net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include <net/inet_connection_sock.h>
  23 #include "core.h"
  24 #include "nl80211.h"
  25 #include "reg.h"
  26 #include "rdev-ops.h"
  27
  28 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  29                                    struct genl_info *info,
  30                                    struct cfg80211_crypto_settings *settings,
  31                                    int cipher_limit);
  32
  33 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
  34                             struct genl_info *info);
  35 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
  36                               struct genl_info *info);
  37
  38 /* the netlink family */
  39 static struct genl_family nl80211_fam = {
  40         .id = GENL_ID_GENERATE,         /* don't bother with a hardcoded ID */
  41         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
  42         .hdrsize = 0,                   /* no private header */
  43         .version = 1,                   /* no particular meaning now */
  44         .maxattr = NL80211_ATTR_MAX,
  45         .netnsok = true,
  46         .pre_doit = nl80211_pre_doit,
  47         .post_doit = nl80211_post_doit,
  48 };
  49
  50 /* returns ERR_PTR values */
  51 static struct wireless_dev *
  52 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  53 {
  54         struct cfg80211_registered_device *rdev;
  55         struct wireless_dev *result = NULL;
  56         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  57         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  58         u64 wdev_id;
  59         int wiphy_idx = -1;
  60         int ifidx = -1;
  61
  62         ASSERT_RTNL();
  63
  64         if (!have_ifidx && !have_wdev_id)
  65                 return ERR_PTR(-EINVAL);
  66
  67         if (have_ifidx)
  68                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  69         if (have_wdev_id) {
  70                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  71                 wiphy_idx = wdev_id >> 32;
  72         }
  73
  74         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  75                 struct wireless_dev *wdev;
  76
  77                 if (wiphy_net(&rdev->wiphy) != netns)
  78                         continue;
  79
  80                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  81                         continue;
  82
  83                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
  84                         if (have_ifidx && wdev->netdev &&
  85                             wdev->netdev->ifindex == ifidx) {
  86                                 result = wdev;
  87                                 break;
  88                         }
  89                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
  90                                 result = wdev;
  91                                 break;
  92                         }
  93                 }
  94
  95                 if (result)
  96                         break;
  97         }
  98
  99         if (result)
 100                 return result;
 101         return ERR_PTR(-ENODEV);
 102 }
 103
 104 static struct cfg80211_registered_device *
 105 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 106 {
 107         struct cfg80211_registered_device *rdev = NULL, *tmp;
 108         struct net_device *netdev;
 109
 110         ASSERT_RTNL();
 111
 112         if (!attrs[NL80211_ATTR_WIPHY] &&
 113             !attrs[NL80211_ATTR_IFINDEX] &&
 114             !attrs[NL80211_ATTR_WDEV])
 115                 return ERR_PTR(-EINVAL);
 116
 117         if (attrs[NL80211_ATTR_WIPHY])
 118                 rdev = cfg80211_rdev_by_wiphy_idx(
 119                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 120
 121         if (attrs[NL80211_ATTR_WDEV]) {
 122                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 123                 struct wireless_dev *wdev;
 124                 bool found = false;
 125
 126                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 127                 if (tmp) {
 128                         /* make sure wdev exists */
 129                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 130                                 if (wdev->identifier != (u32)wdev_id)
 131                                         continue;
 132                                 found = true;
 133                                 break;
 134                         }
 135
 136                         if (!found)
 137                                 tmp = NULL;
 138
 139                         if (rdev && tmp != rdev)
 140                                 return ERR_PTR(-EINVAL);
 141                         rdev = tmp;
 142                 }
 143         }
 144
 145         if (attrs[NL80211_ATTR_IFINDEX]) {
 146                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 147                 netdev = dev_get_by_index(netns, ifindex);
 148                 if (netdev) {
 149                         if (netdev->ieee80211_ptr)
 150                                 tmp = wiphy_to_dev(
 151                                                 netdev->ieee80211_ptr->wiphy);
 152                         else
 153                                 tmp = NULL;
 154
 155                         dev_put(netdev);
 156
 157                         /* not wireless device -- return error */
 158                         if (!tmp)
 159                                 return ERR_PTR(-EINVAL);
 160
 161                         /* mismatch -- return error */
 162                         if (rdev && tmp != rdev)
 163                                 return ERR_PTR(-EINVAL);
 164
 165                         rdev = tmp;
 166                 }
 167         }
 168
 169         if (!rdev)
 170                 return ERR_PTR(-ENODEV);
 171
 172         if (netns != wiphy_net(&rdev->wiphy))
 173                 return ERR_PTR(-ENODEV);
 174
 175         return rdev;
 176 }
 177
 178 /*
 179  * This function returns a pointer to the driver
 180  * that the genl_info item that is passed refers to.
 181  *
 182  * The result of this can be a PTR_ERR and hence must
 183  * be checked with IS_ERR() for errors.
 184  */
 185 static struct cfg80211_registered_device *
 186 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 187 {
 188         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 189 }
 190
 191 /* policy for the attributes */
 192 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
 193         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 194         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 195                                       .len = 20-1 },
 196         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 197
 198         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 199         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 200         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 201         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 202         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 203
 204         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 205         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 206         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 207         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 208         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 209
 210         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 211         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 212         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 213
 214         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 215         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 216
 217         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 218         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 219                                     .len = WLAN_MAX_KEY_LEN },
 220         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 221         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 222         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 223         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 224         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 225
 226         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 227         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 228         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 229                                        .len = IEEE80211_MAX_DATA_LEN },
 230         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 231                                        .len = IEEE80211_MAX_DATA_LEN },
 232         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 233         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 234         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 235         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 236                                                .len = NL80211_MAX_SUPP_RATES },
 237         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 238         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 239         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 240         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 241                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 242         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 243
 244         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 245         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 246
 247         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 248         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 249         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 250         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 251                                            .len = NL80211_MAX_SUPP_RATES },
 252         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 253
 254         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 255         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 256
 257         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 258
 259         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 260         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 261                               .len = IEEE80211_MAX_DATA_LEN },
 262         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 263         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 264
 265         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 266                                 .len = IEEE80211_MAX_SSID_LEN },
 267         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 268         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 269         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 270         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 271         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 272         [NL80211_ATTR_STA_FLAGS2] = {
 273                 .len = sizeof(struct nl80211_sta_flag_update),
 274         },
 275         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 276         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 277         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 278         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 279         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 280         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 281         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 282         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 283         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 284                                  .len = WLAN_PMKID_LEN },
 285         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 286         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 287         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 288         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 289                                  .len = IEEE80211_MAX_DATA_LEN },
 290         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 291         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 292         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 293         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 294         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 295         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 296         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 297         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 298         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 299         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 300         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 301         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 302         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 303         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 304         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 305         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 306         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 307         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 308         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 309         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 310                                          .len = IEEE80211_MAX_DATA_LEN },
 311         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 312                                          .len = IEEE80211_MAX_DATA_LEN },
 313         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 314         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 315         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 316         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 317         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 318         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 319         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 320         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 321         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 322         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 323                                       .len = IEEE80211_MAX_DATA_LEN },
 324         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 325         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 326         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 327                 .len = NL80211_HT_CAPABILITY_LEN
 328         },
 329         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 330         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 331         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 332         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 333         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 334         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 335         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 336         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 337         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 338         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 339         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 340         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 341         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 342         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 343         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 344         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 345         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 346                 .len = NL80211_VHT_CAPABILITY_LEN,
 347         },
 348         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 349         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 350                                   .len = IEEE80211_MAX_DATA_LEN },
 351         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 352 };
 353
 354 /* policy for the key attributes */
 355 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 356         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 357         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 358         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 359         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 360         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 361         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 362         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 363         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 364 };
 365
 366 /* policy for the key default flags */
 367 static const struct nla_policy
 368 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 369         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 370         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 371 };
 372
 373 /* policy for WoWLAN attributes */
 374 static const struct nla_policy
 375 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 376         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 377         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 378         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 379         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 380         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 381         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 382         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 383         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 384         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 385 };
 386
 387 static const struct nla_policy
 388 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 389         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 390         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 391         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 392         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 393         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 394         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 395         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 396                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 397         },
 398         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 399                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 400         },
 401         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 402         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 403         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 404 };
 405
 406 /* policy for coalesce rule attributes */
 407 static const struct nla_policy
 408 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 409         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 410         [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
 411         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 412 };
 413
 414 /* policy for GTK rekey offload attributes */
 415 static const struct nla_policy
 416 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 417         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 418         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 419         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 420 };
 421
 422 static const struct nla_policy
 423 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 424         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 425                                                  .len = IEEE80211_MAX_SSID_LEN },
 426         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 427 };
 428
 429 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 430                                      struct netlink_callback *cb,
 431                                      struct cfg80211_registered_device **rdev,
 432                                      struct wireless_dev **wdev)
 433 {
 434         int err;
 435
 436         rtnl_lock();
 437
 438         if (!cb->args[0]) {
 439                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 440                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
 441                                   nl80211_policy);
 442                 if (err)
 443                         goto out_unlock;
 444
 445                 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
 446                                                    nl80211_fam.attrbuf);
 447                 if (IS_ERR(*wdev)) {
 448                         err = PTR_ERR(*wdev);
 449                         goto out_unlock;
 450                 }
 451                 *rdev = wiphy_to_dev((*wdev)->wiphy);
 452                 /* 0 is the first index - add 1 to parse only once */
 453                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 454                 cb->args[1] = (*wdev)->identifier;
 455         } else {
 456                 /* subtract the 1 again here */
 457                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 458                 struct wireless_dev *tmp;
 459
 460                 if (!wiphy) {
 461                         err = -ENODEV;
 462                         goto out_unlock;
 463                 }
 464                 *rdev = wiphy_to_dev(wiphy);
 465                 *wdev = NULL;
 466
 467                 list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
 468                         if (tmp->identifier == cb->args[1]) {
 469                                 *wdev = tmp;
 470                                 break;
 471                         }
 472                 }
 473
 474                 if (!*wdev) {
 475                         err = -ENODEV;
 476                         goto out_unlock;
 477                 }
 478         }
 479
 480         return 0;
 481  out_unlock:
 482         rtnl_unlock();
 483         return err;
 484 }
 485
 486 static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
 487 {
 488         rtnl_unlock();
 489 }
 490
 491 /* IE validation */
 492 static bool is_valid_ie_attr(const struct nlattr *attr)
 493 {
 494         const u8 *pos;
 495         int len;
 496
 497         if (!attr)
 498                 return true;
 499
 500         pos = nla_data(attr);
 501         len = nla_len(attr);
 502
 503         while (len) {
 504                 u8 elemlen;
 505
 506                 if (len < 2)
 507                         return false;
 508                 len -= 2;
 509
 510                 elemlen = pos[1];
 511                 if (elemlen > len)
 512                         return false;
 513
 514                 len -= elemlen;
 515                 pos += 2 + elemlen;
 516         }
 517
 518         return true;
 519 }
 520
 521 /* message building helper */
 522 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 523                                    int flags, u8 cmd)
 524 {
 525         /* since there is no private header just add the generic one */
 526         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 527 }
 528
 529 static int nl80211_msg_put_channel(struct sk_buff *msg,
 530                                    struct ieee80211_channel *chan,
 531                                    bool large)
 532 {
 533         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 534                         chan->center_freq))
 535                 goto nla_put_failure;
 536
 537         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 538             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 539                 goto nla_put_failure;
 540         if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
 541             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN))
 542                 goto nla_put_failure;
 543         if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
 544             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IBSS))
 545                 goto nla_put_failure;
 546         if (chan->flags & IEEE80211_CHAN_RADAR) {
 547                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 548                         goto nla_put_failure;
 549                 if (large) {
 550                         u32 time;
 551
 552                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 553
 554                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 555                                         chan->dfs_state))
 556                                 goto nla_put_failure;
 557                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 558                                         time))
 559                                 goto nla_put_failure;
 560                 }
 561         }
 562
 563         if (large) {
 564                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 565                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 566                         goto nla_put_failure;
 567                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 568                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 569                         goto nla_put_failure;
