hdr);
3393         return -EMSGSIZE;
3394 }
3395
3396 static int nl80211_dump_mpath(struct sk_buff *skb,
3397                               struct netlink_callback *cb)
3398 {
3399         struct mpath_info pinfo;
3400         struct cfg80211_registered_device *dev;
3401         struct net_device *netdev;
3402         u8 dst[ETH_ALEN];
3403         u8 next_hop[ETH_ALEN];
3404         int path_idx = cb->args[1];
3405         int err;
3406
3407         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
3408         if (err)
3409                 return err;
3410
3411         if (!dev->ops->dump_mpath) {
3412                 err = -EOPNOTSUPP;
3413                 goto out_err;
3414         }
3415
3416         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
3417                 err = -EOPNOTSUPP;
3418                 goto out_err;
3419         }
3420
3421         while (1) {
3422                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
3423                                            dst, next_hop, &pinfo);
3424                 if (err == -ENOENT)
3425                         break;
3426                 if (err)
3427                         goto out_err;
3428
3429                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
3430                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
3431                                        netdev, dst, next_hop,
3432                                        &pinfo) < 0)
3433                         goto out;
3434
3435                 path_idx++;
3436         }
3437
3438
3439  out:
3440         cb->args[1] = path_idx;
3441         err = skb->len;
3442  out_err:
3443         nl80211_finish_netdev_dump(dev);
3444         return err;
3445 }
3446
3447 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
3448 {
3449         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3450         int err;
3451         struct net_device *dev = info->user_ptr[1];
3452         struct mpath_info pinfo;
3453         struct sk_buff *msg;
3454         u8 *dst = NULL;
3455         u8 next_hop[ETH_ALEN];
3456
3457         memset(&pinfo, 0, sizeof(pinfo));
3458
3459         if (!info->attrs[NL80211_ATTR_MAC])
3460                 return -EINVAL;
3461
3462         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3463
3464         if (!rdev->ops->get_mpath)
3465                 return -EOPNOTSUPP;
3466
3467         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3468                 return -EOPNOTSUPP;
3469
3470         err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
3471         if (err)
3472                 return err;
3473
3474         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3475         if (!msg)
3476                 return -ENOMEM;
3477
3478         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
3479                                  dev, dst, next_hop, &pinfo) < 0) {
3480                 nlmsg_free(msg);
3481                 return -ENOBUFS;
3482         }
3483
3484         return genlmsg_reply(msg, info);
3485 }
3486
3487 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
3488 {
3489         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3490         struct net_device *dev = info->user_ptr[1];
3491         u8 *dst = NULL;
3492         u8 *next_hop = NULL;
3493
3494         if (!info->attrs[NL80211_ATTR_MAC])
3495                 return -EINVAL;
3496
3497         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
3498                 return -EINVAL;
3499
3500         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3501         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
3502
3503         if (!rdev->ops->change_mpath)
3504                 return -EOPNOTSUPP;
3505
3506         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3507                 return -EOPNOTSUPP;
3508
3509         return rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
3510 }
3511
3512 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
3513 {
3514         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3515         struct net_device *dev = info->user_ptr[1];
3516         u8 *dst = NULL;
3517         u8 *next_hop = NULL;
3518
3519         if (!info->attrs[NL80211_ATTR_MAC])
3520                 return -EINVAL;
3521
3522         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
3523                 return -EINVAL;
3524
3525         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3526         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
3527
3528         if (!rdev->ops->add_mpath)
3529                 return -EOPNOTSUPP;
3530
3531         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3532                 return -EOPNOTSUPP;
3533
3534         return rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
3535 }
3536
3537 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
3538 {
3539         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3540         struct net_device *dev = info->user_ptr[1];
3541         u8 *dst = NULL;
3542
3543         if (info->attrs[NL80211_ATTR_MAC])
3544                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3545
3546         if (!rdev->ops->del_mpath)
3547                 return -EOPNOTSUPP;
3548
3549         return rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
3550 }
3551
3552 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
3553 {
3554         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3555         struct net_device *dev = info->user_ptr[1];
3556         struct bss_parameters params;
3557
3558         memset(&params, 0, sizeof(params));
3559         /* default to not changing parameters */
3560         params.use_cts_prot = -1;
3561         params.use_short_preamble = -1;
3562         params.use_short_slot_time = -1;
3563         params.ap_isolate = -1;
3564         params.ht_opmode = -1;
3565
3566         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
3567                 params.use_cts_prot =
3568                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
3569         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
3570                 params.use_short_preamble =
3571                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
3572         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
3573                 params.use_short_slot_time =
3574                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
3575         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
3576                 params.basic_rates =
3577                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3578                 params.basic_rates_len =
3579                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3580         }
3581         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
3582                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
3583         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
3584                 params.ht_opmode =
3585                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
3586
3587         if (!rdev->ops->change_bss)
3588                 return -EOPNOTSUPP;
3589
3590         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3591             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3592                 return -EOPNOTSUPP;
3593
3594         return rdev->ops->change_bss(&rdev->wiphy, dev, &params);
3595 }
3596
3597 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
3598         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
3599         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
3600         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
3601         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
3602         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
3603         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
3604 };
3605
3606 static int parse_reg_rule(struct nlattr *tb[],
3607         struct ieee80211_reg_rule *reg_rule)
3608 {
3609         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
3610         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
3611
3612         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
3613                 return -EINVAL;
3614         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
3615                 return -EINVAL;
3616         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
3617                 return -EINVAL;
3618         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
3619                 return -EINVAL;
3620         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
3621                 return -EINVAL;
3622
3623         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
3624
3625         freq_range->start_freq_khz =
3626                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
3627         freq_range->end_freq_khz =
3628                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
3629         freq_range->max_bandwidth_khz =
3630                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
3631
3632         power_rule->max_eirp =
3633                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
3634
3635         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
3636                 power_rule->max_antenna_gain =
3637                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
3638
3639         return 0;
3640 }
3641
3642 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
3643 {
3644         int r;
3645         char *data = NULL;
3646         enum nl80211_user_reg_hint_type user_reg_hint_type;
3647
3648         /*
3649          * You should only get this when cfg80211 hasn't yet initialized
3650          * completely when built-in to the kernel right between the time
3651          * window between nl80211_init() and regulatory_init(), if that is
3652          * even possible.
3653          */
3654         mutex_lock(&cfg80211_mutex);
3655         if (unlikely(!cfg80211_regdomain)) {
3656                 mutex_unlock(&cfg80211_mutex);
3657                 return -EINPROGRESS;
3658         }
3659         mutex_unlock(&cfg80211_mutex);
3660
3661         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
3662                 return -EINVAL;
3663
3664         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
3665
3666         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
3667                 user_reg_hint_type =
3668                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
3669         else
3670                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
3671
3672         switch (user_reg_hint_type) {
3673         case NL80211_USER_REG_HINT_USER:
3674         case NL80211_USER_REG_HINT_CELL_BASE:
3675                 break;
3676         default:
3677                 return -EINVAL;
3678         }
3679
3680         r = regulatory_hint_user(data, user_reg_hint_type);
3681
3682         return r;
3683 }
3684
3685 static int nl80211_get_mesh_config(struct sk_buff *skb,
3686                                    struct genl_info *info)
3687 {
3688         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3689         struct net_device *dev = info->user_ptr[1];
3690         struct wireless_dev *wdev = dev->ieee80211_ptr;
3691         struct mesh_config cur_params;
3692         int err = 0;
3693         void *hdr;
3694         struct nlattr *pinfoattr;
3695         struct sk_buff *msg;
3696
3697         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
3698                 return -EOPNOTSUPP;
3699
3700         if (!rdev->ops->get_mesh_config)
3701                 return -EOPNOTSUPP;
3702
3703         wdev_lock(wdev);
3704         /* If not connected, get default parameters */
3705         if (!wdev->mesh_id_len)
3706                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
3707         else
3708                 err = rdev->ops->get_mesh_config(&rdev->wiphy, dev,
3709                                                  &cur_params);
3710         wdev_unlock(wdev);
3711
3712         if (err)
3713                 return err;
3714
3715         /* Draw up a netlink message to send back */
3716         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3717         if (!msg)
3718                 return -ENOMEM;
3719         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
3720                              NL80211_CMD_GET_MESH_CONFIG);
3721         if (!hdr)
3722                 goto out;
3723         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
3724         if (!pinfoattr)
3725                 goto nla_put_failure;
3726         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3727             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
3728                         cur_params.dot11MeshRetryTimeout) ||
3729             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
3730                         cur_params.dot11MeshConfirmTimeout) ||
3731             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
3732                         cur_params.dot11MeshHoldingTimeout) ||
3733             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
3734                         cur_params.dot11MeshMaxPeerLinks) ||
3735             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
3736                        cur_params.dot11MeshMaxRetries) ||
3737             nla_put_u8(msg, NL80211_MESHCONF_TTL,
3738                        cur_params.dot11MeshTTL) ||
3739             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
3740                        cur_params.element_ttl) ||
3741             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
3742                        cur_params.auto_open_plinks) ||
3743             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
3744                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
3745             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3746                        cur_params.dot11MeshHWMPmaxPREQretries) ||
3747             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
3748                         cur_params.path_refresh_time) ||
3749             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3750                         cur_params.min_discovery_timeout) ||
3751             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3752                         cur_params.dot11MeshHWMPactivePathTimeout) ||
3753             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3754                         cur_params.dot11MeshHWMPpreqMinInterval) ||
3755             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
3756                         cur_params.dot11MeshHWMPperrMinInterval) ||
3757             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3758                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
3759             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
3760                        cur_params.dot11MeshHWMPRootMode) ||
3761             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3762                         cur_params.dot11MeshHWMPRannInterval) ||
3763             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3764                        cur_params.dot11MeshGateAnnouncementProtocol) ||
3765             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
3766                        cur_params.dot11MeshForwarding) ||
3767             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
3768                         cur_params.rssi_threshold) ||
3769             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
3770                         cur_params.ht_opmode) ||
3771             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
3772                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
3773             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
3774                         cur_params.dot11MeshHWMProotInterval) ||
3775             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
3776                         cur_params.dot11MeshHWMPconfirmationInterval))
3777                 goto nla_put_failure;
3778         nla_nest_end(msg, pinfoattr);
3779         genlmsg_end(msg, hdr);
3780         return genlmsg_reply(msg, info);
3781
3782  nla_put_failure:
3783         genlmsg_cancel(msg, hdr);
3784  out:
3785         nlmsg_free(msg);
3786         return -ENOBUFS;
3787 }
3788
3789 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
3790         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
3791         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
3792         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
3793         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
3794         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
3795         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
3796         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
3797         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
3798         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
3799         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
3800         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
3801         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
3802         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
3803         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
3804         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
3805         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
3806         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
3807         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
3808         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
3809         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
3810         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
3811         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
3812         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
3813         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
3814         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
3815 };
3816
3817 static const struct nla_policy
3818         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
3819         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
3820         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
3821         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
3822         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
3823         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
3824                                     .len = IEEE80211_MAX_DATA_LEN },
3825         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
3826 };
3827
3828 static int nl80211_parse_mesh_config(struct genl_info *info,
3829                                      struct mesh_config *cfg,
3830                                      u32 *mask_out)
3831 {
3832         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
3833         u32 mask = 0;
3834
3835 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
3836 do {\
3837         if (table[attr_num]) {\
3838                 cfg->param = nla_fn(table[attr_num]); \
3839                 mask |= (1 << (attr_num - 1)); \
3840         } \
3841 } while (0);\
3842
3843
3844         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
3845                 return -EINVAL;
3846         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
3847                              info->attrs[NL80211_ATTR_MESH_CONFIG],
3848                              nl80211_meshconf_params_policy))
3849                 return -EINVAL;
3850
3851         /* This makes sure that there aren't more than 32 mesh config
3852          * parameters (otherwise our bitfield scheme would not work.) */
3853         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
3854
3855         /* Fill in the params struct */
3856         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
3857                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
3858                                   nla_get_u16);
3859         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
3860                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
3861                                   nla_get_u16);
3862         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
3863                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
3864                                   nla_get_u16);
3865         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
3866                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
3867                                   nla_get_u16);
3868         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
3869                                   mask, NL80211_MESHCONF_MAX_RETRIES,
3870                                   nla_get_u8);
3871         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
3872                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
3873         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl,
3874                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
3875                                   nla_get_u8);
3876         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
3877                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
3878                                   nla_get_u8);
3879         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor, mask,
3880                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
3881                                   nla_get_u32);
3882         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
3883                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3884                                   nla_get_u8);
3885         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
3886                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
3887                                   nla_get_u32);
3888         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
3889                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3890                                   nla_get_u16);
3891         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout, mask,
3892                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3893                                   nla_get_u32);
3894         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
3895                                   mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3896                                   nla_get_u16);
3897         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
3898                                   mask, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
3899                                   nla_get_u16);
3900         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3901                                   dot11MeshHWMPnetDiameterTraversalTime, mask,
3902                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3903                                   nla_get_u16);
3904         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
3905                                   NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
3906         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
3907                                   NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3908                                   nla_get_u16);
3909         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3910                                   dot11MeshGateAnnouncementProtocol, mask,
3911                                   NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3912                                   nla_get_u8);
3913         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding,
3914                                   mask, NL80211_MESHCONF_FORWARDING,
3915                                   nla_get_u8);
3916         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold,
3917                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
3918                                   nla_get_u32);
3919         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode,
3920                                   mask, NL80211_MESHCONF_HT_OPMODE,
3921                                   nla_get_u16);
3922         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
3923                                   mask,
3924                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
3925                                   nla_get_u32);
3926         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval,
3927                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
3928                                   nla_get_u16);
3929         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3930                                   dot11MeshHWMPconfirmationInterval, mask,
3931                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
3932                                   nla_get_u16);
3933         if (mask_out)
3934                 *mask_out = mask;
3935
3936         return 0;
3937
3938 #undef FILL_IN_MESH_PARAM_IF_SET
3939 }
3940
3941 static int nl80211_parse_mesh_setup(struct genl_info *info,
3942                                      struct mesh_setup *setup)
3943 {
3944         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
3945
3946         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
3947                 return -EINVAL;
3948         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
3949                              info->attrs[NL80211_ATTR_MESH_SETUP],
3950                              nl80211_mesh_setup_params_policy))
3951                 return -EINVAL;
3952
3953         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
3954                 setup->sync_method =
3955                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
3956                  IEEE80211_SYNC_METHOD_VENDOR :
3957                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
3958
3959         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
3960                 setup->path_sel_proto =
3961                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
3962                  IEEE80211_PATH_PROTOCOL_VENDOR :
3963                  IEEE80211_PATH_PROTOCOL_HWMP;
3964
3965         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
3966                 setup->path_metric =
3967                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
3968                  IEEE80211_PATH_METRIC_VENDOR :
3969                  IEEE80211_PATH_METRIC_AIRTIME;
3970
3971
3972         if (tb[NL80211_MESH_SETUP_IE]) {
3973                 struct nlattr *ieattr =
3974                         tb[NL80211_MESH_SETUP_IE];
3975                 if (!is_valid_ie_attr(ieattr))
3976                         return -EINVAL;
3977                 setup->ie = nla_data(ieattr);
3978                 setup->ie_len = nla_len(ieattr);
3979         }
3980         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
3981         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
3982
3983         return 0;
3984 }
3985
3986 static int nl80211_update_mesh_config(struct sk_buff *skb,
3987                                       struct genl_info *info)
3988 {
3989         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3990         struct net_device *dev = info->user_ptr[1];
3991         struct wireless_dev *wdev = dev->ieee80211_ptr;
3992         struct mesh_config cfg;
3993         u32 mask;
3994         int err;
3995
3996         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
3997                 return -EOPNOTSUPP;
3998
3999         if (!rdev->ops->update_mesh_config)
4000                 return -EOPNOTSUPP;
4001
4002         err = nl80211_parse_mesh_config(info, &cfg, &mask);
4003         if (err)
4004                 return err;
4005
4006         wdev_lock(wdev);
4007         if (!wdev->mesh_id_len)
4008                 err = -ENOLINK;
4009
4010         if (!err)
4011                 err = rdev->ops->update_mesh_config(&rdev->wiphy, dev,
4012                                                     mask, &cfg);
4013
4014         wdev_unlock(wdev);
4015
4016         return err;
4017 }
4018
4019 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
4020 {
4021         struct sk_buff *msg;
4022         void *hdr = NULL;
4023         struct nlattr *nl_reg_rules;
4024         unsigned int i;
4025         int err = -EINVAL;
4026
4027         mutex_lock(&cfg80211_mutex);
4028
4029         if (!cfg80211_regdomain)
4030                 goto out;
4031
4032         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4033         if (!msg) {
4034                 err = -ENOBUFS;
4035                 goto out;
4036         }
4037
4038         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4039                              NL80211_CMD_GET_REG);
4040         if (!hdr)
4041                 goto put_failure;
4042
4043         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
4044                            cfg80211_regdomain->alpha2) ||
4045             (cfg80211_regdomain->dfs_region &&
4046              nla_put_u8(msg, NL80211_ATTR_DFS_REGION,
4047                         cfg80211_regdomain->dfs_region)))
4048                 goto nla_put_failure;
4049
4050         if (reg_last_request_cell_base() &&
4051             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
4052                         NL80211_USER_REG_HINT_CELL_BASE))
4053                 goto nla_put_failure;
4054
4055         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
4056         if (!nl_reg_rules)
4057                 goto nla_put_failure;
4058
4059         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
4060                 struct nlattr *nl_reg_rule;
4061                 const struct ieee80211_reg_rule *reg_rule;
4062                 const struct ieee80211_freq_range *freq_range;
4063                 const struct ieee80211_power_rule *power_rule;
4064
4065                 reg_rule = &cfg80211_regdomain->reg_rules[i];
4066                 freq_range = &reg_rule->freq_range;
4067                 power_rule = &reg_rule->power_rule;
4068
4069                 nl_reg_rule = nla_nest_start(msg, i);
4070                 if (!nl_reg_rule)
4071                         goto nla_put_failure;
4072
4073                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
4074                                 reg_rule->flags) ||
4075                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
4076                                 freq_range->start_freq_khz) ||
4077                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
4078                                 freq_range->end_freq_khz) ||
4079                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
4080                                 freq_range->max_bandwidth_khz) ||
4081                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
4082                                 power_rule->max_antenna_gain) ||
4083                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
4084                                 power_rule->max_eirp))
4085                         goto nla_put_failure;
4086
4087                 nla_nest_end(msg, nl_reg_rule);
4088         }
4089
4090         nla_nest_end(msg, nl_reg_rules);
4091
4092         genlmsg_end(msg, hdr);
4093         err = genlmsg_reply(msg, info);
4094         goto out;
4095
4096 nla_put_failure:
4097         genlmsg_cancel(msg, hdr);
4098 put_failure:
4099         nlmsg_free(msg);
4100         err = -EMSGSIZE;
4101 out:
4102         mutex_unlock(&cfg80211_mutex);
4103         return err;
4104 }
4105
4106 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
4107 {
4108         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
4109         struct nlattr *nl_reg_rule;
4110         char *alpha2 = NULL;
4111         int rem_reg_rules = 0, r = 0;
4112         u32 num_rules = 0, rule_idx = 0, size_of_regd;
4113         u8 dfs_region = 0;
4114         struct ieee80211_regdomain *rd = NULL;
4115
4116         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4117                 return -EINVAL;
4118
4119         if (!info->attrs[NL80211_ATTR_REG_RULES])
4120                 return -EINVAL;
4121
4122         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4123
4124         if (info->attrs[NL80211_ATTR_DFS_REGION])
4125                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
4126
4127         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
4128                         rem_reg_rules) {
4129                 num_rules++;
4130                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
4131                         return -EINVAL;
4132         }
4133
4134         mutex_lock(&cfg80211_mutex);
4135
4136         if (!reg_is_valid_request(alpha2)) {
4137                 r = -EINVAL;
4138                 goto bad_reg;
4139         }
4140
4141         size_of_regd = sizeof(struct ieee80211_regdomain) +
4142                 (num_rules * sizeof(struct ieee80211_reg_rule));
4143
4144         rd = kzalloc(size_of_regd, GFP_KERNEL);
4145         if (!rd) {
4146                 r = -ENOMEM;
4147                 goto bad_reg;
4148         }
4149
4150         rd->n_reg_rules = num_rules;
4151         rd->alpha2[0] = alpha2[0];
4152         rd->alpha2[1] = alpha2[1];
4153
4154         /*
4155          * Disable DFS master mode if the DFS region was
4156          * not supported or known on this kernel.
4157          */
4158         if (reg_supported_dfs_region(dfs_region))
4159                 rd->dfs_region = dfs_region;
4160
4161         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
4162                         rem_reg_rules) {
4163                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
4164                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
4165                         reg_rule_policy);
4166                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
4167                 if (r)
4168                         goto bad_reg;
4169
4170                 rule_idx++;
4171
4172                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
4173                         r = -EINVAL;
4174                         goto bad_reg;
4175                 }
4176         }
4177
4178         BUG_ON(rule_idx != num_rules);
4179
4180         r = set_regdom(rd);
4181
4182         mutex_unlock(&cfg80211_mutex);
4183
4184         return r;
4185
4186  bad_reg:
4187         mutex_unlock(&cfg80211_mutex);
4188         kfree(rd);
4189         return r;
4190 }
4191
4192 static int validate_scan_freqs(struct nlattr *freqs)
4193 {
4194         struct nlattr *attr1, *attr2;
4195         int n_channels = 0, tmp1, tmp2;
4196
4197         nla_for_each_nested(attr1, freqs, tmp1) {
4198                 n_channels++;
4199                 /*
4200                  * Some hardware has a limited channel list for
4201                  * scanning, and it is pretty much nonsensical
4202                  * to scan for a channel twice, so disallow that
4203                  * and don't require drivers to check that the
4204                  * channel list they get isn't longer than what
4205                  * they can scan, as long as they can scan all
4206                  * the channels they registered at once.
4207                  */
4208                 nla_for_each_nested(attr2, freqs, tmp2)
4209                         if (attr1 != attr2 &&
4210                             nla_get_u32(attr1) == nla_get_u32(attr2))
4211                                 return 0;
4212         }
4213
4214         return n_channels;
4215 }
4216
4217 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
4218 {
4219         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4220         struct wireless_dev *wdev = info->user_ptr[1];
4221         struct cfg80211_scan_request *request;
4222         struct nlattr *attr;
4223         struct wiphy *wiphy;
4224         int err, tmp, n_ssids = 0, n_channels, i;
4225         size_t ie_len;
4226
4227         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4228                 return -EINVAL;
4229
4230         wiphy = &rdev->wiphy;
4231
4232         if (!rdev->ops->scan)
4233                 return -EOPNOTSUPP;
4234
4235         if (rdev->scan_req)
4236                 return -EBUSY;
4237
4238         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4239                 n_channels = validate_scan_freqs(
4240                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
4241                 if (!n_channels)
4242                         return -EINVAL;
4243         } else {
4244                 enum ieee80211_band band;
4245                 n_channels = 0;
4246
4247                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
4248                         if (wiphy->bands[band])
4249                                 n_channels += wiphy->bands[band]->n_channels;
4250         }
4251
4252         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
4253                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
4254                         n_ssids++;
4255
4256         if (n_ssids > wiphy->max_scan_ssids)
4257                 return -EINVAL;
4258
4259         if (info->attrs[NL80211_ATTR_IE])
4260                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4261         else
4262                 ie_len = 0;
4263
4264         if (ie_len > wiphy->max_scan_ie_len)
4265                 return -EINVAL;
4266
4267         request = kzalloc(sizeof(*request)
4268                         + sizeof(*request->ssids) * n_ssids
4269                         + sizeof(*request->channels) * n_channels
4270                         + ie_len, GFP_KERNEL);
4271         if (!request)
4272                 return -ENOMEM;
4273
4274         if (n_ssids)
4275                 request->ssids = (void *)&request->channels[n_channels];
4276         request->n_ssids = n_ssids;
4277         if (ie_len) {
4278                 if (request->ssids)
4279                         request->ie = (void *)(request->ssids + n_ssids);
4280                 else
4281                         request->ie = (void *)(request->channels + n_channels);
4282         }
4283
4284         i = 0;
4285         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4286                 /* user specified, bail out if channel not found */
4287                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
4288                         struct ieee80211_channel *chan;
4289
4290                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
4291
4292                         if (!chan) {
4293                                 err = -EINVAL;
4294                                 goto out_free;
4295                         }
4296
4297                         /* ignore disabled channels */
4298                         if (chan->flags & IEEE80211_CHAN_DISABLED)
4299                                 continue;
4300
4301                         request->channels[i] = chan;
4302                         i++;
4303                 }
4304         } else {
4305                 enum ieee80211_band band;
4306
4307                 /* all channels */
4308                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
4309                         int j;
4310                         if (!wiphy->bands[band])
4311                                 continue;
4312                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
4313                                 struct ieee80211_channel *chan;
4314
4315                                 chan = &wiphy->bands[band]->channels[j];
4316
4317                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
4318                                         continue;
4319
4320                                 request->channels[i] = chan;
4321                                 i++;
4322                         }
4323                 }
4324         }
4325
4326         if (!i) {
4327                 err = -EINVAL;
4328                 goto out_free;
4329         }
4330
4331         request->n_channels = i;
4332
4333         i = 0;
4334         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
4335                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
4336                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
4337                                 err = -EINVAL;
4338                                 goto out_free;
4339                         }
4340                         request->ssids[i].ssid_len = nla_len(attr);
4341                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
4342                         i++;
4343                 }
4344         }
4345
4346         if (info->attrs[NL80211_ATTR_IE]) {
4347                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4348                 memcpy((void *)request->ie,
4349                        nla_data(info->attrs[NL80211_ATTR_IE]),
4350                        request->ie_len);
4351         }
4352
4353         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
4354                 if (wiphy->bands[i])
4355                         request->rates[i] =
4356                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
4357
4358         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
4359                 nla_for_each_nested(attr,
4360                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
4361                                     tmp) {
4362                         enum ieee80211_band band = nla_type(attr);
4363
4364                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
4365                                 err = -EINVAL;
4366                                 goto out_free;
4367                         }
4368                         err = ieee80211_get_ratemask(wiphy->bands[band],
4369                                                      nla_data(attr),
4370                                                      nla_len(attr),
4371                                                      &request->rates[band]);
4372                         if (err)
4373                                 goto out_free;
4374                 }
4375         }
4376
4377         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
4378                 request->flags = nla_get_u32(
4379                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
4380                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
4381                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
4382                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
4383                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
4384                         err = -EOPNOTSUPP;
4385                         goto out_free;
4386                 }
4387         }
4388
4389         request->no_cck =
4390                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
4391
4392         request->wdev = wdev;
4393         request->wiphy = &rdev->wiphy;
4394         request->scan_start = jiffies;
4395
4396         rdev->scan_req = request;
4397         err = rdev->ops->scan(&rdev->wiphy, request);
4398
4399         if (!err) {
4400                 nl80211_send_scan_start(rdev, wdev);
4401                 if (wdev->netdev)
4402                         dev_hold(wdev->netdev);
4403         } else {
4404  out_free:
4405                 rdev->scan_req = NULL;
4406                 kfree(request);
4407         }
4408
4409         return err;
4410 }
4411
4412 static int nl80211_start_sched_scan(struct sk_buff *skb,
4413                                     struct genl_info *info)
4414 {
4415         struct cfg80211_sched_scan_request *request;
4416         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4417         struct net_device *dev = info->user_ptr[1];
4418         struct nlattr *attr;
4419         struct wiphy *wiphy;
4420         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
4421         u32 interval;
4422         enum ieee80211_band band;
4423         size_t ie_len;
4424         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
4425
4426         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
4427             !rdev->ops->sched_scan_start)
4428                 return -EOPNOTSUPP;
4429
4430         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4431                 return -EINVAL;
4432
4433         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
4434                 return -EINVAL;
4435
4436         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
4437         if (interval == 0)
4438                 return -EINVAL;
4439
4440         wiphy = &rdev->wiphy;
4441
4442         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4443                 n_channels = validate_scan_freqs(
4444                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
4445                 if (!n_channels)
4446                         return -EINVAL;
4447         } else {
4448                 n_channels = 0;
4449
4450                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
4451                         if (wiphy->bands[band])
4452                                 n_channels += wiphy->bands[band]->n_channels;
4453         }
4454
4455         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
4456                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
4457                                     tmp)
4458                         n_ssids++;
4459
4460         if (n_ssids > wiphy->max_sched_scan_ssids)
4461                 return -EINVAL;
4462
4463         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
4464                 nla_for_each_nested(attr,
4465                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
4466                                     tmp)
4467                         n_match_sets++;
4468
4469         if (n_match_sets > wiphy->max_match_sets)
4470                 return -EINVAL;
4471
4472         if (info->attrs[NL80211_ATTR_IE])
4473                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4474         else
4475                 ie_len = 0;
4476
4477         if (ie_len > wiphy->max_sched_scan_ie_len)
4478                 return -EINVAL;
4479
4480         mutex_lock(&rdev->sched_scan_mtx);
4481
4482         if (rdev->sched_scan_req) {
4483                 err = -EINPROGRESS;
4484                 goto out;
4485         }
4486
4487         request = kzalloc(sizeof(*request)
4488                         + sizeof(*request->ssids) * n_ssids
4489                         + sizeof(*request->match_sets) * n_match_sets
4490                         + sizeof(*request->channels) * n_channels
4491                         + ie_len, GFP_KERNEL);
4492         if (!request) {
4493                 err = -ENOMEM;
4494                 goto out;
4495         }
4496
4497         if (n_ssids)
4498                 request->ssids = (void *)&request->channels[n_channels];
4499         request->n_ssids = n_ssids;
4500         if (ie_len) {
4501                 if (request->ssids)
4502                         request->ie = (void *)(request->ssids + n_ssids);
4503                 else
4504                         request->ie = (void *)(request->channels + n_channels);
4505         }
4506
4507         if (n_match_sets) {
4508                 if (request->ie)
4509                         request->match_sets = (void *)(request->ie + ie_len);
4510                 else if (request->ssids)
4511                         request->match_sets =
4512                                 (void *)(request->ssids + n_ssids);
4513                 else
4514                         request->match_sets =
4515                                 (void *)(request->channels + n_channels);
4516         }
4517         request->n_match_sets = n_match_sets;
4518
4519         i = 0;
4520         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4521                 /* user specified, bail out if channel not found */
4522                 nla_for_each_nested(attr,
4523                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
4524                                     tmp) {
4525                         struct ieee80211_channel *chan;
4526
4527                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
4528
4529                         if (!chan) {
4530                                 err = -EINVAL;
4531                                 goto out_free;
4532                         }
4533
4534                         /* ignore disabled channels */
4535                         if (chan->flags & IEEE80211_CHAN_DISABLED)
4536                                 continue;
4537
4538                         request->channels[i] = chan;
4539                         i++;
4540                 }
4541         } else {
4542                 /* all channels */
4543                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
4544                         int j;
4545                         if (!wiphy->bands[band])
4546                                 continue;
4547                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
4548                                 struct ieee80211_channel *chan;
4549
4550                                 chan = &wiphy->bands[band]->channels[j];
4551
4552                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
4553                                         continue;
4554
4555                                 request->channels[i] = chan;
4556                                 i++;
4557                         }
4558                 }
4559         }
4560
4561         if (!i) {
4562                 err = -EINVAL;
4563                 goto out_free;
4564         }
4565
4566         request->n_channels = i;
4567
4568         i = 0;
4569         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
4570                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
4571                                     tmp) {
4572                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
4573                                 err = -EINVAL;
4574                                 goto out_free;
4575                         }
4576                         request->ssids[i].ssid_len = nla_len(attr);
4577                         memcpy(request->ssids[i].ssid, nla_data(attr),
4578                                nla_len(attr));
4579                         i++;
4580                 }
4581         }
4582
4583         i = 0;
4584         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
4585                 nla_for_each_nested(attr,
4586                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
4587                                     tmp) {
4588                         struct nlattr *ssid, *rssi;
4589
4590                         nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
4591                                   nla_data(attr), nla_len(attr),
4592                                   nl80211_match_policy);
4593                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
4594                         if (ssid) {
4595                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
4596                                         err = -EINVAL;
4597                                         goto out_free;
4598                                 }
4599                                 memcpy(request->match_sets[i].ssid.ssid,
4600                                        nla_data(ssid), nla_len(ssid));
4601                                 request->match_sets[i].ssid.ssid_len =
4602                                         nla_len(ssid);
4603                         }
4604                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
4605                         if (rssi)
4606                                 request->rssi_thold = nla_get_u32(rssi);
4607                         else
4608                                 request->rssi_thold =
4609                                                    NL80211_SCAN_RSSI_THOLD_OFF;
4610                         i++;
4611                 }
4612         }
4613
4614         if (info->attrs[NL80211_ATTR_IE]) {
4615                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4616                 memcpy((void *)request->ie,
4617                        nla_data(info->attrs[NL80211_ATTR_IE]),
4618                        request->ie_len);
4619         }
4620
4621         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
4622                 request->flags = nla_get_u32(
4623                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
4624                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
4625                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
4626                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
4627                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
4628                         err = -EOPNOTSUPP;
4629                         goto out_free;
4630                 }
4631         }
4632
4633         request->dev = dev;
4634         request->wiphy = &rdev->wiphy;
4635         request->interval = interval;
4636         request->scan_start = jiffies;
4637
4638         err = rdev->ops->sched_scan_start(&rdev->wiphy, dev, request);
4639         if (!err) {
4640                 rdev->sched_scan_req = request;
4641                 nl80211_send_sched_scan(rdev, dev,
4642                                         NL80211_CMD_START_SCHED_SCAN);
4643                 goto out;
4644         }
4645
4646 out_free:
4647         kfree(request);
4648 out:
4649         mutex_unlock(&rdev->sched_scan_mtx);
4650         return err;
4651 }
4652
4653 static int nl80211_stop_sched_scan(struct sk_buff *skb,
4654                                    struct genl_info *info)
4655 {
4656         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4657         int err;
4658
4659         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
4660             !rdev->ops->sched_scan_stop)
4661                 return -EOPNOTSUPP;
4662
4663         mutex_lock(&rdev->sched_scan_mtx);
4664         err = __cfg80211_stop_sched_scan(rdev, false);
4665         mutex_unlock(&rdev->sched_scan_mtx);
4666
4667         return err;
4668 }
4669
4670 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
4671                             u32 seq, int flags,
4672                             struct cfg80211_registered_device *rdev,
4673                             struct wireless_dev *wdev,
4674                             struct cfg80211_internal_bss *intbss)
4675 {
4676         struct cfg80211_bss *res = &intbss->pub;
4677         void *hdr;
4678         struct nlattr *bss;
4679
4680         ASSERT_WDEV_LOCK(wdev);
4681
4682         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
4683                              NL80211_CMD_NEW_SCAN_RESULTS);
4684         if (!hdr)
4685                 return -1;
4686
4687         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
4688
4689         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation) ||
4690             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
4691                 goto nla_put_failure;
4692
4693         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
4694         if (!bss)
4695                 goto nla_put_failure;
4696         if ((!is_zero_ether_addr(res->bssid) &&
4697              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)) ||
4698             (res->information_elements && res->len_information_elements &&
4699              nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
4700                      res->len_information_elements,
4701                      res->information_elements)) ||
4702             (res->beacon_ies && res->len_beacon_ies &&
4703              res->beacon_ies != res->information_elements &&
4704              nla_put(msg, NL80211_BSS_BEACON_IES,
4705                      res->len_beacon_ies, res->beacon_ies)))
4706                 goto nla_put_failure;
4707         if (res->tsf &&
4708             nla_put_u64(msg, NL80211_BSS_TSF, res->tsf))
4709                 goto nla_put_failure;
4710         if (res->beacon_interval &&
4711             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
4712                 goto nla_put_failure;
4713         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
4714             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
4715             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
4716                         jiffies_to_msecs(jiffies - intbss->ts)))
4717                 goto nla_put_failure;
4718
4719         switch (rdev->wiphy.signal_type) {
4720         case CFG80211_SIGNAL_TYPE_MBM:
4721                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
4722                         goto nla_put_failure;
4723                 break;
4724         case CFG80211_SIGNAL_TYPE_UNSPEC:
4725                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
4726                         goto nla_put_failure;
4727                 break;
4728         default:
4729                 break;
4730         }
4731
4732         switch (wdev->iftype) {
4733         case NL80211_IFTYPE_P2P_CLIENT:
4734         case NL80211_IFTYPE_STATION:
4735                 if (intbss == wdev->current_bss &&
4736                     nla_put_u32(msg, NL80211_BSS_STATUS,
4737                                 NL80211_BSS_STATUS_ASSOCIATED))
4738                         goto nla_put_failure;
4739                 break;
4740         case NL80211_IFTYPE_ADHOC:
4741                 if (intbss == wdev->current_bss &&
4742                     nla_put_u32(msg, NL80211_BSS_STATUS,
4743                                 NL80211_BSS_STATUS_IBSS_JOINED))
4744                         goto nla_put_failure;
4745                 break;
4746         default:
4747                 break;
4748         }
4749
4750         nla_nest_end(msg, bss);
4751
4752         return genlmsg_end(msg, hdr);
4753
4754  nla_put_failure:
4755         genlmsg_cancel(msg, hdr);
4756         return -EMSGSIZE;
4757 }
4758
4759 static int nl80211_dump_scan(struct sk_buff *skb,
4760                              struct netlink_callback *cb)
4761 {
4762         struct cfg80211_registered_device *rdev;
4763         struct net_device *dev;
4764         struct cfg80211_internal_bss *scan;
4765         struct wireless_dev *wdev;
4766         int start = cb->args[1], idx = 0;
4767         int err;
4768
4769         err = nl80211_prepare_netdev_dump(skb, cb, &rdev, &dev);
4770         if (err)
4771                 return err;
4772
4773         wdev = dev->ieee80211_ptr;
4774
4775         wdev_lock(wdev);
4776         spin_lock_bh(&rdev->bss_lock);
4777         cfg80211_bss_expire(rdev);
4778
4779         cb->seq = rdev->bss_generation;
4780
4781         list_for_each_entry(scan, &rdev->bss_list, list) {
4782                 if (++idx <= start)
4783                         continue;
4784                 if (nl80211_send_bss(skb, cb,
4785                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4786                                 rdev, wdev, scan) < 0) {
4787                         idx--;
4788                         break;
4789                 }
4790         }
4791
4792         spin_unlock_bh(&rdev->bss_lock);
4793         wdev_unlock(wdev);
4794
4795         cb->args[1] = idx;
4796         nl80211_finish_netdev_dump(rdev);
4797
4798         return skb->len;
4799 }
4800
4801 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
4802                                 int flags, struct net_device *dev,
4803                                 struct survey_info *survey)
4804 {
4805         void *hdr;
4806         struct nlattr *infoattr;
4807
4808         hdr = nl80211hdr_put(msg, portid, seq, flags,
4809                              NL80211_CMD_NEW_SURVEY_RESULTS);
4810         if (!hdr)
4811                 return -ENOMEM;
4812
4813         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
4814                 goto nla_put_failure;
4815
4816         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
4817         if (!infoattr)
4818                 goto nla_put_failure;
4819
4820         if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
4821                         survey->channel->center_freq))
4822                 goto nla_put_failure;
4823
4824         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
4825             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
4826                 goto nla_put_failure;
4827         if ((survey->filled & SURVEY_INFO_IN_USE) &&
4828             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
4829                 goto nla_put_failure;
4830         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
4831             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
4832                         survey->channel_time))
4833                 goto nla_put_failure;
4834         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
4835             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
4836                         survey->channel_time_busy))
4837                 goto nla_put_failure;
4838         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
4839             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
4840                         survey->channel_time_ext_busy))
4841                 goto nla_put_failure;
4842         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
4843             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
4844                         survey->channel_time_rx))
4845                 goto nla_put_failure;
4846         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
4847             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
4848                         survey->channel_time_tx))
4849                 goto nla_put_failure;
4850
4851         nla_nest_end(msg, infoattr);
4852
4853         return genlmsg_end(msg, hdr);
4854
4855  nla_put_failure:
4856         genlmsg_cancel(msg, hdr);
4857         return -EMSGSIZE;
4858 }
4859
4860 static int nl80211_dump_survey(struct sk_buff *skb,
4861                         struct netlink_callback *cb)
4862 {
4863         struct survey_info survey;
4864         struct cfg80211_registered_device *dev;
4865         struct net_device *netdev;
4866         int survey_idx = cb->args[1];
4867         int res;
4868
4869         res = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
4870         if (res)
4871                 return res;
4872
4873         if (!dev->ops->dump_survey) {
4874                 res = -EOPNOTSUPP;
4875                 goto out_err;
4876         }
4877
4878         while (1) {
4879                 struct ieee80211_channel *chan;
4880
4881                 res = dev->ops->dump_survey(&dev->wiphy, netdev, survey_idx,
4882                                             &survey);
4883                 if (res == -ENOENT)
4884                         break;
4885                 if (res)
4886                         goto out_err;
4887
4888                 /* Survey without a channel doesn't make sense */
4889                 if (!survey.channel) {
4890                         res = -EINVAL;
4891                         goto out;
4892                 }
4893
4894                 chan = ieee80211_get_channel(&dev->wiphy,
4895                                              survey.channel->center_freq);
4896                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
4897                         survey_idx++;
4898                         continue;
4899                 }
4900
4901                 if (nl80211_send_survey(skb,
4902                                 NETLINK_CB(cb->skb).portid,
4903                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4904                                 netdev,
4905                                 &survey) < 0)
4906                         goto out;
4907                 survey_idx++;
4908         }
4909
4910  out:
4911         cb->args[1] = survey_idx;
4912         res = skb->len;
4913  out_err:
4914         nl80211_finish_netdev_dump(dev);
4915         return res;
4916 }
4917
4918 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
4919 {
4920         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
4921                                   NL80211_WPA_VERSION_2));
4922 }
4923
4924 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
4925 {
4926         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4927         struct net_device *dev = info->user_ptr[1];
4928         struct ieee80211_channel *chan;
4929         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
4930         int err, ssid_len, ie_len = 0, sae_data_len = 0;
4931         enum nl80211_auth_type auth_type;
4932         struct key_parse key;
4933         bool local_state_change;
4934
4935         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4936                 return -EINVAL;
4937
4938         if (!info->attrs[NL80211_ATTR_MAC])
4939                 return -EINVAL;
4940
4941         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
4942                 return -EINVAL;
4943
4944         if (!info->attrs[NL80211_ATTR_SSID])
4945                 return -EINVAL;
4946
4947         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
4948                 return -EINVAL;
4949
4950         err = nl80211_parse_key(info, &key);
4951         if (err)
4952                 return err;
4953
4954         if (key.idx >= 0) {
4955                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
4956                         return -EINVAL;
4957                 if (!key.p.key || !key.p.key_len)
4958                         return -EINVAL;
4959                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
4960                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
4961                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
4962                      key.p.key_len != WLAN_KEY_LEN_WEP104))
4963                         return -EINVAL;
4964                 if (key.idx > 4)
4965                         return -EINVAL;
4966         } else {
4967                 key.p.key_len = 0;
4968                 key.p.key = NULL;
4969         }
4970
4971         if (key.idx >= 0) {
4972                 int i;
4973                 bool ok = false;
4974                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
4975                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
4976                                 ok = true;
4977                                 break;
4978                         }
4979                 }
4980                 if (!ok)
4981                         return -EINVAL;
4982         }
4983
4984         if (!rdev->ops->auth)
4985                 return -EOPNOTSUPP;
4986
4987         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4988             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4989                 return -EOPNOTSUPP;
4990
4991         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4992         chan = ieee80211_get_channel(&rdev->wiphy,
4993                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4994         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
4995                 return -EINVAL;
4996
4997         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4998         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4999
5000         if (info->attrs[NL80211_ATTR_IE]) {
5001                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5002                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5003         }
5004
5005         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
5006         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
5007                 return -EINVAL;
5008
5009         if (auth_type == NL80211_AUTHTYPE_SAE &&
5010             !info->attrs[NL80211_ATTR_SAE_DATA])
5011                 return -EINVAL;
5012
5013         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
5014                 if (auth_type != NL80211_AUTHTYPE_SAE)
5015                         return -EINVAL;
5016                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
5017                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
5018                 /* need to include at least Auth Transaction and Status Code */
5019                 if (sae_data_len < 4)
5020                         return -EINVAL;
5021         }
5022
5023         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5024
5025         /*
5026          * Since we no longer track auth state, ignore
5027          * requests to only change local state.