 570                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 571                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 572                         goto nla_put_failure;
 573                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 574                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 575                         goto nla_put_failure;
 576         }
 577
 578         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 579                         DBM_TO_MBM(chan->max_power)))
 580                 goto nla_put_failure;
 581
 582         return 0;
 583
 584  nla_put_failure:
 585         return -ENOBUFS;
 586 }
 587
 588 /* netlink command implementations */
 589
 590 struct key_parse {
 591         struct key_params p;
 592         int idx;
 593         int type;
 594         bool def, defmgmt;
 595         bool def_uni, def_multi;
 596 };
 597
 598 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 599 {
 600         struct nlattr *tb[NL80211_KEY_MAX + 1];
 601         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 602                                    nl80211_key_policy);
 603         if (err)
 604                 return err;
 605
 606         k->def = !!tb[NL80211_KEY_DEFAULT];
 607         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 608
 609         if (k->def) {
 610                 k->def_uni = true;
 611                 k->def_multi = true;
 612         }
 613         if (k->defmgmt)
 614                 k->def_multi = true;
 615
 616         if (tb[NL80211_KEY_IDX])
 617                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 618
 619         if (tb[NL80211_KEY_DATA]) {
 620                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 621                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 622         }
 623
 624         if (tb[NL80211_KEY_SEQ]) {
 625                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 626                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 627         }
 628
 629         if (tb[NL80211_KEY_CIPHER])
 630                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 631
 632         if (tb[NL80211_KEY_TYPE]) {
 633                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 634                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 635                         return -EINVAL;
 636         }
 637
 638         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 639                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 640                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 641                                        tb[NL80211_KEY_DEFAULT_TYPES],
 642                                        nl80211_key_default_policy);
 643                 if (err)
 644                         return err;
 645
 646                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 647                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 648         }
 649
 650         return 0;
 651 }
 652
 653 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 654 {
 655         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 656                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 657                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 658         }
 659
 660         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 661                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 662                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 663         }
 664
 665         if (info->attrs[NL80211_ATTR_KEY_IDX])
 666                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 667
 668         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 669                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 670
 671         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 672         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 673
 674         if (k->def) {
 675                 k->def_uni = true;
 676                 k->def_multi = true;
 677         }
 678         if (k->defmgmt)
 679                 k->def_multi = true;
 680
 681         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 682                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 683                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 684                         return -EINVAL;
 685         }
 686
 687         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 688                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 689                 int err = nla_parse_nested(
 690                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 691                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 692                                 nl80211_key_default_policy);
 693                 if (err)
 694                         return err;
 695
 696                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 697                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 698         }
 699
 700         return 0;
 701 }
 702
 703 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 704 {
 705         int err;
 706
 707         memset(k, 0, sizeof(*k));
 708         k->idx = -1;
 709         k->type = -1;
 710
 711         if (info->attrs[NL80211_ATTR_KEY])
 712                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 713         else
 714                 err = nl80211_parse_key_old(info, k);
 715
 716         if (err)
 717                 return err;
 718
 719         if (k->def && k->defmgmt)
 720                 return -EINVAL;
 721
 722         if (k->defmgmt) {
 723                 if (k->def_uni || !k->def_multi)
 724                         return -EINVAL;
 725         }
 726
 727         if (k->idx != -1) {
 728                 if (k->defmgmt) {
 729                         if (k->idx < 4 || k->idx > 5)
 730                                 return -EINVAL;
 731                 } else if (k->def) {
 732                         if (k->idx < 0 || k->idx > 3)
 733                                 return -EINVAL;
 734                 } else {
 735                         if (k->idx < 0 || k->idx > 5)
 736                                 return -EINVAL;
 737                 }
 738         }
 739
 740         return 0;
 741 }
 742
 743 static struct cfg80211_cached_keys *
 744 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 745                        struct nlattr *keys, bool *no_ht)
 746 {
 747         struct key_parse parse;
 748         struct nlattr *key;
 749         struct cfg80211_cached_keys *result;
 750         int rem, err, def = 0;
 751
 752         result = kzalloc(sizeof(*result), GFP_KERNEL);
 753         if (!result)
 754                 return ERR_PTR(-ENOMEM);
 755
 756         result->def = -1;
 757         result->defmgmt = -1;
 758
 759         nla_for_each_nested(key, keys, rem) {
 760                 memset(&parse, 0, sizeof(parse));
 761                 parse.idx = -1;
 762
 763                 err = nl80211_parse_key_new(key, &parse);
 764                 if (err)
 765                         goto error;
 766                 err = -EINVAL;
 767                 if (!parse.p.key)
 768                         goto error;
 769                 if (parse.idx < 0 || parse.idx > 4)
 770                         goto error;
 771                 if (parse.def) {
 772                         if (def)
 773                                 goto error;
 774                         def = 1;
 775                         result->def = parse.idx;
 776                         if (!parse.def_uni || !parse.def_multi)
 777                                 goto error;
 778                 } else if (parse.defmgmt)
 779                         goto error;
 780                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 781                                                      parse.idx, false, NULL);
 782                 if (err)
 783                         goto error;
 784                 result->params[parse.idx].cipher = parse.p.cipher;
 785                 result->params[parse.idx].key_len = parse.p.key_len;
 786                 result->params[parse.idx].key = result->data[parse.idx];
 787                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 788
 789                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 790                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 791                         if (no_ht)
 792                                 *no_ht = true;
 793                 }
 794         }
 795
 796         return result;
 797  error:
 798         kfree(result);
 799         return ERR_PTR(err);
 800 }
 801
 802 static int nl80211_key_allowed(struct wireless_dev *wdev)
 803 {
 804         ASSERT_WDEV_LOCK(wdev);
 805
 806         switch (wdev->iftype) {
 807         case NL80211_IFTYPE_AP:
 808         case NL80211_IFTYPE_AP_VLAN:
 809         case NL80211_IFTYPE_P2P_GO:
 810         case NL80211_IFTYPE_MESH_POINT:
 811                 break;
 812         case NL80211_IFTYPE_ADHOC:
 813         case NL80211_IFTYPE_STATION:
 814         case NL80211_IFTYPE_P2P_CLIENT:
 815                 if (!wdev->current_bss)
 816                         return -ENOLINK;
 817                 break;
 818         default:
 819                 return -EINVAL;
 820         }
 821
 822         return 0;
 823 }
 824
 825 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 826 {
 827         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 828         int i;
 829
 830         if (!nl_modes)
 831                 goto nla_put_failure;
 832
 833         i = 0;
 834         while (ifmodes) {
 835                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 836                         goto nla_put_failure;
 837                 ifmodes >>= 1;
 838                 i++;
 839         }
 840
 841         nla_nest_end(msg, nl_modes);
 842         return 0;
 843
 844 nla_put_failure:
 845         return -ENOBUFS;
 846 }
 847
 848 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 849                                           struct sk_buff *msg,
 850                                           bool large)
 851 {
 852         struct nlattr *nl_combis;
 853         int i, j;
 854
 855         nl_combis = nla_nest_start(msg,
 856                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 857         if (!nl_combis)
 858                 goto nla_put_failure;
 859
 860         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 861                 const struct ieee80211_iface_combination *c;
 862                 struct nlattr *nl_combi, *nl_limits;
 863
 864                 c = &wiphy->iface_combinations[i];
 865
 866                 nl_combi = nla_nest_start(msg, i + 1);
 867                 if (!nl_combi)
 868                         goto nla_put_failure;
 869
 870                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 871                 if (!nl_limits)
 872                         goto nla_put_failure;
 873
 874                 for (j = 0; j < c->n_limits; j++) {
 875                         struct nlattr *nl_limit;
 876
 877                         nl_limit = nla_nest_start(msg, j + 1);
 878                         if (!nl_limit)
 879                                 goto nla_put_failure;
 880                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 881                                         c->limits[j].max))
 882                                 goto nla_put_failure;
 883                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 884                                                 c->limits[j].types))
 885                                 goto nla_put_failure;
 886                         nla_nest_end(msg, nl_limit);
 887                 }
 888
 889                 nla_nest_end(msg, nl_limits);
 890
 891                 if (c->beacon_int_infra_match &&
 892                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 893                         goto nla_put_failure;
 894                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 895                                 c->num_different_channels) ||
 896                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 897                                 c->max_interfaces))
 898                         goto nla_put_failure;
 899                 if (large &&
 900                     nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
 901                                 c->radar_detect_widths))
 902                         goto nla_put_failure;
 903
 904                 nla_nest_end(msg, nl_combi);
 905         }
 906
 907         nla_nest_end(msg, nl_combis);
 908
 909         return 0;
 910 nla_put_failure:
 911         return -ENOBUFS;
 912 }
 913
 914 #ifdef CONFIG_PM
 915 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
 916                                         struct sk_buff *msg)
 917 {
 918         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
 919         struct nlattr *nl_tcp;
 920
 921         if (!tcp)
 922                 return 0;
 923
 924         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
 925         if (!nl_tcp)
 926                 return -ENOBUFS;
 927
 928         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 929                         tcp->data_payload_max))
 930                 return -ENOBUFS;
 931
 932         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 933                         tcp->data_payload_max))
 934                 return -ENOBUFS;
 935
 936         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
 937                 return -ENOBUFS;
 938
 939         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
 940                                 sizeof(*tcp->tok), tcp->tok))
 941                 return -ENOBUFS;
 942
 943         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
 944                         tcp->data_interval_max))
 945                 return -ENOBUFS;
 946
 947         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
 948                         tcp->wake_payload_max))
 949                 return -ENOBUFS;
 950
 951         nla_nest_end(msg, nl_tcp);
 952         return 0;
 953 }
 954
 955 static int nl80211_send_wowlan(struct sk_buff *msg,
 956                                struct cfg80211_registered_device *dev,
 957                                bool large)
 958 {
 959         struct nlattr *nl_wowlan;
 960
 961         if (!dev->wiphy.wowlan)
 962                 return 0;
 963
 964         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
 965         if (!nl_wowlan)
 966                 return -ENOBUFS;
 967
 968         if (((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
 969              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
 970             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
 971              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
 972             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
 973              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
 974             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
 975              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
 976             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
 977              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
 978             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
 979              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
 980             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
 981              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
 982             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
 983              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
 984                 return -ENOBUFS;
 985
 986         if (dev->wiphy.wowlan->n_patterns) {
 987                 struct nl80211_pattern_support pat = {
 988                         .max_patterns = dev->wiphy.wowlan->n_patterns,
 989                         .min_pattern_len = dev->wiphy.wowlan->pattern_min_len,
 990                         .max_pattern_len = dev->wiphy.wowlan->pattern_max_len,
 991                         .max_pkt_offset = dev->wiphy.wowlan->max_pkt_offset,
 992                 };
 993
 994                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
 995                             sizeof(pat), &pat))
 996                         return -ENOBUFS;
 997         }
 998
 999         if (large && nl80211_send_wowlan_tcp_caps(dev, msg))
1000                 return -ENOBUFS;
1001
1002         nla_nest_end(msg, nl_wowlan);
1003
1004         return 0;
1005 }
1006 #endif
1007
1008 static int nl80211_send_coalesce(struct sk_buff *msg,
1009                                  struct cfg80211_registered_device *dev)
1010 {
1011         struct nl80211_coalesce_rule_support rule;
1012
1013         if (!dev->wiphy.coalesce)
1014                 return 0;
1015
1016         rule.max_rules = dev->wiphy.coalesce->n_rules;
1017         rule.max_delay = dev->wiphy.coalesce->max_delay;
1018         rule.pat.max_patterns = dev->wiphy.coalesce->n_patterns;
1019         rule.pat.min_pattern_len = dev->wiphy.coalesce->pattern_min_len;
1020         rule.pat.max_pattern_len = dev->wiphy.coalesce->pattern_max_len;
1021         rule.pat.max_pkt_offset = dev->wiphy.coalesce->max_pkt_offset;
1022
1023         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1024                 return -ENOBUFS;
1025
1026         return 0;
1027 }
1028
1029 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1030                                       struct ieee80211_supported_band *sband)
1031 {
1032         struct nlattr *nl_rates, *nl_rate;
1033         struct ieee80211_rate *rate;
1034         int i;
1035
1036         /* add HT info */
1037         if (sband->ht_cap.ht_supported &&
1038             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1039                      sizeof(sband->ht_cap.mcs),
1040                      &sband->ht_cap.mcs) ||
1041              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1042                          sband->ht_cap.cap) ||
1043              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1044                         sband->ht_cap.ampdu_factor) ||
1045              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1046                         sband->ht_cap.ampdu_density)))
1047                 return -ENOBUFS;
1048
1049         /* add VHT info */
1050         if (sband->vht_cap.vht_supported &&
1051             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1052                      sizeof(sband->vht_cap.vht_mcs),
1053                      &sband->vht_cap.vht_mcs) ||
1054              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1055                          sband->vht_cap.cap)))
1056                 return -ENOBUFS;
1057
1058         /* add bitrates */
1059         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1060         if (!nl_rates)
1061                 return -ENOBUFS;
1062
1063         for (i = 0; i < sband->n_bitrates; i++) {
1064                 nl_rate = nla_nest_start(msg, i);
1065                 if (!nl_rate)
1066                         return -ENOBUFS;
1067
1068                 rate = &sband->bitrates[i];
1069                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1070                                 rate->bitrate))
1071                         return -ENOBUFS;
1072                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1073                     nla_put_flag(msg,
1074                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1075                         return -ENOBUFS;
1076
1077                 nla_nest_end(msg, nl_rate);
1078         }
1079
1080         nla_nest_end(msg, nl_rates);
1081
1082         return 0;
1083 }
1084
1085 static int
1086 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1087                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1088 {
1089         u16 stypes;
1090         struct nlattr *nl_ftypes, *nl_ifs;
1091         enum nl80211_iftype ift;
1092         int i;
1093
1094         if (!mgmt_stypes)
1095                 return 0;
1096
1097         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1098         if (!nl_ifs)
1099                 return -ENOBUFS;
1100
1101         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1102                 nl_ftypes = nla_nest_start(msg, ift);
1103                 if (!nl_ftypes)
1104                         return -ENOBUFS;
1105                 i = 0;
1106                 stypes = mgmt_stypes[ift].tx;
1107                 while (stypes) {
1108                         if ((stypes & 1) &&
1109                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1110                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1111                                 return -ENOBUFS;
1112                         stypes >>= 1;
1113                         i++;
1114                 }
1115                 nla_nest_end(msg, nl_ftypes);
1116         }
1117
1118         nla_nest_end(msg, nl_ifs);
1119
1120         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1121         if (!nl_ifs)
1122                 return -ENOBUFS;
1123
1124         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1125                 nl_ftypes = nla_nest_start(msg, ift);
1126                 if (!nl_ftypes)
1127                         return -ENOBUFS;
1128                 i = 0;
1129                 stypes = mgmt_stypes[ift].rx;
1130                 while (stypes) {
1131                         if ((stypes & 1) &&
1132                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1133                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1134                                 return -ENOBUFS;
1135                         stypes >>= 1;
1136                         i++;
1137                 }
1138                 nla_nest_end(msg, nl_ftypes);
1139         }
1140         nla_nest_end(msg, nl_ifs);
1141
1142         return 0;
1143 }
1144
1145 struct nl80211_dump_wiphy_state {
1146         s64 filter_wiphy;
1147         long start;
1148         long split_start, band_start, chan_start;
1149         bool split;
1150 };
1151
1152 static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
1153                               struct sk_buff *msg, u32 portid, u32 seq,
1154                               int flags, struct nl80211_dump_wiphy_state *state)
1155 {
1156         void *hdr;
1157         struct nlattr *nl_bands, *nl_band;
1158         struct nlattr *nl_freqs, *nl_freq;
1159         struct nlattr *nl_cmds;
1160         enum ieee80211_band band;
1161         struct ieee80211_channel *chan;
1162         int i;
1163         const struct ieee80211_txrx_stypes *mgmt_stypes =
1164                                 dev->wiphy.mgmt_stypes;
1165         u32 features;
1166
1167         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
1168         if (!hdr)
1169                 return -ENOBUFS;
1170
1171         if (WARN_ON(!state))
1172                 return -EINVAL;
1173
1174         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
1175             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1176                            wiphy_name(&dev->wiphy)) ||
1177             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1178                         cfg80211_rdev_list_generation))
1179                 goto nla_put_failure;
1180
1181         switch (state->split_start) {
1182         case 0:
1183                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1184                                dev->wiphy.retry_short) ||
1185                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1186                                dev->wiphy.retry_long) ||
1187                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1188                                 dev->wiphy.frag_threshold) ||
1189                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1190                                 dev->wiphy.rts_threshold) ||
1191                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1192                                dev->wiphy.coverage_class) ||
1193                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1194                                dev->wiphy.max_scan_ssids) ||
1195                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1196                                dev->wiphy.max_sched_scan_ssids) ||
1197                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1198                                 dev->wiphy.max_scan_ie_len) ||
1199                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1200                                 dev->wiphy.max_sched_scan_ie_len) ||
1201                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1202                                dev->wiphy.max_match_sets))
1203                         goto nla_put_failure;
1204
1205                 if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1206                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1207                         goto nla_put_failure;
1208                 if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1209                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1210                         goto nla_put_failure;
1211                 if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1212                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1213                         goto nla_put_failure;
1214                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1215                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1216                         goto nla_put_failure;
1217                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1218                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1219                         goto nla_put_failure;
1220                 if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1221                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1222                         goto nla_put_failure;
1223                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1224                     nla_put_flag(msg, WIPHY_FLAG_SUPPORTS_5_10_MHZ))
1225                         goto nla_put_failure;
1226
1227                 state->split_start++;
1228                 if (state->split)
1229                         break;
1230         case 1:
1231                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1232                             sizeof(u32) * dev->wiphy.n_cipher_suites,
1233                             dev->wiphy.cipher_suites))
1234                         goto nla_put_failure;
1235
1236                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1237                                dev->wiphy.max_num_pmkids))
1238                         goto nla_put_failure;
1239
1240                 if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1241                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1242                         goto nla_put_failure;
1243
1244                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1245                                 dev->wiphy.available_antennas_tx) ||
1246                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1247                                 dev->wiphy.available_antennas_rx))
1248                         goto nla_put_failure;
1249
1250                 if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1251                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1252                                 dev->wiphy.probe_resp_offload))
1253                         goto nla_put_failure;
1254
1255                 if ((dev->wiphy.available_antennas_tx ||
1256                      dev->wiphy.available_antennas_rx) &&
1257                     dev->ops->get_antenna) {
1258                         u32 tx_ant = 0, rx_ant = 0;
1259                         int res;
1260                         res = rdev_get_antenna(dev, &tx_ant, &rx_ant);
1261                         if (!res) {
1262                                 if (nla_put_u32(msg,
1263                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1264                                                 tx_ant) ||
1265                                     nla_put_u32(msg,
1266                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1267                                                 rx_ant))
1268                                         goto nla_put_failure;
1269                         }
1270                 }
1271
1272                 state->split_start++;
1273                 if (state->split)
1274                         break;
1275         case 2:
1276                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1277                                         dev->wiphy.interface_modes))
1278                                 goto nla_put_failure;
1279                 state->split_start++;
1280                 if (state->split)
1281                         break;
1282         case 3:
1283                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1284                 if (!nl_bands)
1285                         goto nla_put_failure;
1286
1287                 for (band = state->band_start;
1288                      band < IEEE80211_NUM_BANDS; band++) {
1289                         struct ieee80211_supported_band *sband;
1290
1291                         sband = dev->wiphy.bands[band];
1292
1293                         if (!sband)
1294                                 continue;
1295
1296                         nl_band = nla_nest_start(msg, band);
1297                         if (!nl_band)
1298                                 goto nla_put_failure;
1299
1300                         switch (state->chan_start) {
1301                         case 0:
1302                                 if (nl80211_send_band_rateinfo(msg, sband))
1303                                         goto nla_put_failure;
1304                                 state->chan_start++;
1305                                 if (state->split)
1306                                         break;
1307                         default:
1308                                 /* add frequencies */
1309                                 nl_freqs = nla_nest_start(
1310                                         msg, NL80211_BAND_ATTR_FREQS);
1311                                 if (!nl_freqs)
1312                                         goto nla_put_failure;
1313
1314                                 for (i = state->chan_start - 1;
1315                                      i < sband->n_channels;
1316                                      i++) {
1317                                         nl_freq = nla_nest_start(msg, i);
1318                                         if (!nl_freq)
1319                                                 goto nla_put_failure;
1320
1321                                         chan = &sband->channels[i];
1322
1323                                         if (nl80211_msg_put_channel(
1324                                                         msg, chan,
1325                                                         state->split))
1326                                                 goto nla_put_failure;
1327
1328                                         nla_nest_end(msg, nl_freq);
1329                                         if (state->split)
1330                                                 break;
1331                                 }
1332                                 if (i < sband->n_channels)
1333                                         state->chan_start = i + 2;
1334                                 else
1335                                         state->chan_start = 0;
1336                                 nla_nest_end(msg, nl_freqs);
1337                         }
1338
1339                         nla_nest_end(msg, nl_band);
1340
1341                         if (state->split) {
1342                                 /* start again here */
1343                                 if (state->chan_start)
1344                                         band--;
1345                                 break;
1346                         }
1347                 }
1348                 nla_nest_end(msg, nl_bands);
1349
1350                 if (band < IEEE80211_NUM_BANDS)
1351                         state->band_start = band + 1;
1352                 else
1353                         state->band_start = 0;
1354
1355                 /* if bands & channels are done, continue outside */
1356                 if (state->band_start == 0 && state->chan_start == 0)
1357                         state->split_start++;
1358                 if (state->split)
1359                         break;
1360         case 4:
1361                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1362                 if (!nl_cmds)
1363                         goto nla_put_failure;
1364
1365                 i = 0;
1366 #define CMD(op, n)                                                      \
1367                  do {                                                   \
1368                         if (dev->ops->op) {                             \
1369                                 i++;                                    \
1370                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1371                                         goto nla_put_failure;           \
1372                         }                                               \
1373                 } while (0)
1374
1375                 CMD(add_virtual_intf, NEW_INTERFACE);
1376                 CMD(change_virtual_intf, SET_INTERFACE);
1377                 CMD(add_key, NEW_KEY);
1378                 CMD(start_ap, START_AP);
1379                 CMD(add_station, NEW_STATION);
1380                 CMD(add_mpath, NEW_MPATH);
1381                 CMD(update_mesh_config, SET_MESH_CONFIG);
1382                 CMD(change_bss, SET_BSS);
1383                 CMD(auth, AUTHENTICATE);
1384                 CMD(assoc, ASSOCIATE);
1385                 CMD(deauth, DEAUTHENTICATE);
1386                 CMD(disassoc, DISASSOCIATE);
1387                 CMD(join_ibss, JOIN_IBSS);
1388                 CMD(join_mesh, JOIN_MESH);
1389                 CMD(set_pmksa, SET_PMKSA);
1390                 CMD(del_pmksa, DEL_PMKSA);
1391                 CMD(flush_pmksa, FLUSH_PMKSA);
1392                 if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1393                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1394                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1395                 CMD(mgmt_tx, FRAME);
1396                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1397                 if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1398                         i++;
1399                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1400                                 goto nla_put_failure;
1401                 }
1402                 if (dev->ops->set_monitor_channel || dev->ops->start_ap ||
1403                     dev->ops->join_mesh) {
1404                         i++;
1405                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1406                                 goto nla_put_failure;
1407                 }
1408                 CMD(set_wds_peer, SET_WDS_PEER);
1409                 if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1410                         CMD(tdls_mgmt, TDLS_MGMT);
1411                         CMD(tdls_oper, TDLS_OPER);
1412                 }
1413                 if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1414                         CMD(sched_scan_start, START_SCHED_SCAN);
1415                 CMD(probe_client, PROBE_CLIENT);
1416                 CMD(set_noack_map, SET_NOACK_MAP);
1417                 if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1418                         i++;
1419                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1420                                 goto nla_put_failure;
1421                 }
1422                 CMD(start_p2p_device, START_P2P_DEVICE);
1423                 CMD(set_mcast_rate, SET_MCAST_RATE);
1424                 if (state->split) {
1425                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1426                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1427                 }
1428
1429 #ifdef CONFIG_NL80211_TESTMODE
1430                 CMD(testmode_cmd, TESTMODE);
1431 #endif
1432
1433 #undef CMD
1434
1435                 if (dev->ops->connect || dev->ops->auth) {
1436                         i++;
1437                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1438                                 goto nla_put_failure;
1439                 }
1440
1441                 if (dev->ops->disconnect || dev->ops->deauth) {
1442                         i++;
1443                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1444                                 goto nla_put_failure;
1445                 }
1446
1447                 nla_nest_end(msg, nl_cmds);
1448                 state->split_start++;
1449                 if (state->split)
1450                         break;
1451         case 5:
1452                 if (dev->ops->remain_on_channel &&
1453                     (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1454                     nla_put_u32(msg,
1455                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1456                                 dev->wiphy.max_remain_on_channel_duration))
1457                         goto nla_put_failure;
1458
1459                 if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1460                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1461                         goto nla_put_failure;
1462
1463                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1464                         goto nla_put_failure;
1465                 state->split_start++;
1466                 if (state->split)
1467                         break;
1468         case 6:
1469 #ifdef CONFIG_PM
1470                 if (nl80211_send_wowlan(msg, dev, state->split))
1471                         goto nla_put_failure;
1472                 state->split_start++;
1473                 if (state->split)
1474                         break;
1475 #else
1476                 state->split_start++;
1477 #endif
1478         case 7:
1479                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1480                                         dev->wiphy.software_iftypes))
1481                         goto nla_put_failure;
1482
1483                 if (nl80211_put_iface_combinations(&dev->wiphy, msg,
1484                                                    state->split))
1485                         goto nla_put_failure;
1486
1487                 state->split_start++;
1488                 if (state->split)
1489                         break;
1490         case 8:
1491                 if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1492                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1493                                 dev->wiphy.ap_sme_capa))
1494                         goto nla_put_failure;
1495
1496                 features = dev->wiphy.features;
1497                 /*
1498                  * We can only add the per-channel limit information if the
1499                  * dump is split, otherwise it makes it too big. Therefore
1500                  * only advertise it in that case.
1501                  */
1502                 if (state->split)
1503                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1504                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1505                         goto nla_put_failure;
1506
1507                 if (dev->wiphy.ht_capa_mod_mask &&
1508                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1509                             sizeof(*dev->wiphy.ht_capa_mod_mask),
1510                             dev->wiphy.ht_capa_mod_mask))
1511                         goto nla_put_failure;
1512
1513                 if (dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1514                     dev->wiphy.max_acl_mac_addrs &&
1515                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1516                                 dev->wiphy.max_acl_mac_addrs))
1517                         goto nla_put_failure;
1518
1519                 /*
1520                  * Any information below this point is only available to
1521                  * applications that can deal with it being split. This
1522                  * helps ensure that newly added capabilities don't break
1523                  * older tools by overrunning their buffers.
1524                  *
1525                  * We still increment split_start so that in the split
1526                  * case we'll continue with more data in the next round,
1527                  * but break unconditionally so unsplit data stops here.
1528                  */
1529                 state->split_start++;
1530                 break;
1531         case 9:
1532                 if (dev->wiphy.extended_capabilities &&
1533                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1534                              dev->wiphy.extended_capabilities_len,
1535                              dev->wiphy.extended_capabilities) ||
1536                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1537                              dev->wiphy.extended_capabilities_len,
1538                              dev->wiphy.extended_capabilities_mask)))
1539                         goto nla_put_failure;
1540
1541                 if (dev->wiphy.vht_capa_mod_mask &&
1542                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1543                             sizeof(*dev->wiphy.vht_capa_mod_mask),
1544                             dev->wiphy.vht_capa_mod_mask))
1545                         goto nla_put_failure;
1546
1547                 state->split_start++;
1548                 break;
1549         case 10:
1550                 if (nl80211_send_coalesce(msg, dev))
1551                         goto nla_put_failure;
1552
1553                 /* done */
1554                 state->split_start = 0;
1555                 break;
1556         }
1557         return genlmsg_end(msg, hdr);
1558
1559  nla_put_failure:
1560         genlmsg_cancel(msg, hdr);
1561         return -EMSGSIZE;
1562 }
1563
1564 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1565                                     struct netlink_callback *cb,
1566                                     struct nl80211_dump_wiphy_state *state)
1567 {
1568         struct nlattr **tb = nl80211_fam.attrbuf;
1569         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1570                               tb, nl80211_fam.maxattr, nl80211_policy);
1571         /* ignore parse errors for backward compatibility */
1572         if (ret)
1573                 return 0;
1574
1575         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1576         if (tb[NL80211_ATTR_WIPHY])
1577                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1578         if (tb[NL80211_ATTR_WDEV])
1579                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1580         if (tb[NL80211_ATTR_IFINDEX]) {
1581                 struct net_device *netdev;
1582                 struct cfg80211_registered_device *rdev;
1583                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1584
1585                 netdev = dev_get_by_index(sock_net(skb->sk), ifidx);
1586                 if (!netdev)
1587                         return -ENODEV;
1588                 if (netdev->ieee80211_ptr) {
1589                         rdev = wiphy_to_dev(
1590                                 netdev->ieee80211_ptr->wiphy);
1591                         state->filter_wiphy = rdev->wiphy_idx;
1592                 }
1593                 dev_put(netdev);
1594         }
1595
1596         return 0;
1597 }
1598
1599 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1600 {
1601         int idx = 0, ret;
1602         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1603         struct cfg80211_registered_device *dev;
1604
1605         rtnl_lock();
1606         if (!state) {
1607                 state = kzalloc(sizeof(*state), GFP_KERNEL);
1608                 if (!state) {
1609                         rtnl_unlock();
1610                         return -ENOMEM;
1611                 }
1612                 state->filter_wiphy = -1;
1613                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1614                 if (ret) {
1615                         kfree(state);
1616                         rtnl_unlock();
1617                         return ret;
1618                 }
1619                 cb->args[0] = (long)state;
1620         }
1621
1622         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1623                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1624                         continue;
1625                 if (++idx <= state->start)
1626                         continue;
1627                 if (state->filter_wiphy != -1 &&
1628                     state->filter_wiphy != dev->wiphy_idx)
1629                         continue;
1630                 /* attempt to fit multiple wiphy data chunks into the skb */
1631                 do {
1632                         ret = nl80211_send_wiphy(dev, skb,
1633                                                  NETLINK_CB(cb->skb).portid,
1634                                                  cb->nlh->nlmsg_seq,
1635                                                  NLM_F_MULTI, state);
1636                         if (ret < 0) {
1637                                 /*
1638                                  * If sending the wiphy data didn't fit (ENOBUFS
1639                                  * or EMSGSIZE returned), this SKB is still
1640                                  * empty (so it's not too big because another
1641                                  * wiphy dataset is already in the skb) and
1642                                  * we've not tried to adjust the dump allocation
1643                                  * yet ... then adjust the alloc size to be
1644                                  * bigger, and return 1 but with the empty skb.
1645                                  * This results in an empty message being RX'ed
1646                                  * in userspace, but that is ignored.
1647                                  *
1648                                  * We can then retry with the larger buffer.
1649                                  */
1650                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1651                                     !skb->len &&
1652                                     cb->min_dump_alloc < 4096) {
1653                                         cb->min_dump_alloc = 4096;
1654                                         rtnl_unlock();
1655                                         return 1;
1656                                 }
1657                                 idx--;
1658                                 break;
1659                         }
1660                 } while (state->split_start > 0);
1661                 break;
1662         }
1663         rtnl_unlock();
1664
1665         state->start = idx;
1666
1667         return skb->len;
1668 }
1669
1670 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
1671 {
1672         kfree((void *)cb->args[0]);
1673         return 0;
1674 }
1675
1676 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1677 {
1678         struct sk_buff *msg;
1679         struct cfg80211_registered_device *dev = info->user_ptr[0];
1680         struct nl80211_dump_wiphy_state state = {};
1681
1682         msg = nlmsg_new(4096, GFP_KERNEL);
1683         if (!msg)
1684                 return -ENOMEM;
1685
1686         if (nl80211_send_wiphy(dev, msg, info->snd_portid, info->snd_seq, 0,
1687                                &state) < 0) {
1688                 nlmsg_free(msg);
1689                 return -ENOBUFS;
1690         }
1691
1692         return genlmsg_reply(msg, info);
1693 }
1694
1695 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1696         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1697         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1698         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1699         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1700         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1701 };
1702
1703 static int parse_txq_params(struct nlattr *tb[],
1704                             struct ieee80211_txq_params *txq_params)
1705 {
1706         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1707             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1708             !tb[NL80211_TXQ_ATTR_AIFS])
1709                 return -EINVAL;
1710
1711         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1712         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1713         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1714         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1715         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1716
1717         if (txq_params->ac >= NL80211_NUM_ACS)
1718                 return -EINVAL;
1719
1720         return 0;
1721 }
1722
1723 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1724 {
1725         /*
1726          * You can only set the channel explicitly for WDS interfaces,
1727          * all others have their channel managed via their respective
1728          * "establish a connection" command (connect, join, ...)
1729          *
1730          * For AP/GO and mesh mode, the channel can be set with the
1731          * channel userspace API, but is only stored and passed to the
1732          * low-level driver when the AP starts or the mesh is joined.
1733          * This is for backward compatibility, userspace can also give
1734          * the channel in the start-ap or join-mesh commands instead.
1735          *
1736          * Monitors are special as they are normally slaved to
1737          * whatever else is going on, so they have their own special
1738          * operation to set the monitor channel if possible.