5028          */
5029         if (local_state_change)
5030                 return 0;
5031
5032         return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
5033                                   ssid, ssid_len, ie, ie_len,
5034                                   key.p.key, key.p.key_len, key.idx,
5035                                   sae_data, sae_data_len);
5036 }
5037
5038 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
5039                                    struct genl_info *info,
5040                                    struct cfg80211_crypto_settings *settings,
5041                                    int cipher_limit)
5042 {
5043         memset(settings, 0, sizeof(*settings));
5044
5045         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
5046
5047         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
5048                 u16 proto;
5049                 proto = nla_get_u16(
5050                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
5051                 settings->control_port_ethertype = cpu_to_be16(proto);
5052                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
5053                     proto != ETH_P_PAE)
5054                         return -EINVAL;
5055                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
5056                         settings->control_port_no_encrypt = true;
5057         } else
5058                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
5059
5060         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
5061                 void *data;
5062                 int len, i;
5063
5064                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5065                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5066                 settings->n_ciphers_pairwise = len / sizeof(u32);
5067
5068                 if (len % sizeof(u32))
5069                         return -EINVAL;
5070
5071                 if (settings->n_ciphers_pairwise > cipher_limit)
5072                         return -EINVAL;
5073
5074                 memcpy(settings->ciphers_pairwise, data, len);
5075
5076                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
5077                         if (!cfg80211_supported_cipher_suite(
5078                                         &rdev->wiphy,
5079                                         settings->ciphers_pairwise[i]))
5080                                 return -EINVAL;
5081         }
5082
5083         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
5084                 settings->cipher_group =
5085                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
5086                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
5087                                                      settings->cipher_group))
5088                         return -EINVAL;
5089         }
5090
5091         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
5092                 settings->wpa_versions =
5093                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
5094                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
5095                         return -EINVAL;
5096         }
5097
5098         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
5099                 void *data;
5100                 int len;
5101
5102                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
5103                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
5104                 settings->n_akm_suites = len / sizeof(u32);
5105
5106                 if (len % sizeof(u32))
5107                         return -EINVAL;
5108
5109                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
5110                         return -EINVAL;
5111
5112                 memcpy(settings->akm_suites, data, len);
5113         }
5114
5115         return 0;
5116 }
5117
5118 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
5119 {
5120         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5121         struct net_device *dev = info->user_ptr[1];
5122         struct cfg80211_crypto_settings crypto;
5123         struct ieee80211_channel *chan;
5124         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
5125         int err, ssid_len, ie_len = 0;
5126         bool use_mfp = false;
5127         u32 flags = 0;
5128         struct ieee80211_ht_cap *ht_capa = NULL;
5129         struct ieee80211_ht_cap *ht_capa_mask = NULL;
5130
5131         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5132                 return -EINVAL;
5133
5134         if (!info->attrs[NL80211_ATTR_MAC] ||
5135             !info->attrs[NL80211_ATTR_SSID] ||
5136             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
5137                 return -EINVAL;
5138
5139         if (!rdev->ops->assoc)
5140                 return -EOPNOTSUPP;
5141
5142         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5143             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5144                 return -EOPNOTSUPP;
5145
5146         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5147
5148         chan = ieee80211_get_channel(&rdev->wiphy,
5149                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5150         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
5151                 return -EINVAL;
5152
5153         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5154         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5155
5156         if (info->attrs[NL80211_ATTR_IE]) {
5157                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5158                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5159         }
5160
5161         if (info->attrs[NL80211_ATTR_USE_MFP]) {
5162                 enum nl80211_mfp mfp =
5163                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
5164                 if (mfp == NL80211_MFP_REQUIRED)
5165                         use_mfp = true;
5166                 else if (mfp != NL80211_MFP_NO)
5167                         return -EINVAL;
5168         }
5169
5170         if (info->attrs[NL80211_ATTR_PREV_BSSID])
5171                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
5172
5173         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
5174                 flags |= ASSOC_REQ_DISABLE_HT;
5175
5176         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
5177                 ht_capa_mask =
5178                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]);
5179
5180         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
5181                 if (!ht_capa_mask)
5182                         return -EINVAL;
5183                 ht_capa = nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5184         }
5185
5186         err = nl80211_crypto_settings(rdev, info, &crypto, 1);
5187         if (!err)
5188                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
5189                                           ssid, ssid_len, ie, ie_len, use_mfp,
5190                                           &crypto, flags, ht_capa,
5191                                           ht_capa_mask);
5192
5193         return err;
5194 }
5195
5196 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
5197 {
5198         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5199         struct net_device *dev = info->user_ptr[1];
5200         const u8 *ie = NULL, *bssid;
5201         int ie_len = 0;
5202         u16 reason_code;
5203         bool local_state_change;
5204
5205         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5206                 return -EINVAL;
5207
5208         if (!info->attrs[NL80211_ATTR_MAC])
5209                 return -EINVAL;
5210
5211         if (!info->attrs[NL80211_ATTR_REASON_CODE])
5212                 return -EINVAL;
5213
5214         if (!rdev->ops->deauth)
5215                 return -EOPNOTSUPP;
5216
5217         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5218             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5219                 return -EOPNOTSUPP;
5220
5221         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5222
5223         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5224         if (reason_code == 0) {
5225                 /* Reason Code 0 is reserved */
5226                 return -EINVAL;
5227         }
5228
5229         if (info->attrs[NL80211_ATTR_IE]) {
5230                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5231                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5232         }
5233
5234         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5235
5236         return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
5237                                     local_state_change);
5238 }
5239
5240 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
5241 {
5242         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5243         struct net_device *dev = info->user_ptr[1];
5244         const u8 *ie = NULL, *bssid;
5245         int ie_len = 0;
5246         u16 reason_code;
5247         bool local_state_change;
5248
5249         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5250                 return -EINVAL;
5251
5252         if (!info->attrs[NL80211_ATTR_MAC])
5253                 return -EINVAL;
5254
5255         if (!info->attrs[NL80211_ATTR_REASON_CODE])
5256                 return -EINVAL;
5257
5258         if (!rdev->ops->disassoc)
5259                 return -EOPNOTSUPP;
5260
5261         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5262             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5263                 return -EOPNOTSUPP;
5264
5265         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5266
5267         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5268         if (reason_code == 0) {
5269                 /* Reason Code 0 is reserved */
5270                 return -EINVAL;
5271         }
5272
5273         if (info->attrs[NL80211_ATTR_IE]) {
5274                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5275                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5276         }
5277
5278         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5279
5280         return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
5281                                       local_state_change);
5282 }
5283
5284 static bool
5285 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
5286                          int mcast_rate[IEEE80211_NUM_BANDS],
5287                          int rateval)
5288 {
5289         struct wiphy *wiphy = &rdev->wiphy;
5290         bool found = false;
5291         int band, i;
5292
5293         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5294                 struct ieee80211_supported_band *sband;
5295
5296                 sband = wiphy->bands[band];
5297                 if (!sband)
5298                         continue;
5299
5300                 for (i = 0; i < sband->n_bitrates; i++) {
5301                         if (sband->bitrates[i].bitrate == rateval) {
5302                                 mcast_rate[band] = i + 1;
5303                                 found = true;
5304                                 break;
5305                         }
5306                 }
5307         }
5308
5309         return found;
5310 }
5311
5312 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
5313 {
5314         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5315         struct net_device *dev = info->user_ptr[1];
5316         struct cfg80211_ibss_params ibss;
5317         struct wiphy *wiphy;
5318         struct cfg80211_cached_keys *connkeys = NULL;
5319         int err;
5320
5321         memset(&ibss, 0, sizeof(ibss));
5322
5323         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5324                 return -EINVAL;
5325
5326         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
5327             !info->attrs[NL80211_ATTR_SSID] ||
5328             !nla_len(info->attrs[NL80211_ATTR_SSID]))
5329                 return -EINVAL;
5330
5331         ibss.beacon_interval = 100;
5332
5333         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
5334                 ibss.beacon_interval =
5335                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
5336                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
5337                         return -EINVAL;
5338         }
5339
5340         if (!rdev->ops->join_ibss)
5341                 return -EOPNOTSUPP;
5342
5343         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
5344                 return -EOPNOTSUPP;
5345
5346         wiphy = &rdev->wiphy;
5347
5348         if (info->attrs[NL80211_ATTR_MAC]) {
5349                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5350
5351                 if (!is_valid_ether_addr(ibss.bssid))
5352                         return -EINVAL;
5353         }
5354         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5355         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5356
5357         if (info->attrs[NL80211_ATTR_IE]) {
5358                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5359                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5360         }
5361
5362         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
5363                 enum nl80211_channel_type channel_type;
5364
5365                 if (!nl80211_valid_channel_type(info, &channel_type))
5366                         return -EINVAL;
5367
5368                 if (channel_type != NL80211_CHAN_NO_HT &&
5369                     !(wiphy->features & NL80211_FEATURE_HT_IBSS))
5370                         return -EINVAL;
5371
5372                 ibss.channel_type = channel_type;
5373         } else {
5374                 ibss.channel_type = NL80211_CHAN_NO_HT;
5375         }
5376
5377         ibss.channel = rdev_freq_to_chan(rdev,
5378                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]),
5379                 ibss.channel_type);
5380         if (!ibss.channel ||
5381             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
5382             ibss.channel->flags & IEEE80211_CHAN_DISABLED)
5383                 return -EINVAL;
5384
5385         /* Both channels should be able to initiate communication */
5386         if ((ibss.channel_type == NL80211_CHAN_HT40PLUS ||
5387              ibss.channel_type == NL80211_CHAN_HT40MINUS) &&
5388             !cfg80211_can_beacon_sec_chan(&rdev->wiphy, ibss.channel,
5389                                           ibss.channel_type))
5390                 return -EINVAL;
5391
5392         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
5393         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
5394
5395         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
5396                 u8 *rates =
5397                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5398                 int n_rates =
5399                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5400                 struct ieee80211_supported_band *sband =
5401                         wiphy->bands[ibss.channel->band];
5402
5403                 err = ieee80211_get_ratemask(sband, rates, n_rates,
5404                                              &ibss.basic_rates);
5405                 if (err)
5406                         return err;
5407         }
5408
5409         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
5410             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
5411                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
5412                 return -EINVAL;
5413
5414         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
5415                 bool no_ht = false;
5416
5417                 connkeys = nl80211_parse_connkeys(rdev,
5418                                           info->attrs[NL80211_ATTR_KEYS],
5419                                           &no_ht);
5420                 if (IS_ERR(connkeys))
5421                         return PTR_ERR(connkeys);
5422
5423                 if ((ibss.channel_type != NL80211_CHAN_NO_HT) && no_ht) {
5424                         kfree(connkeys);
5425                         return -EINVAL;
5426                 }
5427         }
5428
5429         ibss.control_port =
5430                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
5431
5432         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
5433         if (err)
5434                 kfree(connkeys);
5435         return err;
5436 }
5437
5438 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
5439 {
5440         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5441         struct net_device *dev = info->user_ptr[1];
5442
5443         if (!rdev->ops->leave_ibss)
5444                 return -EOPNOTSUPP;
5445
5446         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
5447                 return -EOPNOTSUPP;
5448
5449         return cfg80211_leave_ibss(rdev, dev, false);
5450 }
5451
5452 #ifdef CONFIG_NL80211_TESTMODE
5453 static struct genl_multicast_group nl80211_testmode_mcgrp = {
5454         .name = "testmode",
5455 };
5456
5457 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
5458 {
5459         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5460         int err;
5461
5462         if (!info->attrs[NL80211_ATTR_TESTDATA])
5463                 return -EINVAL;
5464
5465         err = -EOPNOTSUPP;
5466         if (rdev->ops->testmode_cmd) {
5467                 rdev->testmode_info = info;
5468                 err = rdev->ops->testmode_cmd(&rdev->wiphy,
5469                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
5470                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
5471                 rdev->testmode_info = NULL;
5472         }
5473
5474         return err;
5475 }
5476
5477 static int nl80211_testmode_dump(struct sk_buff *skb,
5478                                  struct netlink_callback *cb)
5479 {
5480         struct cfg80211_registered_device *rdev;
5481         int err;
5482         long phy_idx;
5483         void *data = NULL;
5484         int data_len = 0;
5485
5486         if (cb->args[0]) {
5487                 /*
5488                  * 0 is a valid index, but not valid for args[0],
5489                  * so we need to offset by 1.
5490                  */
5491                 phy_idx = cb->args[0] - 1;
5492         } else {
5493                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
5494                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
5495                                   nl80211_policy);
5496                 if (err)
5497                         return err;
5498
5499                 mutex_lock(&cfg80211_mutex);
5500                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
5501                                                   nl80211_fam.attrbuf);
5502                 if (IS_ERR(rdev)) {
5503                         mutex_unlock(&cfg80211_mutex);
5504                         return PTR_ERR(rdev);
5505                 }
5506                 phy_idx = rdev->wiphy_idx;
5507                 rdev = NULL;
5508                 mutex_unlock(&cfg80211_mutex);
5509
5510                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
5511                         cb->args[1] =
5512                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
5513         }
5514
5515         if (cb->args[1]) {
5516                 data = nla_data((void *)cb->args[1]);
5517                 data_len = nla_len((void *)cb->args[1]);
5518         }
5519
5520         mutex_lock(&cfg80211_mutex);
5521         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
5522         if (!rdev) {
5523                 mutex_unlock(&cfg80211_mutex);
5524                 return -ENOENT;
5525         }
5526         cfg80211_lock_rdev(rdev);
5527         mutex_unlock(&cfg80211_mutex);
5528
5529         if (!rdev->ops->testmode_dump) {
5530                 err = -EOPNOTSUPP;
5531                 goto out_err;
5532         }
5533
5534         while (1) {
5535                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
5536                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
5537                                            NL80211_CMD_TESTMODE);
5538                 struct nlattr *tmdata;
5539
5540                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
5541                         genlmsg_cancel(skb, hdr);
5542                         break;
5543                 }
5544
5545                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
5546                 if (!tmdata) {
5547                         genlmsg_cancel(skb, hdr);
5548                         break;
5549                 }
5550                 err = rdev->ops->testmode_dump(&rdev->wiphy, skb, cb,
5551                                                data, data_len);
5552                 nla_nest_end(skb, tmdata);
5553
5554                 if (err == -ENOBUFS || err == -ENOENT) {
5555                         genlmsg_cancel(skb, hdr);
5556                         break;
5557                 } else if (err) {
5558                         genlmsg_cancel(skb, hdr);
5559                         goto out_err;
5560                 }
5561
5562                 genlmsg_end(skb, hdr);
5563         }
5564
5565         err = skb->len;
5566         /* see above */
5567         cb->args[0] = phy_idx + 1;
5568  out_err:
5569         cfg80211_unlock_rdev(rdev);
5570         return err;
5571 }
5572
5573 static struct sk_buff *
5574 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
5575                               int approxlen, u32 portid, u32 seq, gfp_t gfp)
5576 {
5577         struct sk_buff *skb;
5578         void *hdr;
5579         struct nlattr *data;
5580
5581         skb = nlmsg_new(approxlen + 100, gfp);
5582         if (!skb)
5583                 return NULL;
5584
5585         hdr = nl80211hdr_put(skb, portid, seq, 0, NL80211_CMD_TESTMODE);
5586         if (!hdr) {
5587                 kfree_skb(skb);
5588                 return NULL;
5589         }
5590
5591         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
5592                 goto nla_put_failure;
5593         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
5594
5595         ((void **)skb->cb)[0] = rdev;
5596         ((void **)skb->cb)[1] = hdr;
5597         ((void **)skb->cb)[2] = data;
5598
5599         return skb;
5600
5601  nla_put_failure:
5602         kfree_skb(skb);
5603         return NULL;
5604 }
5605
5606 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
5607                                                   int approxlen)
5608 {
5609         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
5610
5611         if (WARN_ON(!rdev->testmode_info))
5612                 return NULL;
5613
5614         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
5615                                 rdev->testmode_info->snd_portid,
5616                                 rdev->testmode_info->snd_seq,
5617                                 GFP_KERNEL);
5618 }
5619 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
5620
5621 int cfg80211_testmode_reply(struct sk_buff *skb)
5622 {
5623         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
5624         void *hdr = ((void **)skb->cb)[1];
5625         struct nlattr *data = ((void **)skb->cb)[2];
5626
5627         if (WARN_ON(!rdev->testmode_info)) {
5628                 kfree_skb(skb);
5629                 return -EINVAL;
5630         }
5631
5632         nla_nest_end(skb, data);
5633         genlmsg_end(skb, hdr);
5634         return genlmsg_reply(skb, rdev->testmode_info);
5635 }
5636 EXPORT_SYMBOL(cfg80211_testmode_reply);
5637
5638 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
5639                                                   int approxlen, gfp_t gfp)
5640 {
5641         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
5642
5643         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
5644 }
5645 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
5646
5647 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
5648 {
5649         void *hdr = ((void **)skb->cb)[1];
5650         struct nlattr *data = ((void **)skb->cb)[2];
5651
5652         nla_nest_end(skb, data);
5653         genlmsg_end(skb, hdr);
5654         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
5655 }
5656 EXPORT_SYMBOL(cfg80211_testmode_event);
5657 #endif
5658
5659 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
5660 {
5661         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5662         struct net_device *dev = info->user_ptr[1];
5663         struct cfg80211_connect_params connect;
5664         struct wiphy *wiphy;
5665         struct cfg80211_cached_keys *connkeys = NULL;
5666         int err;
5667
5668         memset(&connect, 0, sizeof(connect));
5669
5670         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5671                 return -EINVAL;
5672
5673         if (!info->attrs[NL80211_ATTR_SSID] ||
5674             !nla_len(info->attrs[NL80211_ATTR_SSID]))
5675                 return -EINVAL;
5676
5677         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
5678                 connect.auth_type =
5679                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
5680                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
5681                                              NL80211_CMD_CONNECT))
5682                         return -EINVAL;
5683         } else
5684                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
5685
5686         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
5687
5688         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
5689                                       NL80211_MAX_NR_CIPHER_SUITES);
5690         if (err)
5691                 return err;
5692
5693         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5694             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5695                 return -EOPNOTSUPP;
5696
5697         wiphy = &rdev->wiphy;
5698
5699         connect.bg_scan_period = -1;
5700         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
5701                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
5702                 connect.bg_scan_period =
5703                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
5704         }
5705
5706         if (info->attrs[NL80211_ATTR_MAC])
5707                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5708         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5709         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5710
5711         if (info->attrs[NL80211_ATTR_IE]) {
5712                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5713                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5714         }
5715
5716         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
5717                 connect.channel =
5718                         ieee80211_get_channel(wiphy,
5719                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5720                 if (!connect.channel ||
5721                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
5722                         return -EINVAL;
5723         }
5724
5725         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
5726                 connkeys = nl80211_parse_connkeys(rdev,
5727                                           info->attrs[NL80211_ATTR_KEYS], NULL);
5728                 if (IS_ERR(connkeys))
5729                         return PTR_ERR(connkeys);
5730         }
5731
5732         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
5733                 connect.flags |= ASSOC_REQ_DISABLE_HT;
5734
5735         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
5736                 memcpy(&connect.ht_capa_mask,
5737                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
5738                        sizeof(connect.ht_capa_mask));
5739
5740         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
5741                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
5742                         kfree(connkeys);
5743                         return -EINVAL;
5744                 }
5745                 memcpy(&connect.ht_capa,
5746                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
5747                        sizeof(connect.ht_capa));
5748         }
5749
5750         err = cfg80211_connect(rdev, dev, &connect, connkeys);
5751         if (err)
5752                 kfree(connkeys);
5753         return err;
5754 }
5755
5756 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
5757 {
5758         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5759         struct net_device *dev = info->user_ptr[1];
5760         u16 reason;
5761
5762         if (!info->attrs[NL80211_ATTR_REASON_CODE])
5763                 reason = WLAN_REASON_DEAUTH_LEAVING;
5764         else
5765                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5766
5767         if (reason == 0)
5768                 return -EINVAL;
5769
5770         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5771             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5772                 return -EOPNOTSUPP;
5773
5774         return cfg80211_disconnect(rdev, dev, reason, true);
5775 }
5776
5777 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
5778 {
5779         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5780         struct net *net;
5781         int err;
5782         u32 pid;
5783
5784         if (!info->attrs[NL80211_ATTR_PID])
5785                 return -EINVAL;
5786
5787         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
5788
5789         net = get_net_ns_by_pid(pid);
5790         if (IS_ERR(net))
5791                 return PTR_ERR(net);
5792
5793         err = 0;
5794
5795         /* check if anything to do */
5796         if (!net_eq(wiphy_net(&rdev->wiphy), net))
5797                 err = cfg80211_switch_netns(rdev, net);
5798
5799         put_net(net);
5800         return err;
5801 }
5802
5803 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
5804 {
5805         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5806         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
5807                         struct cfg80211_pmksa *pmksa) = NULL;
5808         struct net_device *dev = info->user_ptr[1];
5809         struct cfg80211_pmksa pmksa;
5810
5811         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
5812
5813         if (!info->attrs[NL80211_ATTR_MAC])
5814                 return -EINVAL;
5815
5816         if (!info->attrs[NL80211_ATTR_PMKID])
5817                 return -EINVAL;
5818
5819         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
5820         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5821
5822         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5823             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5824                 return -EOPNOTSUPP;
5825
5826         switch (info->genlhdr->cmd) {
5827         case NL80211_CMD_SET_PMKSA:
5828                 rdev_ops = rdev->ops->set_pmksa;
5829                 break;
5830         case NL80211_CMD_DEL_PMKSA:
5831                 rdev_ops = rdev->ops->del_pmksa;
5832                 break;
5833         default:
5834                 WARN_ON(1);
5835                 break;
5836         }
5837
5838         if (!rdev_ops)
5839                 return -EOPNOTSUPP;
5840
5841         return rdev_ops(&rdev->wiphy, dev, &pmksa);
5842 }
5843
5844 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
5845 {
5846         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5847         struct net_device *dev = info->user_ptr[1];
5848
5849         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5850             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5851                 return -EOPNOTSUPP;
5852
5853         if (!rdev->ops->flush_pmksa)
5854                 return -EOPNOTSUPP;
5855
5856         return rdev->ops->flush_pmksa(&rdev->wiphy, dev);
5857 }
5858
5859 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
5860 {
5861         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5862         struct net_device *dev = info->user_ptr[1];
5863         u8 action_code, dialog_token;
5864         u16 status_code;
5865         u8 *peer;
5866
5867         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
5868             !rdev->ops->tdls_mgmt)
5869                 return -EOPNOTSUPP;
5870
5871         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
5872             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
5873             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
5874             !info->attrs[NL80211_ATTR_IE] ||
5875             !info->attrs[NL80211_ATTR_MAC])
5876                 return -EINVAL;
5877
5878         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
5879         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
5880         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
5881         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
5882
5883         return rdev->ops->tdls_mgmt(&rdev->wiphy, dev, peer, action_code,
5884                                     dialog_token, status_code,
5885                                     nla_data(info->attrs[NL80211_ATTR_IE]),
5886                                     nla_len(info->attrs[NL80211_ATTR_IE]));
5887 }
5888
5889 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
5890 {
5891         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5892         struct net_device *dev = info->user_ptr[1];
5893         enum nl80211_tdls_operation operation;
5894         u8 *peer;
5895
5896         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
5897             !rdev->ops->tdls_oper)
5898                 return -EOPNOTSUPP;
5899
5900         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
5901             !info->attrs[NL80211_ATTR_MAC])
5902                 return -EINVAL;
5903
5904         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
5905         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
5906
5907         return rdev->ops->tdls_oper(&rdev->wiphy, dev, peer, operation);
5908 }
5909
5910 static int nl80211_remain_on_channel(struct sk_buff *skb,
5911                                      struct genl_info *info)
5912 {
5913         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5914         struct wireless_dev *wdev = info->user_ptr[1];
5915         struct ieee80211_channel *chan;
5916         struct sk_buff *msg;
5917         void *hdr;
5918         u64 cookie;
5919         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
5920         u32 freq, duration;
5921         int err;
5922
5923         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
5924             !info->attrs[NL80211_ATTR_DURATION])
5925                 return -EINVAL;
5926
5927         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
5928
5929         if (!rdev->ops->remain_on_channel ||
5930             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
5931                 return -EOPNOTSUPP;
5932
5933         /*
5934          * We should be on that channel for at least a minimum amount of
5935          * time (10ms) but no longer than the driver supports.
5936          */
5937         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
5938             duration > rdev->wiphy.max_remain_on_channel_duration)
5939                 return -EINVAL;
5940
5941         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
5942             !nl80211_valid_channel_type(info, &channel_type))
5943                 return -EINVAL;
5944
5945         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
5946         chan = rdev_freq_to_chan(rdev, freq, channel_type);
5947         if (chan == NULL)
5948                 return -EINVAL;
5949
5950         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5951         if (!msg)
5952                 return -ENOMEM;
5953
5954         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5955                              NL80211_CMD_REMAIN_ON_CHANNEL);
5956
5957         if (IS_ERR(hdr)) {
5958                 err = PTR_ERR(hdr);
5959                 goto free_msg;
5960         }
5961
5962         err = rdev->ops->remain_on_channel(&rdev->wiphy, wdev, chan,
5963                                            channel_type, duration, &cookie);
5964
5965         if (err)
5966                 goto free_msg;
5967
5968         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
5969                 goto nla_put_failure;
5970
5971         genlmsg_end(msg, hdr);
5972
5973         return genlmsg_reply(msg, info);
5974
5975  nla_put_failure:
5976         err = -ENOBUFS;
5977  free_msg:
5978         nlmsg_free(msg);
5979         return err;
5980 }
5981
5982 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
5983                                             struct genl_info *info)
5984 {
5985         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5986         struct wireless_dev *wdev = info->user_ptr[1];
5987         u64 cookie;
5988
5989         if (!info->attrs[NL80211_ATTR_COOKIE])
5990                 return -EINVAL;
5991
5992         if (!rdev->ops->cancel_remain_on_channel)
5993                 return -EOPNOTSUPP;
5994
5995         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
5996
5997         return rdev->ops->cancel_remain_on_channel(&rdev->wiphy, wdev, cookie);
5998 }
5999
6000 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
6001                            u8 *rates, u8 rates_len)
6002 {
6003         u8 i;
6004         u32 mask = 0;
6005
6006         for (i = 0; i < rates_len; i++) {
6007                 int rate = (rates[i] & 0x7f) * 5;
6008                 int ridx;
6009                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
6010                         struct ieee80211_rate *srate =
6011                                 &sband->bitrates[ridx];
6012                         if (rate == srate->bitrate) {
6013                                 mask |= 1 << ridx;
6014                                 break;
6015                         }
6016                 }
6017                 if (ridx == sband->n_bitrates)
6018                         return 0; /* rate not found */
6019         }
6020
6021         return mask;
6022 }
6023
6024 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
6025                                u8 *rates, u8 rates_len,
6026                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
6027 {
6028         u8 i;
6029
6030         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
6031
6032         for (i = 0; i < rates_len; i++) {
6033                 int ridx, rbit;
6034
6035                 ridx = rates[i] / 8;
6036                 rbit = BIT(rates[i] % 8);
6037
6038                 /* check validity */
6039                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
6040                         return false;
6041
6042                 /* check availability */
6043                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
6044                         mcs[ridx] |= rbit;
6045                 else
6046                         return false;
6047         }
6048
6049         return true;
6050 }
6051
6052 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
6053         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
6054                                     .len = NL80211_MAX_SUPP_RATES },
6055         [NL80211_TXRATE_MCS] = { .type = NLA_BINARY,
6056                                  .len = NL80211_MAX_SUPP_HT_RATES },
6057 };
6058
6059 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
6060                                        struct genl_info *info)
6061 {
6062         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
6063         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6064         struct cfg80211_bitrate_mask mask;
6065         int rem, i;
6066         struct net_device *dev = info->user_ptr[1];
6067         struct nlattr *tx_rates;
6068         struct ieee80211_supported_band *sband;
6069
6070         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
6071                 return -EINVAL;
6072
6073         if (!rdev->ops->set_bitrate_mask)
6074                 return -EOPNOTSUPP;
6075
6076         memset(&mask, 0, sizeof(mask));
6077         /* Default to all rates enabled */
6078         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
6079                 sband = rdev->wiphy.bands[i];
6080                 mask.control[i].legacy =
6081                         sband ? (1 << sband->n_bitrates) - 1 : 0;
6082                 if (sband)
6083                         memcpy(mask.control[i].mcs,
6084                                sband->ht_cap.mcs.rx_mask,
6085                                sizeof(mask.control[i].mcs));
6086                 else
6087                         memset(mask.control[i].mcs, 0,
6088                                sizeof(mask.control[i].mcs));
6089         }
6090
6091         /*
6092          * The nested attribute uses enum nl80211_band as the index. This maps
6093          * directly to the enum ieee80211_band values used in cfg80211.
6094          */
6095         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
6096         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
6097         {
6098                 enum ieee80211_band band = nla_type(tx_rates);
6099                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
6100                         return -EINVAL;
6101                 sband = rdev->wiphy.bands[band];
6102                 if (sband == NULL)
6103                         return -EINVAL;
6104                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
6105                           nla_len(tx_rates), nl80211_txattr_policy);
6106                 if (tb[NL80211_TXRATE_LEGACY]) {
6107                         mask.control[band].legacy = rateset_to_mask(
6108                                 sband,
6109                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
6110                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
6111                         if ((mask.control[band].legacy == 0) &&
6112                             nla_len(tb[NL80211_TXRATE_LEGACY]))
6113                                 return -EINVAL;
6114                 }
6115                 if (tb[NL80211_TXRATE_MCS]) {
6116                         if (!ht_rateset_to_mask(
6117                                         sband,
6118                                         nla_data(tb[NL80211_TXRATE_MCS]),
6119                                         nla_len(tb[NL80211_TXRATE_MCS]),
6120                                         mask.control[band].mcs))
6121                                 return -EINVAL;
6122                 }
6123
6124                 if (mask.control[band].legacy == 0) {
6125                         /* don't allow empty legacy rates if HT
6126                          * is not even supported. */
6127                         if (!rdev->wiphy.bands[band]->ht_cap.ht_supported)
6128                                 return -EINVAL;
6129
6130                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
6131                                 if (mask.control[band].mcs[i])
6132                                         break;
6133
6134                         /* legacy and mcs rates may not be both empty */
6135                         if (i == IEEE80211_HT_MCS_MASK_LEN)
6136                                 return -EINVAL;
6137                 }
6138         }
6139
6140         return rdev->ops->set_bitrate_mask(&rdev->wiphy, dev, NULL, &mask);
6141 }
6142
6143 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
6144 {
6145         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6146         struct wireless_dev *wdev = info->user_ptr[1];
6147         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
6148
6149         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
6150                 return -EINVAL;
6151
6152         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
6153                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
6154
6155         switch (wdev->iftype) {
6156         case NL80211_IFTYPE_STATION:
6157         case NL80211_IFTYPE_ADHOC:
6158         case NL80211_IFTYPE_P2P_CLIENT:
6159         case NL80211_IFTYPE_AP:
6160         case NL80211_IFTYPE_AP_VLAN:
6161         case NL80211_IFTYPE_MESH_POINT:
6162         case NL80211_IFTYPE_P2P_GO:
6163         case NL80211_IFTYPE_P2P_DEVICE:
6164                 break;
6165         default:
6166                 return -EOPNOTSUPP;
6167         }
6168
6169         /* not much point in registering if we can't reply */
6170         if (!rdev->ops->mgmt_tx)
6171                 return -EOPNOTSUPP;
6172
6173         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
6174                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
6175                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
6176 }
6177
6178 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
6179 {
6180         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6181         struct wireless_dev *wdev = info->user_ptr[1];
6182         struct ieee80211_channel *chan;
6183         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
6184         bool channel_type_valid = false;
6185         u32 freq;
6186         int err;
6187         void *hdr = NULL;
6188         u64 cookie;
6189         struct sk_buff *msg = NULL;
6190         unsigned int wait = 0;
6191         bool offchan, no_cck, dont_wait_for_ack;
6192
6193         dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
6194
6195         if (!info->attrs[NL80211_ATTR_FRAME] ||
6196             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
6197                 return -EINVAL;
6198
6199         if (!rdev->ops->mgmt_tx)
6200                 return -EOPNOTSUPP;
6201
6202         switch (wdev->iftype) {
6203         case NL80211_IFTYPE_STATION:
6204         case NL80211_IFTYPE_ADHOC:
6205         case NL80211_IFTYPE_P2P_CLIENT:
6206         case NL80211_IFTYPE_AP:
6207         case NL80211_IFTYPE_AP_VLAN:
6208         case NL80211_IFTYPE_MESH_POINT:
6209         case NL80211_IFTYPE_P2P_GO:
6210         case NL80211_IFTYPE_P2P_DEVICE:
6211                 break;
6212         default:
6213                 return -EOPNOTSUPP;
6214         }
6215
6216         if (info->attrs[NL80211_ATTR_DURATION]) {
6217                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
6218                         return -EINVAL;
6219                 wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
6220
6221                 /*
6222                  * We should wait on the channel for at least a minimum amount
6223                  * of time (10ms) but no longer than the driver supports.