1739          */
1740         return !wdev ||
1741                 wdev->iftype == NL80211_IFTYPE_AP ||
1742                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1743                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1744                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1745 }
1746
1747 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1748                                  struct genl_info *info,
1749                                  struct cfg80211_chan_def *chandef)
1750 {
1751         u32 control_freq;
1752
1753         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1754                 return -EINVAL;
1755
1756         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1757
1758         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1759         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1760         chandef->center_freq1 = control_freq;
1761         chandef->center_freq2 = 0;
1762
1763         /* Primary channel not allowed */
1764         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1765                 return -EINVAL;
1766
1767         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1768                 enum nl80211_channel_type chantype;
1769
1770                 chantype = nla_get_u32(
1771                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1772
1773                 switch (chantype) {
1774                 case NL80211_CHAN_NO_HT:
1775                 case NL80211_CHAN_HT20:
1776                 case NL80211_CHAN_HT40PLUS:
1777                 case NL80211_CHAN_HT40MINUS:
1778                         cfg80211_chandef_create(chandef, chandef->chan,
1779                                                 chantype);
1780                         break;
1781                 default:
1782                         return -EINVAL;
1783                 }
1784         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1785                 chandef->width =
1786                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1787                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1788                         chandef->center_freq1 =
1789                                 nla_get_u32(
1790                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1791                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1792                         chandef->center_freq2 =
1793                                 nla_get_u32(
1794                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1795         }
1796
1797         if (!cfg80211_chandef_valid(chandef))
1798                 return -EINVAL;
1799
1800         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1801                                      IEEE80211_CHAN_DISABLED))
1802                 return -EINVAL;
1803
1804         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
1805              chandef->width == NL80211_CHAN_WIDTH_10) &&
1806             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
1807                 return -EINVAL;
1808
1809         return 0;
1810 }
1811
1812 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1813                                  struct wireless_dev *wdev,
1814                                  struct genl_info *info)
1815 {
1816         struct cfg80211_chan_def chandef;
1817         int result;
1818         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1819
1820         if (wdev)
1821                 iftype = wdev->iftype;
1822
1823         if (!nl80211_can_set_dev_channel(wdev))
1824                 return -EOPNOTSUPP;
1825
1826         result = nl80211_parse_chandef(rdev, info, &chandef);
1827         if (result)
1828                 return result;
1829
1830         switch (iftype) {
1831         case NL80211_IFTYPE_AP:
1832         case NL80211_IFTYPE_P2P_GO:
1833                 if (wdev->beacon_interval) {
1834                         result = -EBUSY;
1835                         break;
1836                 }
1837                 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef)) {
1838                         result = -EINVAL;
1839                         break;
1840                 }
1841                 wdev->preset_chandef = chandef;
1842                 result = 0;
1843                 break;
1844         case NL80211_IFTYPE_MESH_POINT:
1845                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
1846                 break;
1847         case NL80211_IFTYPE_MONITOR:
1848                 result = cfg80211_set_monitor_channel(rdev, &chandef);
1849                 break;
1850         default:
1851                 result = -EINVAL;
1852         }
1853
1854         return result;
1855 }
1856
1857 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1858 {
1859         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1860         struct net_device *netdev = info->user_ptr[1];
1861
1862         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1863 }
1864
1865 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1866 {
1867         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1868         struct net_device *dev = info->user_ptr[1];
1869         struct wireless_dev *wdev = dev->ieee80211_ptr;
1870         const u8 *bssid;
1871
1872         if (!info->attrs[NL80211_ATTR_MAC])
1873                 return -EINVAL;
1874
1875         if (netif_running(dev))
1876                 return -EBUSY;
1877
1878         if (!rdev->ops->set_wds_peer)
1879                 return -EOPNOTSUPP;
1880
1881         if (wdev->iftype != NL80211_IFTYPE_WDS)
1882                 return -EOPNOTSUPP;
1883
1884         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1885         return rdev_set_wds_peer(rdev, dev, bssid);
1886 }
1887
1888
1889 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1890 {
1891         struct cfg80211_registered_device *rdev;
1892         struct net_device *netdev = NULL;
1893         struct wireless_dev *wdev;
1894         int result = 0, rem_txq_params = 0;
1895         struct nlattr *nl_txq_params;
1896         u32 changed;
1897         u8 retry_short = 0, retry_long = 0;
1898         u32 frag_threshold = 0, rts_threshold = 0;
1899         u8 coverage_class = 0;
1900
1901         ASSERT_RTNL();
1902
1903         /*
1904          * Try to find the wiphy and netdev. Normally this
1905          * function shouldn't need the netdev, but this is
1906          * done for backward compatibility -- previously
1907          * setting the channel was done per wiphy, but now
1908          * it is per netdev. Previous userland like hostapd
1909          * also passed a netdev to set_wiphy, so that it is
1910          * possible to let that go to the right netdev!
1911          */
1912
1913         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1914                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1915
1916                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1917                 if (netdev && netdev->ieee80211_ptr)
1918                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1919                 else
1920                         netdev = NULL;
1921         }
1922
1923         if (!netdev) {
1924                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
1925                                                   info->attrs);
1926                 if (IS_ERR(rdev))
1927                         return PTR_ERR(rdev);
1928                 wdev = NULL;
1929                 netdev = NULL;
1930                 result = 0;
1931         } else
1932                 wdev = netdev->ieee80211_ptr;
1933
1934         /*
1935          * end workaround code, by now the rdev is available
1936          * and locked, and wdev may or may not be NULL.
1937          */
1938
1939         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1940                 result = cfg80211_dev_rename(
1941                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1942
1943         if (result)
1944                 goto bad_res;
1945
1946         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1947                 struct ieee80211_txq_params txq_params;
1948                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1949
1950                 if (!rdev->ops->set_txq_params) {
1951                         result = -EOPNOTSUPP;
1952                         goto bad_res;
1953                 }
1954
1955                 if (!netdev) {
1956                         result = -EINVAL;
1957                         goto bad_res;
1958                 }
1959
1960                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1961                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
1962                         result = -EINVAL;
1963                         goto bad_res;
1964                 }
1965
1966                 if (!netif_running(netdev)) {
1967                         result = -ENETDOWN;
1968                         goto bad_res;
1969                 }
1970
1971                 nla_for_each_nested(nl_txq_params,
1972                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1973                                     rem_txq_params) {
1974                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1975                                   nla_data(nl_txq_params),
1976                                   nla_len(nl_txq_params),
1977                                   txq_params_policy);
1978                         result = parse_txq_params(tb, &txq_params);
1979                         if (result)
1980                                 goto bad_res;
1981
1982                         result = rdev_set_txq_params(rdev, netdev,
1983                                                      &txq_params);
1984                         if (result)
1985                                 goto bad_res;
1986                 }
1987         }
1988
1989         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1990                 result = __nl80211_set_channel(rdev,
1991                                 nl80211_can_set_dev_channel(wdev) ? wdev : NULL,
1992                                 info);
1993                 if (result)
1994                         goto bad_res;
1995         }
1996
1997         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1998                 struct wireless_dev *txp_wdev = wdev;
1999                 enum nl80211_tx_power_setting type;
2000                 int idx, mbm = 0;
2001
2002                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2003                         txp_wdev = NULL;
2004
2005                 if (!rdev->ops->set_tx_power) {
2006                         result = -EOPNOTSUPP;
2007                         goto bad_res;
2008                 }
2009
2010                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2011                 type = nla_get_u32(info->attrs[idx]);
2012
2013                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2014                     (type != NL80211_TX_POWER_AUTOMATIC)) {
2015                         result = -EINVAL;
2016                         goto bad_res;
2017                 }
2018
2019                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2020                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2021                         mbm = nla_get_u32(info->attrs[idx]);
2022                 }
2023
2024                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2025                 if (result)
2026                         goto bad_res;
2027         }
2028
2029         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2030             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2031                 u32 tx_ant, rx_ant;
2032                 if ((!rdev->wiphy.available_antennas_tx &&
2033                      !rdev->wiphy.available_antennas_rx) ||
2034                     !rdev->ops->set_antenna) {
2035                         result = -EOPNOTSUPP;
2036                         goto bad_res;
2037                 }
2038
2039                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2040                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2041
2042                 /* reject antenna configurations which don't match the
2043                  * available antenna masks, except for the "all" mask */
2044                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2045                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
2046                         result = -EINVAL;
2047                         goto bad_res;
2048                 }
2049
2050                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2051                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2052
2053                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2054                 if (result)
2055                         goto bad_res;
2056         }
2057
2058         changed = 0;
2059
2060         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2061                 retry_short = nla_get_u8(
2062                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2063                 if (retry_short == 0) {
2064                         result = -EINVAL;
2065                         goto bad_res;
2066                 }
2067                 changed |= WIPHY_PARAM_RETRY_SHORT;
2068         }
2069
2070         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2071                 retry_long = nla_get_u8(
2072                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2073                 if (retry_long == 0) {
2074                         result = -EINVAL;
2075                         goto bad_res;
2076                 }
2077                 changed |= WIPHY_PARAM_RETRY_LONG;
2078         }
2079
2080         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2081                 frag_threshold = nla_get_u32(
2082                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2083                 if (frag_threshold < 256) {
2084                         result = -EINVAL;
2085                         goto bad_res;
2086                 }
2087                 if (frag_threshold != (u32) -1) {
2088                         /*
2089                          * Fragments (apart from the last one) are required to
2090                          * have even length. Make the fragmentation code
2091                          * simpler by stripping LSB should someone try to use
2092                          * odd threshold value.
2093                          */
2094                         frag_threshold &= ~0x1;
2095                 }
2096                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2097         }
2098
2099         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2100                 rts_threshold = nla_get_u32(
2101                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2102                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2103         }
2104
2105         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2106                 coverage_class = nla_get_u8(
2107                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2108                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2109         }
2110
2111         if (changed) {
2112                 u8 old_retry_short, old_retry_long;
2113                 u32 old_frag_threshold, old_rts_threshold;
2114                 u8 old_coverage_class;
2115
2116                 if (!rdev->ops->set_wiphy_params) {
2117                         result = -EOPNOTSUPP;
2118                         goto bad_res;
2119                 }
2120
2121                 old_retry_short = rdev->wiphy.retry_short;
2122                 old_retry_long = rdev->wiphy.retry_long;
2123                 old_frag_threshold = rdev->wiphy.frag_threshold;
2124                 old_rts_threshold = rdev->wiphy.rts_threshold;
2125                 old_coverage_class = rdev->wiphy.coverage_class;
2126
2127                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2128                         rdev->wiphy.retry_short = retry_short;
2129                 if (changed & WIPHY_PARAM_RETRY_LONG)
2130                         rdev->wiphy.retry_long = retry_long;
2131                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2132                         rdev->wiphy.frag_threshold = frag_threshold;
2133                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2134                         rdev->wiphy.rts_threshold = rts_threshold;
2135                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2136                         rdev->wiphy.coverage_class = coverage_class;
2137
2138                 result = rdev_set_wiphy_params(rdev, changed);
2139                 if (result) {
2140                         rdev->wiphy.retry_short = old_retry_short;
2141                         rdev->wiphy.retry_long = old_retry_long;
2142                         rdev->wiphy.frag_threshold = old_frag_threshold;
2143                         rdev->wiphy.rts_threshold = old_rts_threshold;
2144                         rdev->wiphy.coverage_class = old_coverage_class;
2145                 }
2146         }
2147
2148  bad_res:
2149         if (netdev)
2150                 dev_put(netdev);
2151         return result;
2152 }
2153
2154 static inline u64 wdev_id(struct wireless_dev *wdev)
2155 {
2156         return (u64)wdev->identifier |
2157                ((u64)wiphy_to_dev(wdev->wiphy)->wiphy_idx << 32);
2158 }
2159
2160 static int nl80211_send_chandef(struct sk_buff *msg,
2161                                  struct cfg80211_chan_def *chandef)
2162 {
2163         WARN_ON(!cfg80211_chandef_valid(chandef));
2164
2165         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2166                         chandef->chan->center_freq))
2167                 return -ENOBUFS;
2168         switch (chandef->width) {
2169         case NL80211_CHAN_WIDTH_20_NOHT:
2170         case NL80211_CHAN_WIDTH_20:
2171         case NL80211_CHAN_WIDTH_40:
2172                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2173                                 cfg80211_get_chandef_type(chandef)))
2174                         return -ENOBUFS;
2175                 break;
2176         default:
2177                 break;
2178         }
2179         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2180                 return -ENOBUFS;
2181         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2182                 return -ENOBUFS;
2183         if (chandef->center_freq2 &&
2184             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2185                 return -ENOBUFS;
2186         return 0;
2187 }
2188
2189 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2190                               struct cfg80211_registered_device *rdev,
2191                               struct wireless_dev *wdev)
2192 {
2193         struct net_device *dev = wdev->netdev;
2194         void *hdr;
2195
2196         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
2197         if (!hdr)
2198                 return -1;
2199
2200         if (dev &&
2201             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2202              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2203                 goto nla_put_failure;
2204
2205         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2206             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2207             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2208             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2209             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2210                         rdev->devlist_generation ^
2211                         (cfg80211_rdev_list_generation << 2)))
2212                 goto nla_put_failure;
2213
2214         if (rdev->ops->get_channel) {
2215                 int ret;
2216                 struct cfg80211_chan_def chandef;
2217
2218                 ret = rdev_get_channel(rdev, wdev, &chandef);
2219                 if (ret == 0) {
2220                         if (nl80211_send_chandef(msg, &chandef))
2221                                 goto nla_put_failure;
2222                 }
2223         }
2224
2225         if (wdev->ssid_len) {
2226                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2227                         goto nla_put_failure;
2228         }
2229
2230         return genlmsg_end(msg, hdr);
2231
2232  nla_put_failure:
2233         genlmsg_cancel(msg, hdr);
2234         return -EMSGSIZE;
2235 }
2236
2237 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2238 {
2239         int wp_idx = 0;
2240         int if_idx = 0;
2241         int wp_start = cb->args[0];
2242         int if_start = cb->args[1];
2243         struct cfg80211_registered_device *rdev;
2244         struct wireless_dev *wdev;
2245
2246         rtnl_lock();
2247         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2248                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2249                         continue;
2250                 if (wp_idx < wp_start) {
2251                         wp_idx++;
2252                         continue;
2253                 }
2254                 if_idx = 0;
2255
2256                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
2257                         if (if_idx < if_start) {
2258                                 if_idx++;
2259                                 continue;
2260                         }
2261                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2262                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2263                                                rdev, wdev) < 0) {
2264                                 goto out;
2265                         }
2266                         if_idx++;
2267                 }
2268
2269                 wp_idx++;
2270         }
2271  out:
2272         rtnl_unlock();
2273
2274         cb->args[0] = wp_idx;
2275         cb->args[1] = if_idx;
2276
2277         return skb->len;
2278 }
2279
2280 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2281 {