6224                  */
6225                 if (wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
6226                     wait > rdev->wiphy.max_remain_on_channel_duration)
6227                         return -EINVAL;
6228
6229         }
6230
6231         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
6232                 if (!nl80211_valid_channel_type(info, &channel_type))
6233                         return -EINVAL;
6234                 channel_type_valid = true;
6235         }
6236
6237         offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
6238
6239         if (offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
6240                 return -EINVAL;
6241
6242         no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
6243
6244         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
6245         chan = rdev_freq_to_chan(rdev, freq, channel_type);
6246         if (chan == NULL)
6247                 return -EINVAL;
6248
6249         if (!dont_wait_for_ack) {
6250                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6251                 if (!msg)
6252                         return -ENOMEM;
6253
6254                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6255                                      NL80211_CMD_FRAME);
6256
6257                 if (IS_ERR(hdr)) {
6258                         err = PTR_ERR(hdr);
6259                         goto free_msg;
6260                 }
6261         }
6262
6263         err = cfg80211_mlme_mgmt_tx(rdev, wdev, chan, offchan, channel_type,
6264                                     channel_type_valid, wait,
6265                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
6266                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
6267                                     no_cck, dont_wait_for_ack, &cookie);
6268         if (err)
6269                 goto free_msg;
6270
6271         if (msg) {
6272                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6273                         goto nla_put_failure;
6274
6275                 genlmsg_end(msg, hdr);
6276                 return genlmsg_reply(msg, info);
6277         }
6278
6279         return 0;
6280
6281  nla_put_failure:
6282         err = -ENOBUFS;
6283  free_msg:
6284         nlmsg_free(msg);
6285         return err;
6286 }
6287
6288 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
6289 {
6290         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6291         struct wireless_dev *wdev = info->user_ptr[1];
6292         u64 cookie;
6293
6294         if (!info->attrs[NL80211_ATTR_COOKIE])
6295                 return -EINVAL;
6296
6297         if (!rdev->ops->mgmt_tx_cancel_wait)
6298                 return -EOPNOTSUPP;
6299
6300         switch (wdev->iftype) {
6301         case NL80211_IFTYPE_STATION:
6302         case NL80211_IFTYPE_ADHOC:
6303         case NL80211_IFTYPE_P2P_CLIENT:
6304         case NL80211_IFTYPE_AP:
6305         case NL80211_IFTYPE_AP_VLAN:
6306         case NL80211_IFTYPE_P2P_GO:
6307         case NL80211_IFTYPE_P2P_DEVICE:
6308                 break;
6309         default:
6310                 return -EOPNOTSUPP;
6311         }
6312
6313         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
6314
6315         return rdev->ops->mgmt_tx_cancel_wait(&rdev->wiphy, wdev, cookie);
6316 }
6317
6318 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
6319 {
6320         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6321         struct wireless_dev *wdev;
6322         struct net_device *dev = info->user_ptr[1];
6323         u8 ps_state;
6324         bool state;
6325         int err;
6326
6327         if (!info->attrs[NL80211_ATTR_PS_STATE])
6328                 return -EINVAL;
6329
6330         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
6331
6332         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
6333                 return -EINVAL;
6334
6335         wdev = dev->ieee80211_ptr;
6336
6337         if (!rdev->ops->set_power_mgmt)
6338                 return -EOPNOTSUPP;
6339
6340         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
6341
6342         if (state == wdev->ps)
6343                 return 0;
6344
6345         err = rdev->ops->set_power_mgmt(wdev->wiphy, dev, state,
6346                                         wdev->ps_timeout);
6347         if (!err)
6348                 wdev->ps = state;
6349         return err;
6350 }
6351
6352 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
6353 {
6354         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6355         enum nl80211_ps_state ps_state;
6356         struct wireless_dev *wdev;
6357         struct net_device *dev = info->user_ptr[1];
6358         struct sk_buff *msg;
6359         void *hdr;
6360         int err;
6361
6362         wdev = dev->ieee80211_ptr;
6363
6364         if (!rdev->ops->set_power_mgmt)
6365                 return -EOPNOTSUPP;
6366
6367         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6368         if (!msg)
6369                 return -ENOMEM;
6370
6371         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6372                              NL80211_CMD_GET_POWER_SAVE);
6373         if (!hdr) {
6374                 err = -ENOBUFS;
6375                 goto free_msg;
6376         }
6377
6378         if (wdev->ps)
6379                 ps_state = NL80211_PS_ENABLED;
6380         else
6381                 ps_state = NL80211_PS_DISABLED;
6382
6383         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
6384                 goto nla_put_failure;
6385
6386         genlmsg_end(msg, hdr);
6387         return genlmsg_reply(msg, info);
6388
6389  nla_put_failure:
6390         err = -ENOBUFS;
6391  free_msg:
6392         nlmsg_free(msg);
6393         return err;
6394 }
6395
6396 static struct nla_policy
6397 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
6398         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
6399         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
6400         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
6401         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
6402         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
6403         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
6404 };
6405
6406 static int nl80211_set_cqm_txe(struct genl_info *info,
6407                                 u32 rate, u32 pkts, u32 intvl)
6408 {
6409         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6410         struct wireless_dev *wdev;
6411         struct net_device *dev = info->user_ptr[1];
6412
6413         if ((rate < 0 || rate > 100) ||
6414             (intvl < 0 || intvl > NL80211_CQM_TXE_MAX_INTVL))
6415                 return -EINVAL;
6416
6417         wdev = dev->ieee80211_ptr;
6418
6419         if (!rdev->ops->set_cqm_txe_config)
6420                 return -EOPNOTSUPP;
6421
6422         if (wdev->iftype != NL80211_IFTYPE_STATION &&
6423             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
6424                 return -EOPNOTSUPP;
6425
6426         return rdev->ops->set_cqm_txe_config(wdev->wiphy, dev,
6427                                              rate, pkts, intvl);
6428 }
6429
6430 static int nl80211_set_cqm_rssi(struct genl_info *info,
6431                                 s32 threshold, u32 hysteresis)
6432 {
6433         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6434         struct wireless_dev *wdev;
6435         struct net_device *dev = info->user_ptr[1];
6436
6437         if (threshold > 0)
6438                 return -EINVAL;
6439
6440         wdev = dev->ieee80211_ptr;
6441
6442         if (!rdev->ops->set_cqm_rssi_config)
6443                 return -EOPNOTSUPP;
6444
6445         if (wdev->iftype != NL80211_IFTYPE_STATION &&
6446             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
6447                 return -EOPNOTSUPP;
6448
6449         return rdev->ops->set_cqm_rssi_config(wdev->wiphy, dev,
6450                                               threshold, hysteresis);
6451 }
6452
6453 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
6454 {
6455         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
6456         struct nlattr *cqm;
6457         int err;
6458
6459         cqm = info->attrs[NL80211_ATTR_CQM];
6460         if (!cqm) {
6461                 err = -EINVAL;
6462                 goto out;
6463         }
6464
6465         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
6466                                nl80211_attr_cqm_policy);
6467         if (err)
6468                 goto out;
6469
6470         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
6471             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
6472                 s32 threshold;
6473                 u32 hysteresis;
6474                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
6475                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
6476                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
6477         } else if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
6478                    attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
6479                    attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
6480                 u32 rate, pkts, intvl;
6481                 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
6482                 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
6483                 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
6484                 err = nl80211_set_cqm_txe(info, rate, pkts, intvl);
6485         } else
6486                 err = -EINVAL;
6487
6488 out:
6489         return err;
6490 }
6491
6492 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
6493 {
6494         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6495         struct net_device *dev = info->user_ptr[1];
6496         struct mesh_config cfg;
6497         struct mesh_setup setup;
6498         int err;
6499
6500         /* start with default */
6501         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
6502         memcpy(&setup, &default_mesh_setup, sizeof(setup));
6503
6504         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
6505                 /* and parse parameters if given */
6506                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
6507                 if (err)
6508                         return err;
6509         }
6510
6511         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
6512             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
6513                 return -EINVAL;
6514
6515         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
6516         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
6517
6518         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
6519             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
6520                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
6521                         return -EINVAL;
6522
6523         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
6524                 /* parse additional setup parameters if given */
6525                 err = nl80211_parse_mesh_setup(info, &setup);
6526                 if (err)
6527                         return err;
6528         }
6529
6530         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6531                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
6532
6533                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
6534                     !nl80211_valid_channel_type(info, &channel_type))
6535                         return -EINVAL;
6536
6537                 setup.channel = rdev_freq_to_chan(rdev,
6538                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]),
6539                         channel_type);
6540                 if (!setup.channel)
6541                         return -EINVAL;
6542                 setup.channel_type = channel_type;
6543         } else {
6544                 /* cfg80211_join_mesh() will sort it out */
6545                 setup.channel = NULL;
6546         }
6547
6548         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
6549 }
6550
6551 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
6552 {
6553         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6554         struct net_device *dev = info->user_ptr[1];
6555
6556         return cfg80211_leave_mesh(rdev, dev);
6557 }
6558
6559 #ifdef CONFIG_PM
6560 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
6561 {
6562         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6563         struct sk_buff *msg;
6564         void *hdr;
6565
6566         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
6567                 return -EOPNOTSUPP;
6568
6569         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6570         if (!msg)
6571                 return -ENOMEM;
6572
6573         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6574                              NL80211_CMD_GET_WOWLAN);
6575         if (!hdr)
6576                 goto nla_put_failure;
6577
6578         if (rdev->wowlan) {
6579                 struct nlattr *nl_wowlan;
6580
6581                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
6582                 if (!nl_wowlan)
6583                         goto nla_put_failure;
6584
6585                 if ((rdev->wowlan->any &&
6586                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
6587                     (rdev->wowlan->disconnect &&
6588                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
6589                     (rdev->wowlan->magic_pkt &&
6590                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
6591                     (rdev->wowlan->gtk_rekey_failure &&
6592                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
6593                     (rdev->wowlan->eap_identity_req &&
6594                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
6595                     (rdev->wowlan->four_way_handshake &&
6596                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
6597                     (rdev->wowlan->rfkill_release &&
6598                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
6599                         goto nla_put_failure;
6600                 if (rdev->wowlan->n_patterns) {
6601                         struct nlattr *nl_pats, *nl_pat;
6602                         int i, pat_len;
6603
6604                         nl_pats = nla_nest_start(msg,
6605                                         NL80211_WOWLAN_TRIG_PKT_PATTERN);
6606                         if (!nl_pats)
6607                                 goto nla_put_failure;
6608
6609                         for (i = 0; i < rdev->wowlan->n_patterns; i++) {
6610                                 nl_pat = nla_nest_start(msg, i + 1);
6611                                 if (!nl_pat)
6612                                         goto nla_put_failure;
6613                                 pat_len = rdev->wowlan->patterns[i].pattern_len;
6614                                 if (nla_put(msg, NL80211_WOWLAN_PKTPAT_MASK,
6615                                             DIV_ROUND_UP(pat_len, 8),
6616                                             rdev->wowlan->patterns[i].mask) ||
6617                                     nla_put(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
6618                                             pat_len,
6619                                             rdev->wowlan->patterns[i].pattern))
6620                                         goto nla_put_failure;
6621                                 nla_nest_end(msg, nl_pat);
6622                         }
6623                         nla_nest_end(msg, nl_pats);
6624                 }
6625
6626                 nla_nest_end(msg, nl_wowlan);
6627         }
6628
6629         genlmsg_end(msg, hdr);
6630         return genlmsg_reply(msg, info);
6631
6632 nla_put_failure:
6633         nlmsg_free(msg);
6634         return -ENOBUFS;
6635 }
6636
6637 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
6638 {
6639         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6640         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
6641         struct cfg80211_wowlan new_triggers = {};
6642         struct cfg80211_wowlan *ntrig;
6643         struct wiphy_wowlan_support *wowlan = &rdev->wiphy.wowlan;
6644         int err, i;
6645         bool prev_enabled = rdev->wowlan;
6646
6647         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
6648                 return -EOPNOTSUPP;
6649
6650         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
6651                 cfg80211_rdev_free_wowlan(rdev);
6652                 rdev->wowlan = NULL;
6653                 goto set_wakeup;
6654         }
6655
6656         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
6657                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
6658                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
6659                         nl80211_wowlan_policy);
6660         if (err)
6661                 return err;
6662
6663         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
6664                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
6665                         return -EINVAL;
6666                 new_triggers.any = true;
6667         }
6668
6669         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
6670                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
6671                         return -EINVAL;
6672                 new_triggers.disconnect = true;
6673         }
6674
6675         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
6676                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
6677                         return -EINVAL;
6678                 new_triggers.magic_pkt = true;
6679         }
6680
6681         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
6682                 return -EINVAL;
6683
6684         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
6685                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
6686                         return -EINVAL;
6687                 new_triggers.gtk_rekey_failure = true;
6688         }
6689
6690         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
6691                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
6692                         return -EINVAL;
6693                 new_triggers.eap_identity_req = true;
6694         }
6695
6696         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
6697                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
6698                         return -EINVAL;
6699                 new_triggers.four_way_handshake = true;
6700         }
6701
6702         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
6703                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
6704                         return -EINVAL;
6705                 new_triggers.rfkill_release = true;
6706         }
6707
6708         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
6709                 struct nlattr *pat;
6710                 int n_patterns = 0;
6711                 int rem, pat_len, mask_len;
6712                 struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
6713
6714                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
6715                                     rem)
6716                         n_patterns++;
6717                 if (n_patterns > wowlan->n_patterns)
6718                         return -EINVAL;
6719
6720                 new_triggers.patterns = kcalloc(n_patterns,
6721                                                 sizeof(new_triggers.patterns[0]),
6722                                                 GFP_KERNEL);
6723                 if (!new_triggers.patterns)
6724                         return -ENOMEM;
6725
6726                 new_triggers.n_patterns = n_patterns;
6727                 i = 0;
6728
6729                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
6730                                     rem) {
6731                         nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
6732                                   nla_data(pat), nla_len(pat), NULL);
6733                         err = -EINVAL;
6734                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
6735                             !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
6736                                 goto error;
6737                         pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
6738                         mask_len = DIV_ROUND_UP(pat_len, 8);
6739                         if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
6740                             mask_len)
6741                                 goto error;
6742                         if (pat_len > wowlan->pattern_max_len ||
6743                             pat_len < wowlan->pattern_min_len)
6744                                 goto error;
6745
6746                         new_triggers.patterns[i].mask =
6747                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
6748                         if (!new_triggers.patterns[i].mask) {
6749                                 err = -ENOMEM;
6750                                 goto error;
6751                         }
6752                         new_triggers.patterns[i].pattern =
6753                                 new_triggers.patterns[i].mask + mask_len;
6754                         memcpy(new_triggers.patterns[i].mask,
6755                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
6756                                mask_len);
6757                         new_triggers.patterns[i].pattern_len = pat_len;
6758                         memcpy(new_triggers.patterns[i].pattern,
6759                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
6760                                pat_len);
6761                         i++;
6762                 }
6763         }
6764
6765         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
6766         if (!ntrig) {
6767                 err = -ENOMEM;
6768                 goto error;
6769         }
6770         cfg80211_rdev_free_wowlan(rdev);
6771         rdev->wowlan = ntrig;
6772
6773  set_wakeup:
6774         if (rdev->ops->set_wakeup && prev_enabled != !!rdev->wowlan)
6775                 rdev->ops->set_wakeup(&rdev->wiphy, rdev->wowlan);
6776
6777         return 0;
6778  error:
6779         for (i = 0; i < new_triggers.n_patterns; i++)
6780                 kfree(new_triggers.patterns[i].mask);
6781         kfree(new_triggers.patterns);
6782         return err;
6783 }
6784 #endif
6785
6786 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
6787 {
6788         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6789         struct net_device *dev = info->user_ptr[1];
6790         struct wireless_dev *wdev = dev->ieee80211_ptr;
6791         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
6792         struct cfg80211_gtk_rekey_data rekey_data;
6793         int err;
6794
6795         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
6796                 return -EINVAL;
6797
6798         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
6799                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
6800                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
6801                         nl80211_rekey_policy);
6802         if (err)
6803                 return err;
6804
6805         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
6806                 return -ERANGE;
6807         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
6808                 return -ERANGE;
6809         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
6810                 return -ERANGE;
6811
6812         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
6813                NL80211_KEK_LEN);
6814         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
6815                NL80211_KCK_LEN);
6816         memcpy(rekey_data.replay_ctr,
6817                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
6818                NL80211_REPLAY_CTR_LEN);
6819
6820         wdev_lock(wdev);
6821         if (!wdev->current_bss) {
6822                 err = -ENOTCONN;
6823                 goto out;
6824         }
6825
6826         if (!rdev->ops->set_rekey_data) {
6827                 err = -EOPNOTSUPP;
6828                 goto out;
6829         }
6830
6831         err = rdev->ops->set_rekey_data(&rdev->wiphy, dev, &rekey_data);
6832  out:
6833         wdev_unlock(wdev);
6834         return err;
6835 }
6836
6837 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
6838                                              struct genl_info *info)
6839 {
6840         struct net_device *dev = info->user_ptr[1];
6841         struct wireless_dev *wdev = dev->ieee80211_ptr;
6842
6843         if (wdev->iftype != NL80211_IFTYPE_AP &&
6844             wdev->iftype != NL80211_IFTYPE_P2P_GO)
6845                 return -EINVAL;
6846
6847         if (wdev->ap_unexpected_nlportid)
6848                 return -EBUSY;
6849
6850         wdev->ap_unexpected_nlportid = info->snd_portid;
6851         return 0;
6852 }
6853
6854 static int nl80211_probe_client(struct sk_buff *skb,
6855                                 struct genl_info *info)
6856 {
6857         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6858         struct net_device *dev = info->user_ptr[1];
6859         struct wireless_dev *wdev = dev->ieee80211_ptr;
6860         struct sk_buff *msg;
6861         void *hdr;
6862         const u8 *addr;
6863         u64 cookie;
6864         int err;
6865
6866         if (wdev->iftype != NL80211_IFTYPE_AP &&
6867             wdev->iftype != NL80211_IFTYPE_P2P_GO)
6868                 return -EOPNOTSUPP;
6869
6870         if (!info->attrs[NL80211_ATTR_MAC])
6871                 return -EINVAL;
6872
6873         if (!rdev->ops->probe_client)
6874                 return -EOPNOTSUPP;
6875
6876         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6877         if (!msg)
6878                 return -ENOMEM;
6879
6880         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6881                              NL80211_CMD_PROBE_CLIENT);
6882
6883         if (IS_ERR(hdr)) {
6884                 err = PTR_ERR(hdr);
6885                 goto free_msg;
6886         }
6887
6888         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
6889
6890         err = rdev->ops->probe_client(&rdev->wiphy, dev, addr, &cookie);
6891         if (err)
6892                 goto free_msg;
6893
6894         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6895                 goto nla_put_failure;
6896
6897         genlmsg_end(msg, hdr);
6898
6899         return genlmsg_reply(msg, info);
6900
6901  nla_put_failure:
6902         err = -ENOBUFS;
6903  free_msg:
6904         nlmsg_free(msg);
6905         return err;
6906 }
6907
6908 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
6909 {
6910         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6911
6912         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
6913                 return -EOPNOTSUPP;
6914
6915         if (rdev->ap_beacons_nlportid)
6916                 return -EBUSY;
6917
6918         rdev->ap_beacons_nlportid = info->snd_portid;
6919
6920         return 0;
6921 }
6922
6923 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
6924 {
6925         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6926         struct wireless_dev *wdev = info->user_ptr[1];
6927         int err;
6928
6929         if (!rdev->ops->start_p2p_device)
6930                 return -EOPNOTSUPP;
6931
6932         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
6933                 return -EOPNOTSUPP;
6934
6935         if (wdev->p2p_started)
6936                 return 0;
6937
6938         mutex_lock(&rdev->devlist_mtx);
6939         err = cfg80211_can_add_interface(rdev, wdev->iftype);
6940         mutex_unlock(&rdev->devlist_mtx);
6941         if (err)
6942                 return err;
6943
6944         err = rdev->ops->start_p2p_device(&rdev->wiphy, wdev);
6945         if (err)
6946                 return err;
6947
6948         wdev->p2p_started = true;
6949         mutex_lock(&rdev->devlist_mtx);
6950         rdev->opencount++;
6951         mutex_unlock(&rdev->devlist_mtx);
6952
6953         return 0;
6954 }
6955
6956 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
6957 {
6958         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6959         struct wireless_dev *wdev = info->user_ptr[1];
6960
6961         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
6962                 return -EOPNOTSUPP;
6963
6964         if (!rdev->ops->stop_p2p_device)
6965                 return -EOPNOTSUPP;
6966
6967         if (!wdev->p2p_started)
6968                 return 0;
6969
6970         rdev->ops->stop_p2p_device(&rdev->wiphy, wdev);
6971         wdev->p2p_started = false;
6972
6973         mutex_lock(&rdev->devlist_mtx);
6974         rdev->opencount--;
6975         mutex_unlock(&rdev->devlist_mtx);
6976
6977         if (WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev)) {
6978                 rdev->scan_req->aborted = true;
6979                 ___cfg80211_scan_done(rdev, true);
6980         }
6981
6982         return 0;
6983 }
6984
6985 #define NL80211_FLAG_NEED_WIPHY         0x01
6986 #define NL80211_FLAG_NEED_NETDEV        0x02
6987 #define NL80211_FLAG_NEED_RTNL          0x04
6988 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
6989 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
6990                                          NL80211_FLAG_CHECK_NETDEV_UP)
6991 #define NL80211_FLAG_NEED_WDEV          0x10
6992 /* If a netdev is associated, it must be UP, P2P must be started */
6993 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
6994                                          NL80211_FLAG_CHECK_NETDEV_UP)
6995
6996 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
6997                             struct genl_info *info)
6998 {
6999         struct cfg80211_registered_device *rdev;
7000         struct wireless_dev *wdev;
7001         struct net_device *dev;
7002         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
7003
7004         if (rtnl)
7005                 rtnl_lock();
7006
7007         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
7008                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
7009                 if (IS_ERR(rdev)) {
7010                         if (rtnl)
7011                                 rtnl_unlock();
7012                         return PTR_ERR(rdev);
7013                 }
7014                 info->user_ptr[0] = rdev;
7015         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
7016                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
7017                 mutex_lock(&cfg80211_mutex);
7018                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
7019                                                   info->attrs);
7020                 if (IS_ERR(wdev)) {
7021                         mutex_unlock(&cfg80211_mutex);
7022                         if (rtnl)
7023                                 rtnl_unlock();
7024                         return PTR_ERR(wdev);
7025                 }
7026
7027                 dev = wdev->netdev;
7028                 rdev = wiphy_to_dev(wdev->wiphy);
7029
7030                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
7031                         if (!dev) {
7032                                 mutex_unlock(&cfg80211_mutex);
7033                                 if (rtnl)
7034                                         rtnl_unlock();
7035                                 return -EINVAL;
7036                         }
7037
7038                         info->user_ptr[1] = dev;
7039                 } else {
7040                         info->user_ptr[1] = wdev;
7041                 }
7042
7043                 if (dev) {
7044                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
7045                             !netif_running(dev)) {
7046                                 mutex_unlock(&cfg80211_mutex);
7047                                 if (rtnl)
7048                                         rtnl_unlock();
7049                                 return -ENETDOWN;
7050                         }
7051
7052                         dev_hold(dev);
7053                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
7054                         if (!wdev->p2p_started) {
7055                                 mutex_unlock(&cfg80211_mutex);
7056                                 if (rtnl)
7057                                         rtnl_unlock();
7058                                 return -ENETDOWN;
7059                         }
7060                 }
7061
7062                 cfg80211_lock_rdev(rdev);
7063
7064                 mutex_unlock(&cfg80211_mutex);
7065
7066                 info->user_ptr[0] = rdev;
7067         }
7068
7069         return 0;
7070 }
7071
7072 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
7073                               struct genl_info *info)
7074 {
7075         if (info->user_ptr[0])
7076                 cfg80211_unlock_rdev(info->user_ptr[0]);
7077         if (info->user_ptr[1]) {
7078                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
7079                         struct wireless_dev *wdev = info->user_ptr[1];
7080
7081                         if (wdev->netdev)
7082                                 dev_put(wdev->netdev);
7083                 } else {
7084                         dev_put(info->user_ptr[1]);
7085                 }
7086         }
7087         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
7088                 rtnl_unlock();
7089 }
7090
7091 static struct genl_ops nl80211_ops[] = {
7092         {
7093                 .cmd = NL80211_CMD_GET_WIPHY,
7094                 .doit = nl80211_get_wiphy,
7095                 .dumpit = nl80211_dump_wiphy,
7096                 .policy = nl80211_policy,
7097                 /* can be retrieved by unprivileged users */
7098                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
7099         },
7100         {
7101                 .cmd = NL80211_CMD_SET_WIPHY,
7102                 .doit = nl80211_set_wiphy,
7103                 .policy = nl80211_policy,
7104                 .flags = GENL_ADMIN_PERM,
7105                 .internal_flags = NL80211_FLAG_NEED_RTNL,
7106         },
7107         {
7108                 .cmd = NL80211_CMD_GET_INTERFACE,
7109                 .doit = nl80211_get_interface,
7110                 .dumpit = nl80211_dump_interface,
7111                 .policy = nl80211_policy,
7112                 /* can be retrieved by unprivileged users */
7113                 .internal_flags = NL80211_FLAG_NEED_WDEV,
7114         },
7115         {
7116                 .cmd = NL80211_CMD_SET_INTERFACE,
7117                 .doit = nl80211_set_interface,
7118                 .policy = nl80211_policy,
7119                 .flags = GENL_ADMIN_PERM,
7120                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7121                                   NL80211_FLAG_NEED_RTNL,
7122         },
7123         {
7124                 .cmd = NL80211_CMD_NEW_INTERFACE,
7125                 .doit = nl80211_new_interface,
7126                 .policy = nl80211_policy,
7127                 .flags = GENL_ADMIN_PERM,
7128                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7129                                   NL80211_FLAG_NEED_RTNL,
7130         },
7131         {
7132                 .cmd = NL80211_CMD_DEL_INTERFACE,
7133                 .doit = nl80211_del_interface,
7134                 .policy = nl80211_policy,
7135                 .flags = GENL_ADMIN_PERM,
7136                 .internal_flags = NL80211_FLAG_NEED_WDEV |
7137                                   NL80211_FLAG_NEED_RTNL,
7138         },
7139         {
7140                 .cmd = NL80211_CMD_GET_KEY,
7141                 .doit = nl80211_get_key,
7142                 .policy = nl80211_policy,
7143                 .flags = GENL_ADMIN_PERM,
7144                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7145                                   NL80211_FLAG_NEED_RTNL,
7146         },
7147         {
7148                 .cmd = NL80211_CMD_SET_KEY,
7149                 .doit = nl80211_set_key,
7150                 .policy = nl80211_policy,
7151                 .flags = GENL_ADMIN_PERM,
7152                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7153                                   NL80211_FLAG_NEED_RTNL,
7154         },
7155         {
7156                 .cmd = NL80211_CMD_NEW_KEY,
7157                 .doit = nl80211_new_key,
7158                 .policy = nl80211_policy,
7159                 .flags = GENL_ADMIN_PERM,
7160                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7161                                   NL80211_FLAG_NEED_RTNL,
7162         },
7163         {
7164                 .cmd = NL80211_CMD_DEL_KEY,
7165                 .doit = nl80211_del_key,
7166                 .policy = nl80211_policy,
7167                 .flags = GENL_ADMIN_PERM,
7168                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7169                                   NL80211_FLAG_NEED_RTNL,
7170         },
7171         {
7172                 .cmd = NL80211_CMD_SET_BEACON,
7173                 .policy = nl80211_policy,
7174                 .flags = GENL_ADMIN_PERM,
7175                 .doit = nl80211_set_beacon,
7176                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7177                                   NL80211_FLAG_NEED_RTNL,
7178         },
7179         {
7180                 .cmd = NL80211_CMD_START_AP,
7181                 .policy = nl80211_policy,
7182                 .flags = GENL_ADMIN_PERM,
7183                 .doit = nl80211_start_ap,
7184                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7185                                   NL80211_FLAG_NEED_RTNL,
7186         },
7187         {
7188                 .cmd = NL80211_CMD_STOP_AP,
7189                 .policy = nl80211_policy,
7190                 .flags = GENL_ADMIN_PERM,
7191                 .doit = nl80211_stop_ap,
7192                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7193                                   NL80211_FLAG_NEED_RTNL,
7194         },
7195         {
7196                 .cmd = NL80211_CMD_GET_STATION,
7197                 .doit = nl80211_get_station,
7198                 .dumpit = nl80211_dump_station,
7199                 .policy = nl80211_policy,
7200                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7201                                   NL80211_FLAG_NEED_RTNL,
7202         },
7203         {
7204                 .cmd = NL80211_CMD_SET_STATION,
7205                 .doit = nl80211_set_station,
7206                 .policy = nl80211_policy,
7207                 .flags = GENL_ADMIN_PERM,
7208                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7209                                   NL80211_FLAG_NEED_RTNL,
7210         },
7211         {
7212                 .cmd = NL80211_CMD_NEW_STATION,
7213                 .doit = nl80211_new_station,
7214                 .policy = nl80211_policy,
7215                 .flags = GENL_ADMIN_PERM,
7216                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7217                                   NL80211_FLAG_NEED_RTNL,
7218         },
7219         {
7220                 .cmd = NL80211_CMD_DEL_STATION,
7221                 .doit = nl80211_del_station,
7222                 .policy = nl80211_policy,
7223                 .flags = GENL_ADMIN_PERM,
7224                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7225                                   NL80211_FLAG_NEED_RTNL,
7226         },
7227         {
7228                 .cmd = NL80211_CMD_GET_MPATH,
7229                 .doit = nl80211_get_mpath,
7230                 .dumpit = nl80211_dump_mpath,
7231                 .policy = nl80211_policy,
7232                 .flags = GENL_ADMIN_PERM,
7233                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7234                                   NL80211_FLAG_NEED_RTNL,
7235         },
7236         {
7237                 .cmd = NL80211_CMD_SET_MPATH,
7238                 .doit = nl80211_set_mpath,
7239                 .policy = nl80211_policy,
7240                 .flags = GENL_ADMIN_PERM,
7241                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7242                                   NL80211_FLAG_NEED_RTNL,
7243         },
7244         {
7245                 .cmd = NL80211_CMD_NEW_MPATH,
7246                 .doit = nl80211_new_mpath,
7247                 .policy = nl80211_policy,
7248                 .flags = GENL_ADMIN_PERM,
7249                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7250                                   NL80211_FLAG_NEED_RTNL,
7251         },
7252         {
7253                 .cmd = NL80211_CMD_DEL_MPATH,
7254                 .doit = nl80211_del_mpath,
7255                 .policy = nl80211_policy,
7256                 .flags = GENL_ADMIN_PERM,
7257                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7258                                   NL80211_FLAG_NEED_RTNL,
7259         },
7260         {
7261                 .cmd = NL80211_CMD_SET_BSS,
7262                 .doit = nl80211_set_bss,
7263                 .policy = nl80211_policy,
7264                 .flags = GENL_ADMIN_PERM,
7265                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7266                                   NL80211_FLAG_NEED_RTNL,
7267         },
7268         {
7269                 .cmd = NL80211_CMD_GET_REG,
7270                 .doit = nl80211_get_reg,
7271                 .policy = nl80211_policy,
7272                 /* can be retrieved by unprivileged users */
7273         },
7274         {
7275                 .cmd = NL80211_CMD_SET_REG,
7276                 .doit = nl80211_set_reg,
7277                 .policy = nl80211_policy,
7278                 .flags = GENL_ADMIN_PERM,
7279         },
7280         {
7281                 .cmd = NL80211_CMD_REQ_SET_REG,
7282                 .doit = nl80211_req_set_reg,
7283                 .policy = nl80211_policy,
7284                 .flags = GENL_ADMIN_PERM,
7285         },
7286         {
7287                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
7288                 .doit = nl80211_get_mesh_config,
7289                 .policy = nl80211_policy,
7290                 /* can be retrieved by unprivileged users */
7291                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7292                                   NL80211_FLAG_NEED_RTNL,
7293         },
7294         {
7295                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
7296                 .doit = nl80211_update_mesh_config,
7297                 .policy = nl80211_policy,
7298                 .flags = GENL_ADMIN_PERM,
7299                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7300                                   NL80211_FLAG_NEED_RTNL,
7301         },
7302         {
7303                 .cmd = NL80211_CMD_TRIGGER_SCAN,
7304                 .doit = nl80211_trigger_scan,
7305                 .policy = nl80211_policy,
7306                 .flags = GENL_ADMIN_PERM,
7307                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7308                                   NL80211_FLAG_NEED_RTNL,
7309         },
7310         {
7311                 .cmd = NL80211_CMD_GET_SCAN,
7312                 .policy = nl80211_policy,
7313                 .dumpit = nl80211_dump_scan,
7314         },
7315         {
7316                 .cmd = NL80211_CMD_START_SCHED_SCAN,
7317                 .doit = nl80211_start_sched_scan,
7318                 .policy = nl80211_policy,
7319                 .flags = GENL_ADMIN_PERM,
7320                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7321                                   NL80211_FLAG_NEED_RTNL,
7322         },
7323         {
7324                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
7325                 .doit = nl80211_stop_sched_scan,
7326                 .policy = nl80211_policy,
7327                 .flags = GENL_ADMIN_PERM,
7328                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7329                                   NL80211_FLAG_NEED_RTNL,
7330         },
7331         {
7332                 .cmd = NL80211_CMD_AUTHENTICATE,
7333                 .doit = nl80211_authenticate,
7334                 .policy = nl80211_policy,
7335                 .flags = GENL_ADMIN_PERM,
7336                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7337                                   NL80211_FLAG_NEED_RTNL,
7338         },
7339         {
7340                 .cmd = NL80211_CMD_ASSOCIATE,
7341                 .doit = nl80211_associate,
7342                 .policy = nl80211_policy,
7343                 .flags = GENL_ADMIN_PERM,
7344                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7345                                   NL80211_FLAG_NEED_RTNL,
7346         },
7347         {
7348                 .cmd = NL80211_CMD_DEAUTHENTICATE,
7349                 .doit = nl80211_deauthenticate,
7350                 .policy = nl80211_policy,
7351                 .flags = GENL_ADMIN_PERM,
7352                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7353                                   NL80211_FLAG_NEED_RTNL,
7354         },
7355         {
7356                 .cmd = NL80211_CMD_DISASSOCIATE,
7357                 .doit = nl80211_disassociate,
7358                 .policy = nl80211_policy,
7359                 .flags = GENL_ADMIN_PERM,
7360                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7361                                   NL80211_FLAG_NEED_RTNL,
7362         },
7363         {
7364                 .cmd = NL80211_CMD_JOIN_IBSS,
7365                 .doit = nl80211_join_ibss,
7366                 .policy = nl80211_policy,
7367                 .flags = GENL_ADMIN_PERM,
7368                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7369                                   NL80211_FLAG_NEED_RTNL,
7370         },
7371         {
7372                 .cmd = NL80211_CMD_LEAVE_IBSS,
7373                 .doit = nl80211_leave_ibss,
7374                 .policy = nl80211_policy,
7375                 .flags = GENL_ADMIN_PERM,
7376                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7377                                   NL80211_FLAG_NEED_RTNL,
7378         },
7379 #ifdef CONFIG_NL80211_TESTMODE
7380         {
7381                 .cmd = NL80211_CMD_TESTMODE,
7382                 .doit = nl80211_testmode_do,
7383                 .dumpit = nl80211_testmode_dump,
7384                 .policy = nl80211_policy,
7385                 .flags = GENL_ADMIN_PERM,
7386                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7387                                   NL80211_FLAG_NEED_RTNL,
7388         },
7389 #endif
7390         {
7391                 .cmd = NL80211_CMD_CONNECT,
7392                 .doit = nl80211_connect,
7393                 .policy = nl80211_policy,
7394                 .flags = GENL_ADMIN_PERM,
7395                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7396                                   NL80211_FLAG_NEED_RTNL,
7397         },
7398         {
7399                 .cmd = NL80211_CMD_DISCONNECT,
7400                 .doit = nl80211_disconnect,
7401                 .policy = nl80211_policy,
7402                 .flags = GENL_ADMIN_PERM,
7403                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7404                                   NL80211_FLAG_NEED_RTNL,
7405         },
7406         {
7407                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
7408                 .doit = nl80211_wiphy_netns,
7409                 .policy = nl80211_policy,
7410                 .flags = GENL_ADMIN_PERM,
7411                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7412                                   NL80211_FLAG_NEED_RTNL,
7413         },
7414         {
7415                 .cmd = NL80211_CMD_GET_SURVEY,
7416                 .policy = nl80211_policy,
7417                 .dumpit = nl80211_dump_survey,
7418         },
7419         {
7420                 .cmd = NL80211_CMD_SET_PMKSA,
7421                 .doit = nl80211_setdel_pmksa,
7422                 .policy = nl80211_policy,
7423                 .flags = GENL_ADMIN_PERM,
7424                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7425                                   NL80211_FLAG_NEED_RTNL,
7426         },
7427         {
7428                 .cmd = NL80211_CMD_DEL_PMKSA,
7429                 .doit = nl80211_setdel_pmksa,
7430                 .policy = nl80211_policy,
7431                 .flags = GENL_ADMIN_PERM,
7432                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7433                                   NL80211_FLAG_NEED_RTNL,
7434         },
7435         {
7436                 .cmd = NL80211_CMD_FLUSH_PMKSA,
7437                 .doit = nl80211_flush_pmksa,
7438                 .policy = nl80211_policy,
7439                 .flags = GENL_ADMIN_PERM,
7440                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7441                                   NL80211_FLAG_NEED_RTNL,
7442         },
7443         {
7444                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
7445                 .doit = nl80211_remain_on_channel,
7446                 .policy = nl80211_policy,
7447                 .flags = GENL_ADMIN_PERM,
7448                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7449                                   NL80211_FLAG_NEED_RTNL,
7450         },
7451         {
7452                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
7453                 .doit = nl80211_cancel_remain_on_channel,
7454                 .policy = nl80211_policy,
7455                 .flags = GENL_ADMIN_PERM,
7456                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7457                                   NL80211_FLAG_NEED_RTNL,
7458         },
7459         {
7460                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
7461                 .doit = nl80211_set_tx_bitrate_mask,
7462                 .policy = nl80211_policy,
7463                 .flags = GENL_ADMIN_PERM,
7464                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7465                                   NL80211_FLAG_NEED_RTNL,
7466         },
7467         {
7468                 .cmd = NL80211_CMD_REGISTER_FRAME,
7469                 .doit = nl80211_register_mgmt,
7470                 .policy = nl80211_policy,
7471                 .flags = GENL_ADMIN_PERM,
7472                 .internal_flags = NL80211_FLAG_NEED_WDEV |
7473                                   NL80211_FLAG_NEED_RTNL,
7474         },
7475         {
7476                 .cmd = NL80211_CMD_FRAME,
7477                 .doit = nl80211_tx_mgmt,
7478                 .policy = nl80211_policy,
7479                 .flags = GENL_ADMIN_PERM,
7480                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7481                                   NL80211_FLAG_NEED_RTNL,
7482         },
7483         {
7484                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
7485                 .doit = nl80211_tx_mgmt_cancel_wait,
7486                 .policy = nl80211_policy,
7487                 .flags = GENL_ADMIN_PERM,
7488                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7489                                   NL80211_FLAG_NEED_RTNL,
7490         },
7491         {
7492                 .cmd = NL80211_CMD_SET_POWER_SAVE,
7493                 .doit = nl80211_set_power_save,
7494                 .policy = nl80211_policy,
7495                 .flags = GENL_ADMIN_PERM,
7496                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7497                                   NL80211_FLAG_NEED_RTNL,
7498         },
7499         {
7500                 .cmd = NL80211_CMD_GET_POWER_SAVE,
7501                 .doit = nl80211_get_power_save,
7502                 .policy = nl80211_policy,
7503                 /* can be retrieved by unprivileged users */
7504                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7505                                   NL80211_FLAG_NEED_RTNL,
7506         },
7507         {
7508                 .cmd = NL80211_CMD_SET_CQM,
7509                 .doit = nl80211_set_cqm,
7510                 .policy = nl80211_policy,
7511                 .flags = GENL_ADMIN_PERM,
7512                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7513                                   NL80211_FLAG_NEED_RTNL,
7514         },
7515         {
7516                 .cmd = NL80211_CMD_SET_CHANNEL,
7517                 .doit = nl80211_set_channel,
7518                 .policy = nl80211_policy,
7519                 .flags = GENL_ADMIN_PERM,
7520                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7521                                   NL80211_FLAG_NEED_RTNL,
7522         },
7523         {
7524                 .cmd = NL80211_CMD_SET_WDS_PEER,
7525                 .doit = nl80211_set_wds_peer,
7526                 .policy = nl80211_policy,
7527                 .flags = GENL_ADMIN_PERM,
7528                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7529                                   NL80211_FLAG_NEED_RTNL,
7530         },
7531         {
7532                 .cmd = NL80211_CMD_JOIN_MESH,
7533                 .doit = nl80211_join_mesh,
7534                 .policy = nl80211_policy,
7535                 .flags = GENL_ADMIN_PERM,
7536                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7537                                   NL80211_FLAG_NEED_RTNL,
7538         },
7539         {
7540                 .cmd = NL80211_CMD_LEAVE_MESH,
7541                 .doit = nl80211_leave_mesh,
7542                 .policy = nl80211_policy,
7543                 .flags = GENL_ADMIN_PERM,
7544                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7545                                   NL80211_FLAG_NEED_RTNL,