2282         struct sk_buff *msg;
2283         struct cfg80211_registered_device *dev = info->user_ptr[0];
2284         struct wireless_dev *wdev = info->user_ptr[1];
2285
2286         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2287         if (!msg)
2288                 return -ENOMEM;
2289
2290         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2291                                dev, wdev) < 0) {
2292                 nlmsg_free(msg);
2293                 return -ENOBUFS;
2294         }
2295
2296         return genlmsg_reply(msg, info);
2297 }
2298
2299 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2300         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2301         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2302         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2303         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2304         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2305         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2306 };
2307
2308 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2309 {
2310         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2311         int flag;
2312
2313         *mntrflags = 0;
2314
2315         if (!nla)
2316                 return -EINVAL;
2317
2318         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2319                              nla, mntr_flags_policy))
2320                 return -EINVAL;
2321
2322         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2323                 if (flags[flag])
2324                         *mntrflags |= (1<<flag);
2325
2326         return 0;
2327 }
2328
2329 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2330                                struct net_device *netdev, u8 use_4addr,
2331                                enum nl80211_iftype iftype)
2332 {
2333         if (!use_4addr) {
2334                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2335                         return -EBUSY;
2336                 return 0;
2337         }
2338
2339         switch (iftype) {
2340         case NL80211_IFTYPE_AP_VLAN:
2341                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2342                         return 0;
2343                 break;
2344         case NL80211_IFTYPE_STATION:
2345                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2346                         return 0;
2347                 break;
2348         default:
2349                 break;
2350         }
2351
2352         return -EOPNOTSUPP;
2353 }
2354
2355 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2356 {
2357         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2358         struct vif_params params;
2359         int err;
2360         enum nl80211_iftype otype, ntype;
2361         struct net_device *dev = info->user_ptr[1];
2362         u32 _flags, *flags = NULL;
2363         bool change = false;
2364
2365         memset(&params, 0, sizeof(params));
2366
2367         otype = ntype = dev->ieee80211_ptr->iftype;
2368
2369         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2370                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2371                 if (otype != ntype)
2372                         change = true;
2373                 if (ntype > NL80211_IFTYPE_MAX)
2374                         return -EINVAL;
2375         }
2376
2377         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2378                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2379
2380                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2381                         return -EINVAL;
2382                 if (netif_running(dev))
2383                         return -EBUSY;
2384
2385                 wdev_lock(wdev);
2386                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2387                              IEEE80211_MAX_MESH_ID_LEN);
2388                 wdev->mesh_id_up_len =
2389                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2390                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2391                        wdev->mesh_id_up_len);
2392                 wdev_unlock(wdev);
2393         }
2394
2395         if (info->attrs[NL80211_ATTR_4ADDR]) {
2396                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2397                 change = true;
2398                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2399                 if (err)
2400                         return err;
2401         } else {
2402                 params.use_4addr = -1;
2403         }
2404
2405         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2406                 if (ntype != NL80211_IFTYPE_MONITOR)
2407                         return -EINVAL;
2408                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2409                                           &_flags);
2410                 if (err)
2411                         return err;
2412
2413                 flags = &_flags;
2414                 change = true;
2415         }
2416
2417         if (flags && (*flags & NL80211_MNTR_FLAG_ACTIVE) &&
2418             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2419                 return -EOPNOTSUPP;
2420
2421         if (change)
2422                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2423         else
2424                 err = 0;
2425
2426         if (!err && params.use_4addr != -1)
2427                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2428
2429         return err;
2430 }
2431
2432 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2433 {
2434         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2435         struct vif_params params;
2436         struct wireless_dev *wdev;
2437         struct sk_buff *msg;
2438         int err;
2439         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2440         u32 flags;
2441
2442         memset(&params, 0, sizeof(params));
2443
2444         if (!info->attrs[NL80211_ATTR_IFNAME])
2445                 return -EINVAL;
2446
2447         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2448                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2449                 if (type > NL80211_IFTYPE_MAX)
2450                         return -EINVAL;
2451         }
2452
2453         if (!rdev->ops->add_virtual_intf ||
2454             !(rdev->wiphy.interface_modes & (1 << type)))
2455                 return -EOPNOTSUPP;
2456
2457         if (type == NL80211_IFTYPE_P2P_DEVICE && info->attrs[NL80211_ATTR_MAC]) {
2458                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2459                            ETH_ALEN);
2460                 if (!is_valid_ether_addr(params.macaddr))
2461                         return -EADDRNOTAVAIL;
2462         }
2463
2464         if (info->attrs[NL80211_ATTR_4ADDR]) {
2465                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2466                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2467                 if (err)
2468                         return err;
2469         }
2470
2471         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2472         if (!msg)
2473                 return -ENOMEM;
2474
2475         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2476                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2477                                   &flags);
2478
2479         if (!err && (flags & NL80211_MNTR_FLAG_ACTIVE) &&
2480             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2481                 return -EOPNOTSUPP;
2482
2483         wdev = rdev_add_virtual_intf(rdev,
2484                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2485                                 type, err ? NULL : &flags, &params);
2486         if (IS_ERR(wdev)) {
2487                 nlmsg_free(msg);
2488                 return PTR_ERR(wdev);
2489         }
2490
2491         switch (type) {
2492         case NL80211_IFTYPE_MESH_POINT:
2493                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2494                         break;
2495                 wdev_lock(wdev);
2496                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2497                              IEEE80211_MAX_MESH_ID_LEN);
2498                 wdev->mesh_id_up_len =
2499                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2500                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2501                        wdev->mesh_id_up_len);
2502                 wdev_unlock(wdev);
2503                 break;
2504         case NL80211_IFTYPE_P2P_DEVICE:
2505                 /*
2506                  * P2P Device doesn't have a netdev, so doesn't go
2507                  * through the netdev notifier and must be added here
2508                  */
2509                 mutex_init(&wdev->mtx);
2510                 INIT_LIST_HEAD(&wdev->event_list);
2511                 spin_lock_init(&wdev->event_lock);
2512                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2513                 spin_lock_init(&wdev->mgmt_registrations_lock);
2514
2515                 wdev->identifier = ++rdev->wdev_id;
2516                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2517                 rdev->devlist_generation++;
2518                 break;
2519         default:
2520                 break;
2521         }
2522
2523         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2524                                rdev, wdev) < 0) {
2525                 nlmsg_free(msg);
2526                 return -ENOBUFS;
2527         }
2528
2529         return genlmsg_reply(msg, info);
2530 }
2531
2532 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2533 {
2534         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2535         struct wireless_dev *wdev = info->user_ptr[1];
2536
2537         if (!rdev->ops->del_virtual_intf)
2538                 return -EOPNOTSUPP;
2539
2540         /*
2541          * If we remove a wireless device without a netdev then clear
2542          * user_ptr[1] so that nl80211_post_doit won't dereference it
2543          * to check if it needs to do dev_put(). Otherwise it crashes
2544          * since the wdev has been freed, unlike with a netdev where
2545          * we need the dev_put() for the netdev to really be freed.
2546          */
2547         if (!wdev->netdev)
2548                 info->user_ptr[1] = NULL;
2549
2550         return rdev_del_virtual_intf(rdev, wdev);
2551 }
2552
2553 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2554 {
2555         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2556         struct net_device *dev = info->user_ptr[1];
2557         u16 noack_map;
2558
2559         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2560                 return -EINVAL;
2561
2562         if (!rdev->ops->set_noack_map)
2563                 return -EOPNOTSUPP;
2564
2565         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2566
2567         return rdev_set_noack_map(rdev, dev, noack_map);
2568 }
2569
2570 struct get_key_cookie {
2571         struct sk_buff *msg;
2572         int error;
2573         int idx;
2574 };
2575
2576 static void get_key_callback(void *c, struct key_params *params)
2577 {
2578         struct nlattr *key;
2579         struct get_key_cookie *cookie = c;
2580
2581         if ((params->key &&
2582              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2583                      params->key_len, params->key)) ||
2584             (params->seq &&
2585              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2586                      params->seq_len, params->seq)) ||
2587             (params->cipher &&
2588              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2589                          params->cipher)))
2590                 goto nla_put_failure;
2591
2592         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2593         if (!key)
2594                 goto nla_put_failure;
2595
2596         if ((params->key &&
2597              nla_put(cookie->msg, NL80211_KEY_DATA,
2598                      params->key_len, params->key)) ||
2599             (params->seq &&
2600              nla_put(cookie->msg, NL80211_KEY_SEQ,
2601                      params->seq_len, params->seq)) ||
2602             (params->cipher &&
2603              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2604                          params->cipher)))
2605                 goto nla_put_failure;
2606
2607         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2608                 goto nla_put_failure;
2609
2610         nla_nest_end(cookie->msg, key);
2611
2612         return;
2613  nla_put_failure:
2614         cookie->error = 1;
2615 }
2616
2617 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2618 {
2619         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2620         int err;
2621         struct net_device *dev = info->user_ptr[1];
2622         u8 key_idx = 0;
2623         const u8 *mac_addr = NULL;
2624         bool pairwise;
2625         struct get_key_cookie cookie = {
2626                 .error = 0,
2627         };
2628         void *hdr;
2629         struct sk_buff *msg;
2630
2631         if (info->attrs[NL80211_ATTR_KEY_IDX])
2632                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2633
2634         if (key_idx > 5)
2635                 return -EINVAL;
2636
2637         if (info->attrs[NL80211_ATTR_MAC])
2638                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2639
2640         pairwise = !!mac_addr;
2641         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2642                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2643                 if (kt >= NUM_NL80211_KEYTYPES)
2644                         return -EINVAL;
2645                 if (kt != NL80211_KEYTYPE_GROUP &&
2646                     kt != NL80211_KEYTYPE_PAIRWISE)
2647                         return -EINVAL;
2648                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2649         }
2650
2651         if (!rdev->ops->get_key)
2652                 return -EOPNOTSUPP;
2653
2654         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2655         if (!msg)
2656                 return -ENOMEM;
2657
2658         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2659                              NL80211_CMD_NEW_KEY);
2660         if (IS_ERR(hdr))
2661                 return PTR_ERR(hdr);
2662
2663         cookie.msg = msg;
2664         cookie.idx = key_idx;
2665
2666         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2667             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2668                 goto nla_put_failure;
2669         if (mac_addr &&
2670             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2671                 goto nla_put_failure;
2672
2673         if (pairwise && mac_addr &&
2674             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2675                 return -ENOENT;
2676
2677         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2678                            get_key_callback);
2679
2680         if (err)
2681                 goto free_msg;
2682
2683         if (cookie.error)
2684                 goto nla_put_failure;
2685
2686         genlmsg_end(msg, hdr);
2687         return genlmsg_reply(msg, info);
2688
2689  nla_put_failure:
2690         err = -ENOBUFS;
2691  free_msg:
2692         nlmsg_free(msg);
2693         return err;
2694 }
2695
2696 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2697 {
2698         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2699         struct key_parse key;
2700         int err;
2701         struct net_device *dev = info->user_ptr[1];
2702
2703         err = nl80211_parse_key(info, &key);
2704         if (err)
2705                 return err;
2706
2707         if (key.idx < 0)
2708                 return -EINVAL;
2709
2710         /* only support setting default key */
2711         if (!key.def && !key.defmgmt)
2712                 return -EINVAL;
2713
2714         wdev_lock(dev->ieee80211_ptr);
2715
2716         if (key.def) {
2717                 if (!rdev->ops->set_default_key) {
2718                         err = -EOPNOTSUPP;
2719                         goto out;
2720                 }
2721
2722                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2723                 if (err)
2724                         goto out;
2725
2726                 err = rdev_set_default_key(rdev, dev, key.idx,
2727                                                  key.def_uni, key.def_multi);
2728
2729                 if (err)
2730                         goto out;
2731
2732 #ifdef CONFIG_CFG80211_WEXT
2733                 dev->ieee80211_ptr->wext.default_key = key.idx;
2734 #endif
2735         } else {
2736                 if (key.def_uni || !key.def_multi) {
2737                         err = -EINVAL;
2738                         goto out;
2739                 }
2740
2741                 if (!rdev->ops->set_default_mgmt_key) {
2742                         err = -EOPNOTSUPP;
2743                         goto out;
2744                 }
2745
2746                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2747                 if (err)
2748                         goto out;
2749
2750                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2751                 if (err)
2752                         goto out;
2753
2754 #ifdef CONFIG_CFG80211_WEXT
2755                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2756 #endif
2757         }
2758
2759  out:
2760         wdev_unlock(dev->ieee80211_ptr);
2761
2762         return err;
2763 }
2764
2765 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2766 {
2767         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2768         int err;
2769         struct net_device *dev = info->user_ptr[1];
2770         struct key_parse key;
2771         const u8 *mac_addr = NULL;
2772
2773         err = nl80211_parse_key(info, &key);
2774         if (err)
2775                 return err;
2776
2777         if (!key.p.key)
2778                 return -EINVAL;
2779
2780         if (info->attrs[NL80211_ATTR_MAC])
2781                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2782
2783         if (key.type == -1) {
2784                 if (mac_addr)
2785                         key.type = NL80211_KEYTYPE_PAIRWISE;
2786                 else
2787                         key.type = NL80211_KEYTYPE_GROUP;
2788         }
2789
2790         /* for now */
2791         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2792             key.type != NL80211_KEYTYPE_GROUP)
2793                 return -EINVAL;
2794
2795         if (!rdev->ops->add_key)
2796                 return -EOPNOTSUPP;
2797
2798         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2799                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2800                                            mac_addr))
2801                 return -EINVAL;
2802
2803         wdev_lock(dev->ieee80211_ptr);
2804         err = nl80211_key_allowed(dev->ieee80211_ptr);
2805         if (!err)
2806                 err = rdev_add_key(rdev, dev, key.idx,
2807                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2808                                     mac_addr, &key.p);
2809         wdev_unlock(dev->ieee80211_ptr);
2810
2811         return err;
2812 }
2813
2814 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2815 {
2816         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2817         int err;
2818         struct net_device *dev = info->user_ptr[1];
2819         u8 *mac_addr = NULL;
2820         struct key_parse key;
2821
2822         err = nl80211_parse_key(info, &key);
2823         if (err)
2824                 return err;
2825
2826         if (info->attrs[NL80211_ATTR_MAC])
2827                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2828
2829         if (key.type == -1) {
2830                 if (mac_addr)
2831                         key.type = NL80211_KEYTYPE_PAIRWISE;
2832                 else
2833                         key.type = NL80211_KEYTYPE_GROUP;
2834         }
2835
2836         /* for now */
2837         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2838             key.type != NL80211_KEYTYPE_GROUP)
2839                 return -EINVAL;
2840
2841         if (!rdev->ops->del_key)
2842                 return -EOPNOTSUPP;
2843
2844         wdev_lock(dev->ieee80211_ptr);
2845         err = nl80211_key_allowed(dev->ieee80211_ptr);
2846
2847         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2848             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2849                 err = -ENOENT;
2850
2851         if (!err)
2852                 err = rdev_del_key(rdev, dev, key.idx,
2853                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2854                                    mac_addr);
2855
2856 #ifdef CONFIG_CFG80211_WEXT
2857         if (!err) {
2858                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
2859                         dev->ieee80211_ptr->wext.default_key = -1;
2860                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2861                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2862         }
2863 #endif
2864         wdev_unlock(dev->ieee80211_ptr);
2865
2866         return err;
2867 }
2868
2869 /* This function returns an error or the number of nested attributes */
2870 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
2871 {
2872         struct nlattr *attr;
2873         int n_entries = 0, tmp;
2874
2875         nla_for_each_nested(attr, nl_attr, tmp) {
2876                 if (nla_len(attr) != ETH_ALEN)
2877                         return -EINVAL;
2878
2879                 n_entries++;
2880         }
2881
2882         return n_entries;
2883 }
2884
2885 /*
2886  * This function parses ACL information and allocates memory for ACL data.
2887  * On successful return, the calling function is responsible to free the
2888  * ACL buffer returned by this function.
2889  */
2890 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
2891                                                 struct genl_info *info)
2892 {
2893         enum nl80211_acl_policy acl_policy;
2894         struct nlattr *attr;
2895         struct cfg80211_acl_data *acl;
2896         int i = 0, n_entries, tmp;
2897
2898         if (!wiphy->max_acl_mac_addrs)
2899                 return ERR_PTR(-EOPNOTSUPP);
2900
2901         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
2902                 return ERR_PTR(-EINVAL);
2903
2904         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
2905         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
2906             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
2907                 return ERR_PTR(-EINVAL);
2908
2909         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
2910                 return ERR_PTR(-EINVAL);
2911
2912         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
2913         if (n_entries < 0)
2914                 return ERR_PTR(n_entries);
2915
2916         if (n_entries > wiphy->max_acl_mac_addrs)
2917                 return ERR_PTR(-ENOTSUPP);
2918
2919         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
2920                       GFP_KERNEL);
2921         if (!acl)
2922                 return ERR_PTR(-ENOMEM);
2923
2924         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
2925                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
2926                 i++;
2927         }
2928
2929         acl->n_acl_entries = n_entries;
2930         acl->acl_policy = acl_policy;
2931
2932         return acl;
2933 }
2934
2935 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
2936 {
2937         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2938         struct net_device *dev = info->user_ptr[1];
2939         struct cfg80211_acl_data *acl;
2940         int err;
2941
2942         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2943             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2944                 return -EOPNOTSUPP;
2945
2946         if (!dev->ieee80211_ptr->beacon_interval)
2947                 return -EINVAL;
2948
2949         acl = parse_acl_data(&rdev->wiphy, info);
2950         if (IS_ERR(acl))
2951                 return PTR_ERR(acl);
2952
2953         err = rdev_set_mac_acl(rdev, dev, acl);
2954
2955         kfree(acl);
2956
2957         return err;
2958 }
2959
2960 static int nl80211_parse_beacon(struct nlattr *attrs[],
2961                                 struct cfg80211_beacon_data *bcn)
2962 {
2963         bool haveinfo = false;
2964
2965         if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
2966             !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
2967             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
2968             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2969                 return -EINVAL;
2970
2971         memset(bcn, 0, sizeof(*bcn));
2972
2973         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
2974                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
2975                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
2976                 if (!bcn->head_len)
2977                         return -EINVAL;
2978                 haveinfo = true;
2979         }
2980
2981         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
2982                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
2983                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
2984                 haveinfo = true;
2985         }
2986
2987         if (!haveinfo)
2988                 return -EINVAL;
2989
2990         if (attrs[NL80211_ATTR_IE]) {
2991                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
2992                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
2993         }
2994
2995         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
2996                 bcn->proberesp_ies =
2997                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
2998                 bcn->proberesp_ies_len =
2999                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3000         }
3001
3002         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3003                 bcn->assocresp_ies =
3004                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3005                 bcn->assocresp_ies_len =
3006                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3007         }
3008
3009         if (attrs[NL80211_ATTR_PROBE_RESP]) {
3010                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
3011                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3012         }
3013
3014         return 0;
3015 }
3016
3017 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
3018                                    struct cfg80211_ap_settings *params)
3019 {
3020         struct wireless_dev *wdev;
3021         bool ret = false;
3022
3023         list_for_each_entry(wdev, &rdev->wdev_list, list) {
3024                 if (wdev->iftype != NL80211_IFTYPE_AP &&
3025                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
3026                         continue;
3027
3028                 if (!wdev->preset_chandef.chan)
3029                         continue;
3030
3031                 params->chandef = wdev->preset_chandef;
3032                 ret = true;
3033                 break;
3034         }
3035
3036         return ret;
3037 }
3038
3039 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3040                                     enum nl80211_auth_type auth_type,
3041                                     enum nl80211_commands cmd)
3042 {
3043         if (auth_type > NL80211_AUTHTYPE_MAX)
3044                 return false;
3045
3046         switch (cmd) {
3047         case NL80211_CMD_AUTHENTICATE:
3048                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3049                     auth_type == NL80211_AUTHTYPE_SAE)
3050                         return false;
3051                 return true;
3052         case NL80211_CMD_CONNECT:
3053         case NL80211_CMD_START_AP:
3054                 /* SAE not supported yet */
3055                 if (auth_type == NL80211_AUTHTYPE_SAE)
3056                         return false;
3057                 return true;
3058         default:
3059                 return false;
3060         }
3061 }
3062
3063 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3064 {
3065         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3066         struct net_device *dev = info->user_ptr[1];
3067         struct wireless_dev *wdev = dev->ieee80211_ptr;
3068         struct cfg80211_ap_settings params;
3069         int err;
3070         u8 radar_detect_width = 0;
3071
3072         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3073             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3074                 return -EOPNOTSUPP;
3075
3076         if (!rdev->ops->start_ap)
3077                 return -EOPNOTSUPP;
3078
3079         if (wdev->beacon_interval)
3080                 return -EALREADY;
3081
3082         memset(&params, 0, sizeof(params));
3083
3084         /* these are required for START_AP */
3085         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3086             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3087             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3088                 return -EINVAL;
3089
3090         err = nl80211_parse_beacon(info->attrs, &params.beacon);
3091         if (err)
3092                 return err;
3093
3094         params.beacon_interval =
3095                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3096         params.dtim_period =
3097                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3098
3099         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
3100         if (err)
3101                 return err;
3102
3103         /*
3104          * In theory, some of these attributes should be required here
3105          * but since they were not used when the command was originally
3106          * added, keep them optional for old user space programs to let
3107          * them continue to work with drivers that do not need the
3108          * additional information -- drivers must check!
3109          */
3110         if (info->attrs[NL80211_ATTR_SSID]) {
3111                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3112                 params.ssid_len =
3113                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3114                 if (params.ssid_len == 0 ||
3115                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3116                         return -EINVAL;
3117         }
3118
3119         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3120                 params.hidden_ssid = nla_get_u32(
3121                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3122                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3123                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3124                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3125                         return -EINVAL;
3126         }
3127
3128         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3129
3130         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3131                 params.auth_type = nla_get_u32(
3132                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3133                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3134                                              NL80211_CMD_START_AP))
3135                         return -EINVAL;
3136         } else
3137                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3138
3139         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3140                                       NL80211_MAX_NR_CIPHER_SUITES);
3141         if (err)
3142                 return err;
3143
3144         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3145                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3146                         return -EOPNOTSUPP;
3147                 params.inactivity_timeout = nla_get_u16(
3148                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3149         }
3150
3151         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3152                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3153                         return -EINVAL;
3154                 params.p2p_ctwindow =
3155                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3156                 if (params.p2p_ctwindow > 127)
3157                         return -EINVAL;
3158                 if (params.p2p_ctwindow != 0 &&
3159                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3160                         return -EINVAL;
3161         }
3162
3163         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3164                 u8 tmp;
3165
3166                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3167                         return -EINVAL;
3168                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3169                 if (tmp > 1)
3170                         return -EINVAL;
3171                 params.p2p_opp_ps = tmp;
3172                 if (params.p2p_opp_ps != 0 &&
3173                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3174                         return -EINVAL;
3175         }
3176
3177         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3178                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
3179                 if (err)
3180                         return err;
3181         } else if (wdev->preset_chandef.chan) {
3182                 params.chandef = wdev->preset_chandef;
3183         } else if (!nl80211_get_ap_channel(rdev, &params))
3184                 return -EINVAL;
3185
3186         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
3187                 return -EINVAL;
3188
3189         err = cfg80211_chandef_dfs_required(wdev->wiphy, &params.chandef);
3190         if (err < 0)
3191                 return err;
3192         if (err) {
3193                 radar_detect_width = BIT(params.chandef.width);
3194                 params.radar_required = true;
3195         }
3196
3197         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
3198                                            params.chandef.chan,
3199                                            CHAN_MODE_SHARED,
3200                                            radar_detect_width);
3201         if (err)
3202                 return err;
3203
3204         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3205                 params.acl = parse_acl_data(&rdev->wiphy, info);
3206                 if (IS_ERR(params.acl))
3207                         return PTR_ERR(params.acl);
3208         }
3209
3210         err = rdev_start_ap(rdev, dev, &params);
3211         if (!err) {
3212                 wdev->preset_chandef = params.chandef;
3213                 wdev->beacon_interval = params.beacon_interval;
3214                 wdev->channel = params.chandef.chan;
3215                 wdev->ssid_len = params.ssid_len;
3216                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3217         }
3218
3219         kfree(params.acl);
3220
3221         return err;
3222 }
3223
3224 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3225 {
3226         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3227         struct net_device *dev = info->user_ptr[1];
3228         struct wireless_dev *wdev = dev->ieee80211_ptr;
3229         struct cfg80211_beacon_data params;
3230         int err;
3231
3232         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3233             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3234                 return -EOPNOTSUPP;
3235
3236         if (!rdev->ops->change_beacon)
3237                 return -EOPNOTSUPP;
3238
3239         if (!wdev->beacon_interval)
3240                 return -EINVAL;
3241
3242         err = nl80211_parse_beacon(info->attrs, &params);
3243         if (err)
3244                 return err;
3245
3246         return rdev_change_beacon(rdev, dev, &params);
3247 }
3248
3249 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3250 {
3251         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3252         struct net_device *dev = info->user_ptr[1];
3253
3254         return cfg80211_stop_ap(rdev, dev);
3255 }
3256
3257 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3258         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3259         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3260         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3261         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3262         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3263         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3264 };
3265
3266 static int parse_station_flags(struct genl_info *info,
3267                                enum nl80211_iftype iftype,
3268                                struct station_parameters *params)
3269 {
3270         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3271         struct nlattr *nla;
3272         int flag;
3273
3274         /*
3275          * Try parsing the new attribute first so userspace
3276          * can specify both for older kernels.
3277          */
3278         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3279         if (nla) {
3280                 struct nl80211_sta_flag_update *sta_flags;
3281
3282                 sta_flags = nla_data(nla);
3283                 params->sta_flags_mask = sta_flags->mask;
3284                 params->sta_flags_set = sta_flags->set;
3285                 params->sta_flags_set &= params->sta_flags_mask;
3286                 if ((params->sta_flags_mask |
3287                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3288                         return -EINVAL;
3289                 return 0;
3290         }
3291
3292         /* if present, parse the old attribute */
3293
3294         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3295         if (!nla)
3296                 return 0;
3297
3298         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3299                              nla, sta_flags_policy))
3300                 return -EINVAL;
3301
3302         /*
3303          * Only allow certain flags for interface types so that
3304          * other attributes are silently ignored. Remember that
3305          * this is backward compatibility code with old userspace
3306          * and shouldn't be hit in other cases anyway.
3307          */
3308         switch (iftype) {
3309         case NL80211_IFTYPE_AP:
3310         case NL80211_IFTYPE_AP_VLAN:
3311         case NL80211_IFTYPE_P2P_GO:
3312                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3313                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3314                                          BIT(NL80211_STA_FLAG_WME) |
3315                                          BIT(NL80211_STA_FLAG_MFP);
3316                 break;
3317         case NL80211_IFTYPE_P2P_CLIENT:
3318         case NL80211_IFTYPE_STATION:
3319                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3320                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3321                 break;
3322         case NL80211_IFTYPE_MESH_POINT:
3323                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3324                                          BIT(NL80211_STA_FLAG_MFP) |
3325                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3326         default:
3327                 return -EINVAL;
3328         }
3329
3330         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3331                 if (flags[flag]) {
3332                         params->sta_flags_set |= (1<<flag);
3333
3334                         /* no longer support new API additions in old API */
3335                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3336                                 return -EINVAL;
3337                 }
3338         }
3339
3340         return 0;
3341 }
3342
3343 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3344                                  int attr)
3345 {
3346         struct nlattr *rate;
3347         u32 bitrate;
3348         u16 bitrate_compat;
3349
3350         rate = nla_nest_start(msg, attr);
3351         if (!rate)
3352                 return false;
3353
3354         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3355         bitrate = cfg80211_calculate_bitrate(info);
3356         /* report 16-bit bitrate only if we can */
3357         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3358         if (bitrate > 0 &&
3359             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3360                 return false;
3361         if (bitrate_compat > 0 &&
3362             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3363                 return false;
3364
3365         if (info->flags & RATE_INFO_FLAGS_MCS) {
3366                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3367                         return false;
3368                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3369                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3370                         return false;
3371                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3372                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3373                         return false;
3374         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3375                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3376                         return false;
3377                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3378                         return false;
3379                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3380                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3381                         return false;
3382                 if (info->flags & RATE_INFO_FLAGS_80_MHZ_WIDTH &&
3383                     nla_put_flag(msg, NL80211_RATE_INFO_80_MHZ_WIDTH))
3384                         return false;
3385                 if (info->flags & RATE_INFO_FLAGS_80P80_MHZ_WIDTH &&
3386                     nla_put_flag(msg, NL80211_RATE_INFO_80P80_MHZ_WIDTH))
3387                         return false;
3388                 if (info->flags & RATE_INFO_FLAGS_160_MHZ_WIDTH &&
3389                     nla_put_flag(msg, NL80211_RATE_INFO_160_MHZ_WIDTH))
3390                         return false;
3391                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3392                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3393                         return false;
3394         }
3395
3396         nla_nest_end(msg, rate);
3397         return true;
3398 }
3399
3400 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
3401                                int id)
3402 {
3403         void *attr;
3404         int i = 0;
3405
3406         if (!mask)
3407                 return true;
3408
3409         attr = nla_nest_start(msg, id);
3410         if (!attr)
3411                 return false;
3412
3413         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
3414                 if (!(mask & BIT(i)))
3415                         continue;
3416
3417                 if (nla_put_u8(msg, i, signal[i]))
3418                         return false;
3419         }
3420
3421         nla_nest_end(msg, attr);
3422
3423         return true;
3424 }
3425
3426 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
3427                                 int flags,
3428                                 struct cfg80211_registered_device *rdev,
3429                                 struct net_device *dev,
3430                                 const u8 *mac_addr, struct station_info *sinfo)
3431 {
3432         void *hdr;
3433         struct nlattr *sinfoattr, *bss_param;
3434
3435         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3436         if (!hdr)
3437                 return -1;
3438
3439         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3440             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3441             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3442                 goto nla_put_failure;
3443
3444         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3445         if (!sinfoattr)
3446                 goto nla_put_failure;
3447         if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
3448             nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
3449                         sinfo->connected_time))
3450                 goto nla_put_failure;
3451         if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
3452             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
3453                         sinfo->inactive_time))
3454                 goto nla_put_failure;
3455         if ((sinfo->filled & (STATION_INFO_RX_BYTES |
3456                               STATION_INFO_RX_BYTES64)) &&
3457             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3458                         (u32)sinfo->rx_bytes))
3459                 goto nla_put_failure;
3460         if ((sinfo->filled & (STATION_INFO_TX_BYTES |
3461                               STATION_INFO_TX_BYTES64)) &&
3462             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3463                         (u32)sinfo->tx_bytes))
3464                 goto nla_put_failure;
3465         if ((sinfo->filled & STATION_INFO_RX_BYTES64) &&
3466             nla_put_u64(msg, NL80211_STA_INFO_RX_BYTES64,
3467                         sinfo->rx_bytes))
3468                 goto nla_put_failure;
3469         if ((sinfo->filled & STATION_INFO_TX_BYTES64) &&
3470             nla_put_u64(msg, NL80211_STA_INFO_TX_BYTES64,
3471                         sinfo->tx_bytes))
3472                 goto nla_put_failure;
3473         if ((sinfo->filled & STATION_INFO_LLID) &&
3474             nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
3475                 goto nla_put_failure;
3476         if ((sinfo->filled & STATION_INFO_PLID) &&
3477             nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
3478                 goto nla_put_failure;
3479         if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
3480             nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
3481                        sinfo->plink_state))
3482                 goto nla_put_failure;
3483         switch (rdev->wiphy.signal_type) {
3484         case CFG80211_SIGNAL_TYPE_MBM:
3485                 if ((sinfo->filled & STATION_INFO_SIGNAL) &&
3486                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
3487                                sinfo->signal))
3488                         goto nla_put_failure;
3489                 if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
3490                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
3491                                sinfo->signal_avg))
3492                         goto nla_put_failure;
3493                 break;
3494         default:
3495                 break;
3496         }
3497         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL) {
3498                 if (!nl80211_put_signal(msg, sinfo->chains,
3499                                         sinfo->chain_signal,
3500                                         NL80211_STA_INFO_CHAIN_SIGNAL))
3501                         goto nla_put_failure;
3502         }
3503         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL_AVG) {
3504                 if (!nl80211_put_signal(msg, sinfo->chains,
3505                                         sinfo->chain_signal_avg,
3506                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
3507                         goto nla_put_failure;
3508         }
3509         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
3510                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3511                                           NL80211_STA_INFO_TX_BITRATE))
3512                         goto nla_put_failure;
3513         }
3514         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
3515                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3516                                           NL80211_STA_INFO_RX_BITRATE))
3517                         goto nla_put_failure;
3518         }
3519         if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
3520             nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
3521                         sinfo->rx_packets))
3522                 goto nla_put_failure;
3523         if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