7546         },
7547 #ifdef CONFIG_PM
7548         {
7549                 .cmd = NL80211_CMD_GET_WOWLAN,
7550                 .doit = nl80211_get_wowlan,
7551                 .policy = nl80211_policy,
7552                 /* can be retrieved by unprivileged users */
7553                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7554                                   NL80211_FLAG_NEED_RTNL,
7555         },
7556         {
7557                 .cmd = NL80211_CMD_SET_WOWLAN,
7558                 .doit = nl80211_set_wowlan,
7559                 .policy = nl80211_policy,
7560                 .flags = GENL_ADMIN_PERM,
7561                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7562                                   NL80211_FLAG_NEED_RTNL,
7563         },
7564 #endif
7565         {
7566                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
7567                 .doit = nl80211_set_rekey_data,
7568                 .policy = nl80211_policy,
7569                 .flags = GENL_ADMIN_PERM,
7570                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7571                                   NL80211_FLAG_NEED_RTNL,
7572         },
7573         {
7574                 .cmd = NL80211_CMD_TDLS_MGMT,
7575                 .doit = nl80211_tdls_mgmt,
7576                 .policy = nl80211_policy,
7577                 .flags = GENL_ADMIN_PERM,
7578                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7579                                   NL80211_FLAG_NEED_RTNL,
7580         },
7581         {
7582                 .cmd = NL80211_CMD_TDLS_OPER,
7583                 .doit = nl80211_tdls_oper,
7584                 .policy = nl80211_policy,
7585                 .flags = GENL_ADMIN_PERM,
7586                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7587                                   NL80211_FLAG_NEED_RTNL,
7588         },
7589         {
7590                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
7591                 .doit = nl80211_register_unexpected_frame,
7592                 .policy = nl80211_policy,
7593                 .flags = GENL_ADMIN_PERM,
7594                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7595                                   NL80211_FLAG_NEED_RTNL,
7596         },
7597         {
7598                 .cmd = NL80211_CMD_PROBE_CLIENT,
7599                 .doit = nl80211_probe_client,
7600                 .policy = nl80211_policy,
7601                 .flags = GENL_ADMIN_PERM,
7602                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7603                                   NL80211_FLAG_NEED_RTNL,
7604         },
7605         {
7606                 .cmd = NL80211_CMD_REGISTER_BEACONS,
7607                 .doit = nl80211_register_beacons,
7608                 .policy = nl80211_policy,
7609                 .flags = GENL_ADMIN_PERM,
7610                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7611                                   NL80211_FLAG_NEED_RTNL,
7612         },
7613         {
7614                 .cmd = NL80211_CMD_SET_NOACK_MAP,
7615                 .doit = nl80211_set_noack_map,
7616                 .policy = nl80211_policy,
7617                 .flags = GENL_ADMIN_PERM,
7618                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7619                                   NL80211_FLAG_NEED_RTNL,
7620         },
7621         {
7622                 .cmd = NL80211_CMD_START_P2P_DEVICE,
7623                 .doit = nl80211_start_p2p_device,
7624                 .policy = nl80211_policy,
7625                 .flags = GENL_ADMIN_PERM,
7626                 .internal_flags = NL80211_FLAG_NEED_WDEV |
7627                                   NL80211_FLAG_NEED_RTNL,
7628         },
7629         {
7630                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
7631                 .doit = nl80211_stop_p2p_device,
7632                 .policy = nl80211_policy,
7633                 .flags = GENL_ADMIN_PERM,
7634                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7635                                   NL80211_FLAG_NEED_RTNL,
7636         },
7637 };
7638
7639 static struct genl_multicast_group nl80211_mlme_mcgrp = {
7640         .name = "mlme",
7641 };
7642
7643 /* multicast groups */
7644 static struct genl_multicast_group nl80211_config_mcgrp = {
7645         .name = "config",
7646 };
7647 static struct genl_multicast_group nl80211_scan_mcgrp = {
7648         .name = "scan",
7649 };
7650 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
7651         .name = "regulatory",
7652 };
7653
7654 /* notification functions */
7655
7656 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
7657 {
7658         struct sk_buff *msg;
7659
7660         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7661         if (!msg)
7662                 return;
7663
7664         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
7665                 nlmsg_free(msg);
7666                 return;
7667         }
7668
7669         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7670                                 nl80211_config_mcgrp.id, GFP_KERNEL);
7671 }
7672
7673 static int nl80211_add_scan_req(struct sk_buff *msg,
7674                                 struct cfg80211_registered_device *rdev)
7675 {
7676         struct cfg80211_scan_request *req = rdev->scan_req;
7677         struct nlattr *nest;
7678         int i;
7679
7680         ASSERT_RDEV_LOCK(rdev);
7681
7682         if (WARN_ON(!req))
7683                 return 0;
7684
7685         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
7686         if (!nest)
7687                 goto nla_put_failure;
7688         for (i = 0; i < req->n_ssids; i++) {
7689                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
7690                         goto nla_put_failure;
7691         }
7692         nla_nest_end(msg, nest);
7693
7694         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
7695         if (!nest)
7696                 goto nla_put_failure;
7697         for (i = 0; i < req->n_channels; i++) {
7698                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
7699                         goto nla_put_failure;
7700         }
7701         nla_nest_end(msg, nest);
7702
7703         if (req->ie &&
7704             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
7705                 goto nla_put_failure;
7706
7707         if (req->flags)
7708                 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags);
7709
7710         return 0;
7711  nla_put_failure:
7712         return -ENOBUFS;
7713 }
7714
7715 static int nl80211_send_scan_msg(struct sk_buff *msg,
7716                                  struct cfg80211_registered_device *rdev,
7717                                  struct wireless_dev *wdev,
7718                                  u32 portid, u32 seq, int flags,
7719                                  u32 cmd)
7720 {
7721         void *hdr;
7722
7723         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
7724         if (!hdr)
7725                 return -1;
7726
7727         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
7728             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
7729                                          wdev->netdev->ifindex)) ||
7730             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
7731                 goto nla_put_failure;
7732
7733         /* ignore errors and send incomplete event anyway */
7734         nl80211_add_scan_req(msg, rdev);
7735
7736         return genlmsg_end(msg, hdr);
7737
7738  nla_put_failure:
7739         genlmsg_cancel(msg, hdr);
7740         return -EMSGSIZE;
7741 }
7742
7743 static int
7744 nl80211_send_sched_scan_msg(struct sk_buff *msg,
7745                             struct cfg80211_registered_device *rdev,
7746                             struct net_device *netdev,
7747                             u32 portid, u32 seq, int flags, u32 cmd)
7748 {
7749         void *hdr;
7750
7751         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
7752         if (!hdr)
7753                 return -1;
7754
7755         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
7756             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
7757                 goto nla_put_failure;
7758
7759         return genlmsg_end(msg, hdr);
7760
7761  nla_put_failure:
7762         genlmsg_cancel(msg, hdr);
7763         return -EMSGSIZE;
7764 }
7765
7766 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
7767                              struct wireless_dev *wdev)
7768 {
7769         struct sk_buff *msg;
7770
7771         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7772         if (!msg)
7773                 return;
7774
7775         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
7776                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
7777                 nlmsg_free(msg);
7778                 return;
7779         }
7780
7781         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7782                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
7783 }
7784
7785 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
7786                             struct wireless_dev *wdev)
7787 {
7788         struct sk_buff *msg;
7789
7790         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7791         if (!msg)
7792                 return;
7793
7794         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
7795                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
7796                 nlmsg_free(msg);
7797                 return;
7798         }
7799
7800         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7801                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
7802 }
7803
7804 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
7805                                struct wireless_dev *wdev)
7806 {
7807         struct sk_buff *msg;
7808
7809         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7810         if (!msg)
7811                 return;
7812
7813         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
7814                                   NL80211_CMD_SCAN_ABORTED) < 0) {
7815                 nlmsg_free(msg);
7816                 return;
7817         }
7818
7819         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7820                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
7821 }
7822
7823 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
7824                                      struct net_device *netdev)
7825 {
7826         struct sk_buff *msg;
7827
7828         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7829         if (!msg)
7830                 return;
7831
7832         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
7833                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
7834                 nlmsg_free(msg);
7835                 return;
7836         }
7837
7838         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7839                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
7840 }
7841
7842 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
7843                              struct net_device *netdev, u32 cmd)
7844 {
7845         struct sk_buff *msg;
7846
7847         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7848         if (!msg)
7849                 return;
7850
7851         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
7852                 nlmsg_free(msg);
7853                 return;
7854         }
7855
7856         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7857                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
7858 }
7859
7860 /*
7861  * This can happen on global regulatory changes or device specific settings
7862  * based on custom world regulatory domains.
7863  */
7864 void nl80211_send_reg_change_event(struct regulatory_request *request)
7865 {
7866         struct sk_buff *msg;
7867         void *hdr;
7868
7869         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7870         if (!msg)
7871                 return;
7872
7873         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
7874         if (!hdr) {
7875                 nlmsg_free(msg);
7876                 return;
7877         }
7878
7879         /* Userspace can always count this one always being set */
7880         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
7881                 goto nla_put_failure;
7882
7883         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
7884                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
7885                                NL80211_REGDOM_TYPE_WORLD))
7886                         goto nla_put_failure;
7887         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
7888                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
7889                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
7890                         goto nla_put_failure;
7891         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
7892                    request->intersect) {
7893                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
7894                                NL80211_REGDOM_TYPE_INTERSECTION))
7895                         goto nla_put_failure;
7896         } else {
7897                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
7898                                NL80211_REGDOM_TYPE_COUNTRY) ||
7899                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
7900                                    request->alpha2))
7901                         goto nla_put_failure;
7902         }
7903
7904         if (wiphy_idx_valid(request->wiphy_idx) &&
7905             nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
7906                 goto nla_put_failure;
7907
7908         genlmsg_end(msg, hdr);
7909
7910         rcu_read_lock();
7911         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
7912                                 GFP_ATOMIC);
7913         rcu_read_unlock();
7914
7915         return;
7916
7917 nla_put_failure:
7918         genlmsg_cancel(msg, hdr);
7919         nlmsg_free(msg);
7920 }
7921
7922 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
7923                                     struct net_device *netdev,
7924                                     const u8 *buf, size_t len,
7925                                     enum nl80211_commands cmd, gfp_t gfp)
7926 {
7927         struct sk_buff *msg;
7928         void *hdr;
7929
7930         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
7931         if (!msg)
7932                 return;
7933
7934         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
7935         if (!hdr) {
7936                 nlmsg_free(msg);
7937                 return;
7938         }
7939
7940         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
7941             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
7942             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
7943                 goto nla_put_failure;
7944
7945         genlmsg_end(msg, hdr);
7946
7947         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7948                                 nl80211_mlme_mcgrp.id, gfp);
7949         return;
7950
7951  nla_put_failure:
7952         genlmsg_cancel(msg, hdr);
7953         nlmsg_free(msg);
7954 }
7955
7956 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
7957                           struct net_device *netdev, const u8 *buf,
7958                           size_t len, gfp_t gfp)
7959 {
7960         nl80211_send_mlme_event(rdev, netdev, buf, len,
7961                                 NL80211_CMD_AUTHENTICATE, gfp);
7962 }
7963
7964 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
7965                            struct net_device *netdev, const u8 *buf,
7966                            size_t len, gfp_t gfp)
7967 {
7968         nl80211_send_mlme_event(rdev, netdev, buf, len,
7969                                 NL80211_CMD_ASSOCIATE, gfp);
7970 }
7971
7972 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
7973                          struct net_device *netdev, const u8 *buf,
7974                          size_t len, gfp_t gfp)
7975 {
7976         nl80211_send_mlme_event(rdev, netdev, buf, len,
7977                                 NL80211_CMD_DEAUTHENTICATE, gfp);
7978 }
7979
7980 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
7981                            struct net_device *netdev, const u8 *buf,
7982                            size_t len, gfp_t gfp)
7983 {
7984         nl80211_send_mlme_event(rdev, netdev, buf, len,
7985                                 NL80211_CMD_DISASSOCIATE, gfp);
7986 }
7987
7988 void nl80211_send_unprot_deauth(struct cfg80211_registered_device *rdev,
7989                                 struct net_device *netdev, const u8 *buf,
7990                                 size_t len, gfp_t gfp)
7991 {
7992         nl80211_send_mlme_event(rdev, netdev, buf, len,
7993                                 NL80211_CMD_UNPROT_DEAUTHENTICATE, gfp);
7994 }
7995
7996 void nl80211_send_unprot_disassoc(struct cfg80211_registered_device *rdev,
7997                                   struct net_device *netdev, const u8 *buf,
7998                                   size_t len, gfp_t gfp)
7999 {
8000         nl80211_send_mlme_event(rdev, netdev, buf, len,
8001                                 NL80211_CMD_UNPROT_DISASSOCIATE, gfp);
8002 }
8003
8004 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
8005                                       struct net_device *netdev, int cmd,
8006                                       const u8 *addr, gfp_t gfp)
8007 {
8008         struct sk_buff *msg;
8009         void *hdr;
8010
8011         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8012         if (!msg)
8013                 return;
8014
8015         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
8016         if (!hdr) {
8017                 nlmsg_free(msg);
8018                 return;
8019         }
8020
8021         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8022             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8023             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
8024             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
8025                 goto nla_put_failure;
8026
8027         genlmsg_end(msg, hdr);
8028
8029         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8030                                 nl80211_mlme_mcgrp.id, gfp);
8031         return;
8032
8033  nla_put_failure:
8034         genlmsg_cancel(msg, hdr);
8035         nlmsg_free(msg);
8036 }
8037
8038 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
8039                                struct net_device *netdev, const u8 *addr,
8040                                gfp_t gfp)
8041 {
8042         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
8043                                   addr, gfp);
8044 }
8045
8046 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
8047                                 struct net_device *netdev, const u8 *addr,
8048                                 gfp_t gfp)
8049 {
8050         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
8051                                   addr, gfp);
8052 }
8053
8054 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
8055                                  struct net_device *netdev, const u8 *bssid,
8056                                  const u8 *req_ie, size_t req_ie_len,
8057                                  const u8 *resp_ie, size_t resp_ie_len,
8058                                  u16 status, gfp_t gfp)
8059 {
8060         struct sk_buff *msg;
8061         void *hdr;
8062
8063         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8064         if (!msg)
8065                 return;
8066
8067         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
8068         if (!hdr) {
8069                 nlmsg_free(msg);
8070                 return;
8071         }
8072
8073         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8074             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8075             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
8076             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
8077             (req_ie &&
8078              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
8079             (resp_ie &&
8080              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
8081                 goto nla_put_failure;
8082
8083         genlmsg_end(msg, hdr);
8084
8085         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8086                                 nl80211_mlme_mcgrp.id, gfp);
8087         return;
8088
8089  nla_put_failure:
8090         genlmsg_cancel(msg, hdr);
8091         nlmsg_free(msg);
8092
8093 }
8094
8095 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
8096                          struct net_device *netdev, const u8 *bssid,
8097                          const u8 *req_ie, size_t req_ie_len,
8098                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
8099 {
8100         struct sk_buff *msg;
8101         void *hdr;
8102
8103         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8104         if (!msg)
8105                 return;
8106
8107         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
8108         if (!hdr) {
8109                 nlmsg_free(msg);
8110                 return;
8111         }
8112
8113         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8114             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8115             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
8116             (req_ie &&
8117              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
8118             (resp_ie &&
8119              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
8120                 goto nla_put_failure;
8121
8122         genlmsg_end(msg, hdr);
8123
8124         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8125                                 nl80211_mlme_mcgrp.id, gfp);
8126         return;
8127
8128  nla_put_failure:
8129         genlmsg_cancel(msg, hdr);
8130         nlmsg_free(msg);
8131
8132 }
8133
8134 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
8135                                struct net_device *netdev, u16 reason,
8136                                const u8 *ie, size_t ie_len, bool from_ap)
8137 {
8138         struct sk_buff *msg;
8139         void *hdr;
8140
8141         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8142         if (!msg)
8143                 return;
8144
8145         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
8146         if (!hdr) {
8147                 nlmsg_free(msg);
8148                 return;
8149         }
8150
8151         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8152             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8153             (from_ap && reason &&
8154              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
8155             (from_ap &&
8156              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
8157             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
8158                 goto nla_put_failure;
8159
8160         genlmsg_end(msg, hdr);
8161
8162         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8163                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
8164         return;
8165
8166  nla_put_failure:
8167         genlmsg_cancel(msg, hdr);
8168         nlmsg_free(msg);
8169
8170 }
8171
8172 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
8173                              struct net_device *netdev, const u8 *bssid,
8174                              gfp_t gfp)
8175 {
8176         struct sk_buff *msg;
8177         void *hdr;
8178
8179         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8180         if (!msg)
8181                 return;
8182
8183         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
8184         if (!hdr) {
8185                 nlmsg_free(msg);
8186                 return;
8187         }
8188
8189         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8190             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8191             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
8192                 goto nla_put_failure;
8193
8194         genlmsg_end(msg, hdr);
8195
8196         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8197                                 nl80211_mlme_mcgrp.id, gfp);
8198         return;
8199
8200  nla_put_failure:
8201         genlmsg_cancel(msg, hdr);
8202         nlmsg_free(msg);
8203 }
8204
8205 void nl80211_send_new_peer_candidate(struct cfg80211_registered_device *rdev,
8206                 struct net_device *netdev,
8207                 const u8 *macaddr, const u8* ie, u8 ie_len,
8208                 gfp_t gfp)
8209 {
8210         struct sk_buff *msg;
8211         void *hdr;
8212
8213         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8214         if (!msg)
8215                 return;
8216
8217         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
8218         if (!hdr) {
8219                 nlmsg_free(msg);
8220                 return;
8221         }
8222
8223         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8224             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8225             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, macaddr) ||
8226             (ie_len && ie &&
8227              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
8228                 goto nla_put_failure;
8229
8230         genlmsg_end(msg, hdr);
8231
8232         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8233                                 nl80211_mlme_mcgrp.id, gfp);
8234         return;
8235
8236  nla_put_failure:
8237         genlmsg_cancel(msg, hdr);
8238         nlmsg_free(msg);
8239 }
8240
8241 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
8242                                  struct net_device *netdev, const u8 *addr,
8243                                  enum nl80211_key_type key_type, int key_id,
8244                                  const u8 *tsc, gfp_t gfp)
8245 {
8246         struct sk_buff *msg;
8247         void *hdr;
8248
8249         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8250         if (!msg)
8251                 return;
8252
8253         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
8254         if (!hdr) {
8255                 nlmsg_free(msg);
8256                 return;
8257         }
8258
8259         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8260             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8261             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
8262             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
8263             (key_id != -1 &&
8264              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
8265             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