3524             nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
3525                         sinfo->tx_packets))
3526                 goto nla_put_failure;
3527         if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
3528             nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
3529                         sinfo->tx_retries))
3530                 goto nla_put_failure;
3531         if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
3532             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
3533                         sinfo->tx_failed))
3534                 goto nla_put_failure;
3535         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
3536             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
3537                         sinfo->beacon_loss_count))
3538                 goto nla_put_failure;
3539         if ((sinfo->filled & STATION_INFO_LOCAL_PM) &&
3540             nla_put_u32(msg, NL80211_STA_INFO_LOCAL_PM,
3541                         sinfo->local_pm))
3542                 goto nla_put_failure;
3543         if ((sinfo->filled & STATION_INFO_PEER_PM) &&
3544             nla_put_u32(msg, NL80211_STA_INFO_PEER_PM,
3545                         sinfo->peer_pm))
3546                 goto nla_put_failure;
3547         if ((sinfo->filled & STATION_INFO_NONPEER_PM) &&
3548             nla_put_u32(msg, NL80211_STA_INFO_NONPEER_PM,
3549                         sinfo->nonpeer_pm))
3550                 goto nla_put_failure;
3551         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
3552                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3553                 if (!bss_param)
3554                         goto nla_put_failure;
3555
3556                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3557                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3558                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3559                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3560                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3561                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3562                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3563                                sinfo->bss_param.dtim_period) ||
3564                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3565                                 sinfo->bss_param.beacon_interval))
3566                         goto nla_put_failure;
3567
3568                 nla_nest_end(msg, bss_param);
3569         }
3570         if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
3571             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3572                     sizeof(struct nl80211_sta_flag_update),
3573                     &sinfo->sta_flags))
3574                 goto nla_put_failure;
3575         if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
3576                 nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
3577                             sinfo->t_offset))
3578                 goto nla_put_failure;
3579         nla_nest_end(msg, sinfoattr);
3580
3581         if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
3582             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3583                     sinfo->assoc_req_ies))
3584                 goto nla_put_failure;
3585
3586         return genlmsg_end(msg, hdr);
3587
3588  nla_put_failure:
3589         genlmsg_cancel(msg, hdr);
3590         return -EMSGSIZE;
3591 }
3592
3593 static int nl80211_dump_station(struct sk_buff *skb,
3594                                 struct netlink_callback *cb)
3595 {
3596         struct station_info sinfo;
3597         struct cfg80211_registered_device *dev;
3598         struct wireless_dev *wdev;
3599         u8 mac_addr[ETH_ALEN];
3600         int sta_idx = cb->args[2];
3601         int err;
3602
3603         err = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
3604         if (err)
3605                 return err;
3606
3607         if (!wdev->netdev) {
3608                 err = -EINVAL;
3609                 goto out_err;
3610         }
3611
3612         if (!dev->ops->dump_station) {
3613                 err = -EOPNOTSUPP;
3614                 goto out_err;
3615         }
3616
3617         while (1) {
3618                 memset(&sinfo, 0, sizeof(sinfo));
3619                 err = rdev_dump_station(dev, wdev->netdev, sta_idx,
3620                                         mac_addr, &sinfo);
3621                 if (err == -ENOENT)
3622                         break;
3623                 if (err)
3624                         goto out_err;
3625
3626                 if (nl80211_send_station(skb,
3627                                 NETLINK_CB(cb->skb).portid,
3628                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3629                                 dev, wdev->netdev, mac_addr,
3630                                 &sinfo) < 0)
3631                         goto out;
3632
3633                 sta_idx++;
3634         }
3635
3636
3637  out:
3638         cb->args[2] = sta_idx;
3639         err = skb->len;
3640  out_err:
3641         nl80211_finish_wdev_dump(dev);
3642
3643         return err;
3644 }
3645
3646 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3647 {
3648         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3649         struct net_device *dev = info->user_ptr[1];
3650         struct station_info sinfo;
3651         struct sk_buff *msg;
3652         u8 *mac_addr = NULL;
3653         int err;
3654
3655         memset(&sinfo, 0, sizeof(sinfo));
3656
3657         if (!info->attrs[NL80211_ATTR_MAC])
3658                 return -EINVAL;
3659
3660         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3661
3662         if (!rdev->ops->get_station)
3663                 return -EOPNOTSUPP;
3664
3665         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3666         if (err)
3667                 return err;
3668
3669         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3670         if (!msg)
3671                 return -ENOMEM;
3672
3673         if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3674                                  rdev, dev, mac_addr, &sinfo) < 0) {
3675                 nlmsg_free(msg);
3676                 return -ENOBUFS;
3677         }
3678
3679         return genlmsg_reply(msg, info);
3680 }
3681
3682 int cfg80211_check_station_change(struct wiphy *wiphy,
3683                                   struct station_parameters *params,
3684                                   enum cfg80211_station_type statype)
3685 {
3686         if (params->listen_interval != -1)
3687                 return -EINVAL;
3688         if (params->aid)
3689                 return -EINVAL;
3690
3691         /* When you run into this, adjust the code below for the new flag */
3692         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
3693
3694         switch (statype) {
3695         case CFG80211_STA_MESH_PEER_KERNEL:
3696         case CFG80211_STA_MESH_PEER_USER:
3697                 /*
3698                  * No ignoring the TDLS flag here -- the userspace mesh
3699                  * code doesn't have the bug of including TDLS in the
3700                  * mask everywhere.
3701                  */
3702                 if (params->sta_flags_mask &
3703                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3704                                   BIT(NL80211_STA_FLAG_MFP) |
3705                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3706                         return -EINVAL;
3707                 break;
3708         case CFG80211_STA_TDLS_PEER_SETUP:
3709         case CFG80211_STA_TDLS_PEER_ACTIVE:
3710                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3711                         return -EINVAL;
3712                 /* ignore since it can't change */
3713                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3714                 break;
3715         default:
3716                 /* disallow mesh-specific things */
3717                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3718                         return -EINVAL;
3719                 if (params->local_pm)
3720                         return -EINVAL;
3721                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3722                         return -EINVAL;
3723         }
3724
3725         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
3726             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
3727                 /* TDLS can't be set, ... */
3728                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3729                         return -EINVAL;
3730                 /*
3731                  * ... but don't bother the driver with it. This works around
3732                  * a hostapd/wpa_supplicant issue -- it always includes the
3733                  * TLDS_PEER flag in the mask even for AP mode.
3734                  */
3735                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3736         }
3737
3738         if (statype != CFG80211_STA_TDLS_PEER_SETUP) {
3739                 /* reject other things that can't change */
3740                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
3741                         return -EINVAL;
3742                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
3743                         return -EINVAL;
3744                 if (params->supported_rates)
3745                         return -EINVAL;
3746                 if (params->ext_capab || params->ht_capa || params->vht_capa)
3747                         return -EINVAL;
3748         }
3749
3750         if (statype != CFG80211_STA_AP_CLIENT) {
3751                 if (params->vlan)
3752                         return -EINVAL;
3753         }
3754
3755         switch (statype) {
3756         case CFG80211_STA_AP_MLME_CLIENT:
3757                 /* Use this only for authorizing/unauthorizing a station */
3758                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
3759                         return -EOPNOTSUPP;
3760                 break;
3761         case CFG80211_STA_AP_CLIENT:
3762                 /* accept only the listed bits */
3763                 if (params->sta_flags_mask &
3764                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3765                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3766                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
3767                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3768                                   BIT(NL80211_STA_FLAG_WME) |
3769                                   BIT(NL80211_STA_FLAG_MFP)))
3770                         return -EINVAL;
3771
3772                 /* but authenticated/associated only if driver handles it */
3773                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
3774                     params->sta_flags_mask &
3775                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3776                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
3777                         return -EINVAL;
3778                 break;
3779         case CFG80211_STA_IBSS:
3780         case CFG80211_STA_AP_STA:
3781                 /* reject any changes other than AUTHORIZED */
3782                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
3783                         return -EINVAL;
3784                 break;
3785         case CFG80211_STA_TDLS_PEER_SETUP:
3786                 /* reject any changes other than AUTHORIZED or WME */
3787                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3788                                                BIT(NL80211_STA_FLAG_WME)))
3789                         return -EINVAL;
3790                 /* force (at least) rates when authorizing */
3791                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
3792                     !params->supported_rates)
3793                         return -EINVAL;
3794                 break;
3795         case CFG80211_STA_TDLS_PEER_ACTIVE:
3796                 /* reject any changes */
3797                 return -EINVAL;
3798         case CFG80211_STA_MESH_PEER_KERNEL:
3799                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3800                         return -EINVAL;
3801                 break;
3802         case CFG80211_STA_MESH_PEER_USER:
3803                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3804                         return -EINVAL;
3805                 break;
3806         }
3807
3808         return 0;
3809 }
3810 EXPORT_SYMBOL(cfg80211_check_station_change);
3811
3812 /*
3813  * Get vlan interface making sure it is running and on the right wiphy.
3814  */
3815 static struct net_device *get_vlan(struct genl_info *info,
3816                                    struct cfg80211_registered_device *rdev)
3817 {
3818         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
3819         struct net_device *v;
3820         int ret;
3821
3822         if (!vlanattr)
3823                 return NULL;
3824
3825         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
3826         if (!v)
3827                 return ERR_PTR(-ENODEV);
3828
3829         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
3830                 ret = -EINVAL;
3831                 goto error;
3832         }
3833
3834         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
3835             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3836             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
3837                 ret = -EINVAL;
3838                 goto error;
3839         }
3840
3841         if (!netif_running(v)) {
3842                 ret = -ENETDOWN;
3843                 goto error;
3844         }
3845
3846         return v;
3847  error:
3848         dev_put(v);
3849         return ERR_PTR(ret);
3850 }
3851
3852 static struct nla_policy
3853 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
3854         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
3855         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
3856 };
3857
3858 static int nl80211_parse_sta_wme(struct genl_info *info,
3859                                  struct station_parameters *params)
3860 {
3861         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
3862         struct nlattr *nla;
3863         int err;
3864
3865         /* parse WME attributes if present */
3866         if (!info->attrs[NL80211_ATTR_STA_WME])
3867                 return 0;
3868
3869         nla = info->attrs[NL80211_ATTR_STA_WME];
3870         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
3871                                nl80211_sta_wme_policy);
3872         if (err)
3873                 return err;
3874
3875         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
3876                 params->uapsd_queues = nla_get_u8(
3877                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
3878         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
3879                 return -EINVAL;
3880
3881         if (tb[NL80211_STA_WME_MAX_SP])
3882                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
3883
3884         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
3885                 return -EINVAL;
3886
3887         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
3888
3889         return 0;
3890 }
3891
3892 static int nl80211_set_station_tdls(struct genl_info *info,
3893                                     struct station_parameters *params)
3894 {
3895         /* Dummy STA entry gets updated once the peer capabilities are known */
3896         if (info->attrs[NL80211_ATTR_PEER_AID])
3897                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
3898         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3899                 params->ht_capa =
3900                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3901         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
3902                 params->vht_capa =
3903                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
3904
3905         return nl80211_parse_sta_wme(info, params);
3906 }
3907
3908 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
3909 {
3910         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3911         struct net_device *dev = info->user_ptr[1];
3912         struct station_parameters params;
3913         u8 *mac_addr;
3914         int err;
3915
3916         memset(&params, 0, sizeof(params));
3917
3918         params.listen_interval = -1;
3919
3920         if (!rdev->ops->change_station)
3921                 return -EOPNOTSUPP;
3922
3923         if (info->attrs[NL80211_ATTR_STA_AID])
3924                 return -EINVAL;
3925
3926         if (!info->attrs[NL80211_ATTR_MAC])
3927                 return -EINVAL;
3928
3929         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3930
3931         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
3932                 params.supported_rates =
3933                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3934                 params.supported_rates_len =
3935                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3936         }
3937
3938         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
3939                 params.capability =
3940                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
3941                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
3942         }
3943
3944         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
3945                 params.ext_capab =
3946                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3947                 params.ext_capab_len =
3948                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3949         }
3950
3951         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3952                 return -EINVAL;
3953
3954         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3955                 return -EINVAL;
3956
3957         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
3958                 params.plink_action =
3959                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3960                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
3961                         return -EINVAL;
3962         }
3963
3964         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
3965                 params.plink_state =
3966                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
3967                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
3968                         return -EINVAL;
3969                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
3970         }
3971
3972         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
3973                 enum nl80211_mesh_power_mode pm = nla_get_u32(
3974                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
3975
3976                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
3977                     pm > NL80211_MESH_POWER_MAX)
3978                         return -EINVAL;
3979
3980                 params.local_pm = pm;
3981         }
3982
3983         /* Include parameters for TDLS peer (will check later) */
3984         err = nl80211_set_station_tdls(info, &params);
3985         if (err)
3986                 return err;
3987
3988         params.vlan = get_vlan(info, rdev);
3989         if (IS_ERR(params.vlan))
3990                 return PTR_ERR(params.vlan);
3991
3992         switch (dev->ieee80211_ptr->iftype) {
3993         case NL80211_IFTYPE_AP:
3994         case NL80211_IFTYPE_AP_VLAN:
3995         case NL80211_IFTYPE_P2P_GO:
3996         case NL80211_IFTYPE_P2P_CLIENT:
3997         case NL80211_IFTYPE_STATION:
3998         case NL80211_IFTYPE_ADHOC:
3999         case NL80211_IFTYPE_MESH_POINT:
4000                 break;
4001         default:
4002                 err = -EOPNOTSUPP;
4003                 goto out_put_vlan;
4004         }
4005
4006         /* driver will call cfg80211_check_station_change() */
4007         err = rdev_change_station(rdev, dev, mac_addr, &params);
4008
4009  out_put_vlan:
4010         if (params.vlan)
4011                 dev_put(params.vlan);
4012
4013         return err;
4014 }
4015
4016 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
4017 {
4018         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4019         int err;
4020         struct net_device *dev = info->user_ptr[1];
4021         struct station_parameters params;
4022         u8 *mac_addr = NULL;
4023
4024         memset(&params, 0, sizeof(params));
4025
4026         if (!rdev->ops->add_station)
4027                 return -EOPNOTSUPP;
4028
4029         if (!info->attrs[NL80211_ATTR_MAC])
4030                 return -EINVAL;
4031
4032         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4033                 return -EINVAL;
4034
4035         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
4036                 return -EINVAL;
4037
4038         if (!info->attrs[NL80211_ATTR_STA_AID] &&
4039             !info->attrs[NL80211_ATTR_PEER_AID])
4040                 return -EINVAL;
4041
4042         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4043         params.supported_rates =
4044                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4045         params.supported_rates_len =
4046                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4047         params.listen_interval =
4048                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4049
4050         if (info->attrs[NL80211_ATTR_PEER_AID])
4051                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4052         else
4053                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4054         if (!params.aid || params.aid > IEEE80211_MAX_AID)
4055                 return -EINVAL;
4056
4057         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4058                 params.capability =
4059                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4060                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4061         }
4062
4063         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4064                 params.ext_capab =
4065                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4066                 params.ext_capab_len =
4067                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4068         }
4069
4070         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4071                 params.ht_capa =
4072                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4073
4074         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4075                 params.vht_capa =
4076                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4077
4078         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4079                 params.plink_action =
4080                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4081                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4082                         return -EINVAL;
4083         }
4084
4085         err = nl80211_parse_sta_wme(info, &params);
4086         if (err)
4087                 return err;
4088
4089         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4090                 return -EINVAL;
4091
4092         /* When you run into this, adjust the code below for the new flag */
4093         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4094
4095         switch (dev->ieee80211_ptr->iftype) {
4096         case NL80211_IFTYPE_AP:
4097         case NL80211_IFTYPE_AP_VLAN:
4098         case NL80211_IFTYPE_P2P_GO:
4099                 /* ignore WME attributes if iface/sta is not capable */
4100                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
4101                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
4102                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4103
4104                 /* TDLS peers cannot be added */
4105                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4106                     info->attrs[NL80211_ATTR_PEER_AID])
4107                         return -EINVAL;
4108                 /* but don't bother the driver with it */
4109                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4110
4111                 /* allow authenticated/associated only if driver handles it */
4112                 if (!(rdev->wiphy.features &
4113                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4114                     params.sta_flags_mask &
4115                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4116                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4117                         return -EINVAL;
4118
4119                 /* must be last in here for error handling */
4120                 params.vlan = get_vlan(info, rdev);
4121                 if (IS_ERR(params.vlan))
4122                         return PTR_ERR(params.vlan);
4123                 break;
4124         case NL80211_IFTYPE_MESH_POINT:
4125                 /* ignore uAPSD data */
4126                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4127
4128                 /* associated is disallowed */
4129                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
4130                         return -EINVAL;
4131                 /* TDLS peers cannot be added */
4132                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4133                     info->attrs[NL80211_ATTR_PEER_AID])
4134                         return -EINVAL;
4135                 break;
4136         case NL80211_IFTYPE_STATION:
4137         case NL80211_IFTYPE_P2P_CLIENT:
4138                 /* ignore uAPSD data */
4139                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4140
4141                 /* these are disallowed */
4142                 if (params.sta_flags_mask &
4143                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
4144                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4145                         return -EINVAL;
4146                 /* Only TDLS peers can be added */
4147                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4148                         return -EINVAL;
4149                 /* Can only add if TDLS ... */
4150                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
4151                         return -EOPNOTSUPP;
4152                 /* ... with external setup is supported */
4153                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
4154                         return -EOPNOTSUPP;
4155                 /*
4156                  * Older wpa_supplicant versions always mark the TDLS peer
4157                  * as authorized, but it shouldn't yet be.