8266                 goto nla_put_failure;
8267
8268         genlmsg_end(msg, hdr);
8269
8270         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8271                                 nl80211_mlme_mcgrp.id, gfp);
8272         return;
8273
8274  nla_put_failure:
8275         genlmsg_cancel(msg, hdr);
8276         nlmsg_free(msg);
8277 }
8278
8279 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
8280                                     struct ieee80211_channel *channel_before,
8281                                     struct ieee80211_channel *channel_after)
8282 {
8283         struct sk_buff *msg;
8284         void *hdr;
8285         struct nlattr *nl_freq;
8286
8287         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
8288         if (!msg)
8289                 return;
8290
8291         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
8292         if (!hdr) {
8293                 nlmsg_free(msg);
8294                 return;
8295         }
8296
8297         /*
8298          * Since we are applying the beacon hint to a wiphy we know its
8299          * wiphy_idx is valid
8300          */
8301         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
8302                 goto nla_put_failure;
8303
8304         /* Before */
8305         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
8306         if (!nl_freq)
8307                 goto nla_put_failure;
8308         if (nl80211_msg_put_channel(msg, channel_before))
8309                 goto nla_put_failure;
8310         nla_nest_end(msg, nl_freq);
8311
8312         /* After */
8313         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
8314         if (!nl_freq)
8315                 goto nla_put_failure;
8316         if (nl80211_msg_put_channel(msg, channel_after))
8317                 goto nla_put_failure;
8318         nla_nest_end(msg, nl_freq);
8319
8320         genlmsg_end(msg, hdr);
8321
8322         rcu_read_lock();
8323         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
8324                                 GFP_ATOMIC);
8325         rcu_read_unlock();
8326
8327         return;
8328
8329 nla_put_failure:
8330         genlmsg_cancel(msg, hdr);
8331         nlmsg_free(msg);
8332 }
8333
8334 static void nl80211_send_remain_on_chan_event(
8335         int cmd, struct cfg80211_registered_device *rdev,
8336         struct wireless_dev *wdev, u64 cookie,
8337         struct ieee80211_channel *chan,
8338         enum nl80211_channel_type channel_type,
8339         unsigned int duration, gfp_t gfp)
8340 {
8341         struct sk_buff *msg;
8342         void *hdr;
8343
8344         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8345         if (!msg)
8346                 return;
8347
8348         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
8349         if (!hdr) {
8350                 nlmsg_free(msg);
8351                 return;
8352         }
8353
8354         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8355             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
8356                                          wdev->netdev->ifindex)) ||
8357             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
8358             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
8359             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, channel_type) ||
8360             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8361                 goto nla_put_failure;
8362
8363         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
8364             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
8365                 goto nla_put_failure;
8366
8367         genlmsg_end(msg, hdr);
8368
8369         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8370                                 nl80211_mlme_mcgrp.id, gfp);
8371         return;
8372
8373  nla_put_failure:
8374         genlmsg_cancel(msg, hdr);
8375         nlmsg_free(msg);
8376 }
8377
8378 void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
8379                                     struct wireless_dev *wdev, u64 cookie,
8380                                     struct ieee80211_channel *chan,
8381                                     enum nl80211_channel_type channel_type,
8382                                     unsigned int duration, gfp_t gfp)
8383 {
8384         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
8385                                           rdev, wdev, cookie, chan,
8386                                           channel_type, duration, gfp);
8387 }
8388
8389 void nl80211_send_remain_on_channel_cancel(
8390         struct cfg80211_registered_device *rdev,
8391         struct wireless_dev *wdev,
8392         u64 cookie, struct ieee80211_channel *chan,
8393         enum nl80211_channel_type channel_type, gfp_t gfp)
8394 {
8395         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
8396                                           rdev, wdev, cookie, chan,
8397                                           channel_type, 0, gfp);
8398 }
8399
8400 void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
8401                             struct net_device *dev, const u8 *mac_addr,
8402                             struct station_info *sinfo, gfp_t gfp)
8403 {
8404         struct sk_buff *msg;
8405
8406         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8407         if (!msg)
8408                 return;
8409
8410         if (nl80211_send_station(msg, 0, 0, 0,
8411                                  rdev, dev, mac_addr, sinfo) < 0) {
8412                 nlmsg_free(msg);
8413                 return;
8414         }
8415
8416         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8417                                 nl80211_mlme_mcgrp.id, gfp);
8418 }
8419
8420 void nl80211_send_sta_del_event(struct cfg80211_registered_device *rdev,
8421                                 struct net_device *dev, const u8 *mac_addr,
8422                                 gfp_t gfp)
8423 {
8424         struct sk_buff *msg;
8425         void *hdr;
8426
8427         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8428         if (!msg)
8429                 return;
8430
8431         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
8432         if (!hdr) {
8433                 nlmsg_free(msg);
8434                 return;
8435         }
8436
8437         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8438             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
8439                 goto nla_put_failure;
8440
8441         genlmsg_end(msg, hdr);
8442
8443         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8444                                 nl80211_mlme_mcgrp.id, gfp);
8445         return;
8446
8447  nla_put_failure:
8448         genlmsg_cancel(msg, hdr);
8449         nlmsg_free(msg);
8450 }
8451
8452 void nl80211_send_conn_failed_event(struct cfg80211_registered_device *rdev,
8453                                     struct net_device *dev, const u8 *mac_addr,
8454                                     enum nl80211_connect_failed_reason reason,
8455                                     gfp_t gfp)
8456 {
8457         struct sk_buff *msg;
8458         void *hdr;
8459
8460         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
8461         if (!msg)
8462                 return;
8463
8464         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
8465         if (!hdr) {
8466                 nlmsg_free(msg);
8467                 return;
8468         }
8469
8470         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8471             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
8472             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
8473                 goto nla_put_failure;
8474
8475         genlmsg_end(msg, hdr);
8476
8477         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8478                                 nl80211_mlme_mcgrp.id, gfp);
8479         return;
8480
8481  nla_put_failure:
8482         genlmsg_cancel(msg, hdr);
8483         nlmsg_free(msg);
8484 }
8485
8486 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
8487                                        const u8 *addr, gfp_t gfp)
8488 {
8489         struct wireless_dev *wdev = dev->ieee80211_ptr;
8490         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
8491         struct sk_buff *msg;
8492         void *hdr;
8493         int err;
8494         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
8495
8496         if (!nlportid)
8497                 return false;
8498
8499         msg = nlmsg_new(100, gfp);
8500         if (!msg)
8501                 return true;
8502
8503         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
8504         if (!hdr) {
8505                 nlmsg_free(msg);
8506                 return true;
8507         }
8508
8509         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8510             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8511             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
8512                 goto nla_put_failure;
8513
8514         err = genlmsg_end(msg, hdr);
8515         if (err < 0) {
8516                 nlmsg_free(msg);
8517                 return true;
8518         }
8519
8520         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
8521         return true;
8522
8523  nla_put_failure:
8524         genlmsg_cancel(msg, hdr);
8525         nlmsg_free(msg);
8526         return true;
8527 }
8528
8529 bool nl80211_unexpected_frame(struct net_device *dev, const u8 *addr, gfp_t gfp)
8530 {
8531         return __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
8532                                           addr, gfp);
8533 }
8534
8535 bool nl80211_unexpected_4addr_frame(struct net_device *dev,
8536                                     const u8 *addr, gfp_t gfp)
8537 {
8538         return __nl80211_unexpected_frame(dev,
8539                                           NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
8540                                           addr, gfp);
8541 }
8542
8543 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
8544                       struct wireless_dev *wdev, u32 nlportid,
8545                       int freq, int sig_dbm,
8546                       const u8 *buf, size_t len, gfp_t gfp)
8547 {
8548         struct net_device *netdev = wdev->netdev;
8549         struct sk_buff *msg;
8550         void *hdr;
8551
8552         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8553         if (!msg)
8554                 return -ENOMEM;
8555
8556         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
8557         if (!hdr) {
8558                 nlmsg_free(msg);
8559                 return -ENOMEM;
8560         }
8561
8562         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8563             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
8564                                         netdev->ifindex)) ||
8565             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
8566             (sig_dbm &&
8567              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
8568             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
8569                 goto nla_put_failure;
8570
8571         genlmsg_end(msg, hdr);
8572
8573         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
8574
8575  nla_put_failure:
8576         genlmsg_cancel(msg, hdr);
8577         nlmsg_free(msg);
8578         return -ENOBUFS;
8579 }
8580
8581 void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
8582                                  struct wireless_dev *wdev, u64 cookie,
8583                                  const u8 *buf, size_t len, bool ack,
8584                                  gfp_t gfp)
8585 {
8586         struct net_device *netdev = wdev->netdev;
8587         struct sk_buff *msg;
8588         void *hdr;
8589
8590         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8591         if (!msg)
8592                 return;
8593
8594         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
8595         if (!hdr) {
8596                 nlmsg_free(msg);
8597                 return;
8598         }
8599
8600         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8601             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
8602                                    netdev->ifindex)) ||
8603             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
8604             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
8605             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
8606                 goto nla_put_failure;
8607
8608         genlmsg_end(msg, hdr);
8609
8610         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
8611         return;
8612
8613  nla_put_failure:
8614         genlmsg_cancel(msg, hdr);
8615         nlmsg_free(msg);
8616 }
8617
8618 void
8619 nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
8620                              struct net_device *netdev,
8621                              enum nl80211_cqm_rssi_threshold_event rssi_event,
8622                              gfp_t gfp)
8623 {
8624         struct sk_buff *msg;
8625         struct nlattr *pinfoattr;
8626         void *hdr;
8627
8628         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8629         if (!msg)
8630                 return;
8631
8632         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
8633         if (!hdr) {
8634                 nlmsg_free(msg);
8635                 return;
8636         }
8637
8638         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8639             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
8640                 goto nla_put_failure;
8641
8642         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
8643         if (!pinfoattr)
8644                 goto nla_put_failure;
8645
8646         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
8647                         rssi_event))
8648                 goto nla_put_failure;
8649
8650         nla_nest_end(msg, pinfoattr);
8651
8652         genlmsg_end(msg, hdr);
8653
8654         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8655                                 nl80211_mlme_mcgrp.id, gfp);
8656         return;
8657
8658  nla_put_failure:
8659         genlmsg_cancel(msg, hdr);
8660         nlmsg_free(msg);
8661 }
8662
8663 void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
8664                               struct net_device *netdev, const u8 *bssid,
8665                               const u8 *replay_ctr, gfp_t gfp)
8666 {
8667         struct sk_buff *msg;
8668         struct nlattr *rekey_attr;
8669         void *hdr;
8670
8671         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8672         if (!msg)
8673                 return;
8674
8675         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
8676         if (!hdr) {
8677                 nlmsg_free(msg);
8678                 return;
8679         }
8680
8681         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8682             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8683             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
8684                 goto nla_put_failure;
8685
8686         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
8687         if (!rekey_attr)
8688                 goto nla_put_failure;
8689
8690         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
8691                     NL80211_REPLAY_CTR_LEN, replay_ctr))
8692                 goto nla_put_failure;
8693
8694         nla_nest_end(msg, rekey_attr);
8695
8696         genlmsg_end(msg, hdr);
8697
8698         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8699                                 nl80211_mlme_mcgrp.id, gfp);
8700         return;
8701
8702  nla_put_failure:
8703         genlmsg_cancel(msg, hdr);
8704         nlmsg_free(msg);
8705 }
8706
8707 void nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
8708                                     struct net_device *netdev, int index,
8709                                     const u8 *bssid, bool preauth, gfp_t gfp)
8710 {
8711         struct sk_buff *msg;
8712         struct nlattr *attr;
8713         void *hdr;
8714
8715         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8716         if (!msg)
8717                 return;
8718
8719         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
8720         if (!hdr) {
8721                 nlmsg_free(msg);
8722                 return;
8723         }
8724
8725         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8726             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
8727                 goto nla_put_failure;
8728
8729         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
8730         if (!attr)
8731                 goto nla_put_failure;
8732
8733         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
8734             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
8735             (preauth &&
8736              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
8737                 goto nla_put_failure;
8738
8739         nla_nest_end(msg, attr);
8740
8741         genlmsg_end(msg, hdr);
8742
8743         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8744                                 nl80211_mlme_mcgrp.id, gfp);
8745         return;
8746
8747  nla_put_failure:
8748         genlmsg_cancel(msg, hdr);
8749         nlmsg_free(msg);
8750 }
8751
8752 void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
8753                               struct net_device *netdev, int freq,
8754                               enum nl80211_channel_type type, gfp_t gfp)
8755 {
8756         struct sk_buff *msg;
8757         void *hdr;
8758
8759         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8760         if (!msg)
8761                 return;
8762
8763         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
8764         if (!hdr) {
8765                 nlmsg_free(msg);
8766                 return;
8767         }
8768
8769         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8770             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
8771             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, type))
8772                 goto nla_put_failure;
8773
8774         genlmsg_end(msg, hdr);
8775
8776         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8777                                 nl80211_mlme_mcgrp.id, gfp);
8778         return;
8779
8780  nla_put_failure:
8781         genlmsg_cancel(msg, hdr);
8782         nlmsg_free(msg);
8783 }
8784
8785 void
8786 nl80211_send_cqm_txe_notify(struct cfg80211_registered_device *rdev,
8787                             struct net_device *netdev, const u8 *peer,
8788                             u32 num_packets, u32 rate, u32 intvl, gfp_t gfp)
8789 {
8790         struct sk_buff *msg;
8791         struct nlattr *pinfoattr;
8792         void *hdr;
8793
8794         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
8795         if (!msg)
8796                 return;
8797
8798         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
8799         if (!hdr) {
8800                 nlmsg_free(msg);
8801                 return;
8802         }
8803
8804         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8805             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8806             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
8807                 goto nla_put_failure;
8808
8809         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
8810         if (!pinfoattr)
8811                 goto nla_put_failure;
8812
8813         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
8814                 goto nla_put_failure;
8815
8816         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
8817                 goto nla_put_failure;
8818
8819         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
8820                 goto nla_put_failure;
8821
8822         nla_nest_end(msg, pinfoattr);
8823
8824         genlmsg_end(msg, hdr);
8825
8826         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8827                                 nl80211_mlme_mcgrp.id, gfp);
8828         return;
8829
8830  nla_put_failure:
8831         genlmsg_cancel(msg, hdr);
8832         nlmsg_free(msg);
8833 }
8834
8835 void
8836 nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
8837                                 struct net_device *netdev, const u8 *peer,
8838                                 u32 num_packets, gfp_t gfp)
8839 {
8840         struct sk_buff *msg;
8841         struct nlattr *pinfoattr;
8842         void *hdr;
8843
8844         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8845         if (!msg)
8846                 return;
8847
8848         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
8849         if (!hdr) {
8850                 nlmsg_free(msg);
8851                 return;
8852         }
8853
8854         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8855             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8856             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
8857                 goto nla_put_failure;
8858
8859         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
8860         if (!pinfoattr)
8861                 goto nla_put_failure;
8862
8863         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
8864                 goto nla_put_failure;
8865
8866         nla_nest_end(msg, pinfoattr);
8867
8868         genlmsg_end(msg, hdr);
8869
8870         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8871                                 nl80211_mlme_mcgrp.id, gfp);
8872         return;
8873
8874  nla_put_failure:
8875         genlmsg_cancel(msg, hdr);
8876         nlmsg_free(msg);
8877 }
8878
8879 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
8880                            u64 cookie, bool acked, gfp_t gfp)
8881 {
8882         struct wireless_dev *wdev = dev->ieee80211_ptr;
8883         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
8884         struct sk_buff *msg;
8885         void *hdr;
8886         int err;
8887
8888         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8889         if (!msg)
8890                 return;
8891
8892         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
8893         if (!hdr) {
8894                 nlmsg_free(msg);
8895                 return;
8896         }
8897
8898         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8899             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8900             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
8901             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
8902             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
8903                 goto nla_put_failure;
8904
8905         err = genlmsg_end(msg, hdr);
8906         if (err < 0) {
8907                 nlmsg_free(msg);
8908                 return;
8909         }
8910
8911         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8912                                 nl80211_mlme_mcgrp.id, gfp);
8913         return;
8914
8915  nla_put_failure:
8916         genlmsg_cancel(msg, hdr);
8917         nlmsg_free(msg);
8918 }
8919 EXPORT_SYMBOL(cfg80211_probe_status);
8920
8921 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
8922                                  const u8 *frame, size_t len,
8923                                  int freq, int sig_dbm, gfp_t gfp)
8924 {
8925         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
8926         struct sk_buff *msg;
8927         void *hdr;
8928         u32 nlportid = ACCESS_ONCE(rdev->ap_beacons_nlportid);
8929
8930         if (!nlportid)
8931                 return;
8932
8933         msg = nlmsg_new(len + 100, gfp);
8934         if (!msg)
8935                 return;
8936
8937         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
8938         if (!hdr) {
8939                 nlmsg_free(msg);
8940                 return;
8941         }
8942
8943         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8944             (freq &&
8945              nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
8946             (sig_dbm &&
8947              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
8948             nla_put(msg, NL80211_ATTR_FRAME, len, frame))
8949                 goto nla_put_failure;
8950
8951         genlmsg_end(msg, hdr);
8952
8953         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
8954         return;
8955
8956  nla_put_failure:
8957         genlmsg_cancel(msg, hdr);
8958         nlmsg_free(msg);
8959 }
8960 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
8961
8962 static int nl80211_netlink_notify(struct notifier_block * nb,
8963                                   unsigned long state,
8964                                   void *_notify)
8965 {
8966         struct netlink_notify *notify = _notify;
8967         struct cfg80211_registered_device *rdev;
8968         struct wireless_dev *wdev;
8969
8970         if (state != NETLINK_URELEASE)
8971                 return NOTIFY_DONE;
8972
8973         rcu_read_lock();
8974
8975         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
8976                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list)
8977                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
8978                 if (rdev->ap_beacons_nlportid == notify->portid)
8979                         rdev->ap_beacons_nlportid = 0;
8980         }
8981
8982         rcu_read_unlock();
8983
8984         return NOTIFY_DONE;
8985 }
8986
8987 static struct notifier_block nl80211_netlink_notifier = {
8988         .notifier_call = nl80211_netlink_notify,
8989 };
8990
8991 /* initialisation/exit functions */
8992
8993 int nl80211_init(void)
8994 {
8995         int err;
8996
8997         err = genl_register_family_with_ops(&nl80211_fam,
8998                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
8999         if (err)
9000                 return err;
9001
9002         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
9003         if (err)
9004                 goto err_out;
9005
9006         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
9007         if (err)
9008                 goto err_out;
9009
9010         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
9011         if (err)
9012                 goto err_out;
9013
9014         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
9015         if (err)
9016                 goto err_out;
9017
9018 #ifdef CONFIG_NL80211_TESTMODE
9019         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
9020         if (err)
9021                 goto err_out;
9022 #endif
9023
9024         err = netlink_register_notifier(&nl80211_netlink_notifier);
9025         if (err)
9026                 goto err_out;
9027
9028         return 0;
9029  err_out:
9030         genl_unregister_family(&nl80211_fam);
9031         return err;
9032 }
9033
9034 void nl80211_exit(void)
9035 {
9036         netlink_unregister_notifier(&nl80211_netlink_notifier);
9037         genl_unregister_family(&nl80211_fam);
9038 }