4158                  */
4159                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4160                 break;
4161         default:
4162                 return -EOPNOTSUPP;
4163         }
4164
4165         /* be aware of params.vlan when changing code here */
4166
4167         err = rdev_add_station(rdev, dev, mac_addr, &params);
4168
4169         if (params.vlan)
4170                 dev_put(params.vlan);
4171         return err;
4172 }
4173
4174 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
4175 {
4176         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4177         struct net_device *dev = info->user_ptr[1];
4178         u8 *mac_addr = NULL;
4179
4180         if (info->attrs[NL80211_ATTR_MAC])
4181                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4182
4183         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4184             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4185             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4186             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4187                 return -EINVAL;
4188
4189         if (!rdev->ops->del_station)
4190                 return -EOPNOTSUPP;
4191
4192         return rdev_del_station(rdev, dev, mac_addr);
4193 }
4194
4195 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4196                                 int flags, struct net_device *dev,
4197                                 u8 *dst, u8 *next_hop,
4198                                 struct mpath_info *pinfo)
4199 {
4200         void *hdr;
4201         struct nlattr *pinfoattr;
4202
4203         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
4204         if (!hdr)
4205                 return -1;
4206
4207         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4208             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
4209             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
4210             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
4211                 goto nla_put_failure;
4212
4213         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
4214         if (!pinfoattr)
4215                 goto nla_put_failure;
4216         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
4217             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
4218                         pinfo->frame_qlen))
4219                 goto nla_put_failure;
4220         if (((pinfo->filled & MPATH_INFO_SN) &&
4221              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
4222             ((pinfo->filled & MPATH_INFO_METRIC) &&
4223              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
4224                          pinfo->metric)) ||
4225             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
4226              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
4227                          pinfo->exptime)) ||
4228             ((pinfo->filled & MPATH_INFO_FLAGS) &&
4229              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
4230                         pinfo->flags)) ||
4231             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
4232              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
4233                          pinfo->discovery_timeout)) ||
4234             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
4235              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
4236                         pinfo->discovery_retries)))
4237                 goto nla_put_failure;
4238
4239         nla_nest_end(msg, pinfoattr);
4240
4241         return genlmsg_end(msg, hdr);
4242
4243  nla_put_failure:
4244         genlmsg_cancel(msg, hdr);
4245         return -EMSGSIZE;
4246 }
4247
4248 static int nl80211_dump_mpath(struct sk_buff *skb,
4249                               struct netlink_callback *cb)
4250 {
4251         struct mpath_info pinfo;
4252         struct cfg80211_registered_device *dev;
4253         struct wireless_dev *wdev;
4254         u8 dst[ETH_ALEN];
4255         u8 next_hop[ETH_ALEN];
4256         int path_idx = cb->args[2];
4257         int err;
4258
4259         err = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
4260         if (err)
4261                 return err;
4262
4263         if (!dev->ops->dump_mpath) {
4264                 err = -EOPNOTSUPP;
4265                 goto out_err;
4266         }
4267
4268         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4269                 err = -EOPNOTSUPP;
4270                 goto out_err;
4271         }
4272
4273         while (1) {
4274                 err = rdev_dump_mpath(dev, wdev->netdev, path_idx, dst,
4275                                       next_hop, &pinfo);
4276                 if (err == -ENOENT)
4277                         break;
4278                 if (err)
4279                         goto out_err;
4280
4281                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4282                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4283                                        wdev->netdev, dst, next_hop,
4284                                        &pinfo) < 0)
4285                         goto out;
4286
4287                 path_idx++;
4288         }
4289
4290
4291  out:
4292         cb->args[2] = path_idx;
4293         err = skb->len;
4294  out_err:
4295         nl80211_finish_wdev_dump(dev);
4296         return err;
4297 }
4298
4299 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
4300 {
4301         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4302         int err;
4303         struct net_device *dev = info->user_ptr[1];
4304         struct mpath_info pinfo;
4305         struct sk_buff *msg;
4306         u8 *dst = NULL;
4307         u8 next_hop[ETH_ALEN];
4308
4309         memset(&pinfo, 0, sizeof(pinfo));
4310
4311         if (!info->attrs[NL80211_ATTR_MAC])
4312                 return -EINVAL;
4313
4314         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4315
4316         if (!rdev->ops->get_mpath)
4317                 return -EOPNOTSUPP;
4318
4319         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4320                 return -EOPNOTSUPP;
4321
4322         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4323         if (err)
4324                 return err;
4325
4326         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4327         if (!msg)
4328                 return -ENOMEM;
4329
4330         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4331                                  dev, dst, next_hop, &pinfo) < 0) {
4332                 nlmsg_free(msg);
4333                 return -ENOBUFS;
4334         }
4335
4336         return genlmsg_reply(msg, info);
4337 }
4338
4339 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
4340 {
4341         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4342         struct net_device *dev = info->user_ptr[1];
4343         u8 *dst = NULL;
4344         u8 *next_hop = NULL;
4345
4346         if (!info->attrs[NL80211_ATTR_MAC])
4347                 return -EINVAL;
4348
4349         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4350                 return -EINVAL;
4351
4352         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4353         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4354
4355         if (!rdev->ops->change_mpath)
4356                 return -EOPNOTSUPP;
4357
4358         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4359                 return -EOPNOTSUPP;
4360
4361         return rdev_change_mpath(rdev, dev, dst, next_hop);
4362 }
4363
4364 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
4365 {
4366         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4367         struct net_device *dev = info->user_ptr[1];
4368         u8 *dst = NULL;
4369         u8 *next_hop = NULL;
4370
4371         if (!info->attrs[NL80211_ATTR_MAC])
4372                 return -EINVAL;
4373
4374         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4375                 return -EINVAL;
4376
4377         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4378         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4379
4380         if (!rdev->ops->add_mpath)
4381                 return -EOPNOTSUPP;
4382
4383         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4384                 return -EOPNOTSUPP;
4385
4386         return rdev_add_mpath(rdev, dev, dst, next_hop);
4387 }
4388
4389 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
4390 {
4391         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4392         struct net_device *dev = info->user_ptr[1];
4393         u8 *dst = NULL;
4394
4395         if (info->attrs[NL80211_ATTR_MAC])
4396                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4397
4398         if (!rdev->ops->del_mpath)
4399                 return -EOPNOTSUPP;
4400
4401         return rdev_del_mpath(rdev, dev, dst);
4402 }
4403
4404 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
4405 {
4406         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4407         struct net_device *dev = info->user_ptr[1];
4408         struct bss_parameters params;
4409
4410         memset(&params, 0, sizeof(params));
4411         /* default to not changing parameters */
4412         params.use_cts_prot = -1;
4413         params.use_short_preamble = -1;
4414         params.use_short_slot_time = -1;
4415         params.ap_isolate = -1;
4416         params.ht_opmode = -1;
4417         params.p2p_ctwindow = -1;
4418         params.p2p_opp_ps = -1;
4419
4420         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
4421                 params.use_cts_prot =
4422                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
4423         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
4424                 params.use_short_preamble =
4425                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
4426         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
4427                 params.use_short_slot_time =
4428                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4429         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4430                 params.basic_rates =
4431                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4432                 params.basic_rates_len =
4433                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4434         }
4435         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
4436                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4437         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
4438                 params.ht_opmode =
4439                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4440
4441         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4442                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4443                         return -EINVAL;
4444                 params.p2p_ctwindow =
4445                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4446                 if (params.p2p_ctwindow < 0)
4447                         return -EINVAL;
4448                 if (params.p2p_ctwindow != 0 &&
4449                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4450                         return -EINVAL;
4451         }
4452
4453         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4454                 u8 tmp;
4455
4456                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4457                         return -EINVAL;
4458                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4459                 if (tmp > 1)
4460                         return -EINVAL;
4461                 params.p2p_opp_ps = tmp;
4462                 if (params.p2p_opp_ps &&
4463                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4464                         return -EINVAL;
4465         }
4466
4467         if (!rdev->ops->change_bss)
4468                 return -EOPNOTSUPP;
4469
4470         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4471             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4472                 return -EOPNOTSUPP;
4473
4474         return rdev_change_bss(rdev, dev, &params);
4475 }
4476
4477 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
4478         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
4479         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
4480         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
4481         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
4482         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
4483         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
4484 };
4485
4486 static int parse_reg_rule(struct nlattr *tb[],
4487         struct ieee80211_reg_rule *reg_rule)
4488 {
4489         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
4490         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
4491
4492         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
4493                 return -EINVAL;
4494         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
4495                 return -EINVAL;
4496         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
4497                 return -EINVAL;
4498         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
4499                 return -EINVAL;
4500         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
4501                 return -EINVAL;
4502
4503         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
4504
4505         freq_range->start_freq_khz =
4506                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
4507         freq_range->end_freq_khz =
4508                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
4509         freq_range->max_bandwidth_khz =
4510                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
4511
4512         power_rule->max_eirp =
4513                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
4514
4515         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
4516                 power_rule->max_antenna_gain =
4517                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
4518
4519         return 0;
4520 }
4521
4522 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
4523 {
4524         int r;
4525         char *data = NULL;
4526         enum nl80211_user_reg_hint_type user_reg_hint_type;
4527
4528         /*
4529          * You should only get this when cfg80211 hasn't yet initialized
4530          * completely when built-in to the kernel right between the time
4531          * window between nl80211_init() and regulatory_init(), if that is
4532          * even possible.
4533          */
4534         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4535                 return -EINPROGRESS;
4536
4537         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4538                 return -EINVAL;
4539
4540         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4541
4542         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
4543                 user_reg_hint_type =
4544                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
4545         else
4546                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
4547
4548         switch (user_reg_hint_type) {
4549         case NL80211_USER_REG_HINT_USER:
4550         case NL80211_USER_REG_HINT_CELL_BASE:
4551                 break;
4552         default:
4553                 return -EINVAL;
4554         }
4555
4556         r = regulatory_hint_user(data, user_reg_hint_type);
4557
4558         return r;
4559 }
4560
4561 static int nl80211_get_mesh_config(struct sk_buff *skb,
4562                                    struct genl_info *info)
4563 {
4564         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4565         struct net_device *dev = info->user_ptr[1];
4566         struct wireless_dev *wdev = dev->ieee80211_ptr;
4567         struct mesh_config cur_params;
4568         int err = 0;
4569         void *hdr;
4570         struct nlattr *pinfoattr;
4571         struct sk_buff *msg;
4572
4573         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4574                 return -EOPNOTSUPP;
4575
4576         if (!rdev->ops->get_mesh_config)
4577                 return -EOPNOTSUPP;
4578
4579         wdev_lock(wdev);
4580         /* If not connected, get default parameters */
4581         if (!wdev->mesh_id_len)
4582                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
4583         else
4584                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
4585         wdev_unlock(wdev);
4586
4587         if (err)
4588                 return err;
4589
4590         /* Draw up a netlink message to send back */
4591         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4592         if (!msg)
4593                 return -ENOMEM;
4594         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4595                              NL80211_CMD_GET_MESH_CONFIG);
4596         if (!hdr)
4597                 goto out;
4598         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
4599         if (!pinfoattr)
4600                 goto nla_put_failure;
4601         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4602             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
4603                         cur_params.dot11MeshRetryTimeout) ||
4604             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4605                         cur_params.dot11MeshConfirmTimeout) ||
4606             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
4607                         cur_params.dot11MeshHoldingTimeout) ||
4608             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
4609                         cur_params.dot11MeshMaxPeerLinks) ||
4610             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
4611                        cur_params.dot11MeshMaxRetries) ||
4612             nla_put_u8(msg, NL80211_MESHCONF_TTL,
4613                        cur_params.dot11MeshTTL) ||
4614             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
4615                        cur_params.element_ttl) ||
4616             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4617                        cur_params.auto_open_plinks) ||
4618             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4619                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
4620             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4621                        cur_params.dot11MeshHWMPmaxPREQretries) ||
4622             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
4623                         cur_params.path_refresh_time) ||
4624             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4625                         cur_params.min_discovery_timeout) ||
4626             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4627                         cur_params.dot11MeshHWMPactivePathTimeout) ||
4628             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4629                         cur_params.dot11MeshHWMPpreqMinInterval) ||
4630             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4631                         cur_params.dot11MeshHWMPperrMinInterval) ||
4632             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4633                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
4634             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
4635                        cur_params.dot11MeshHWMPRootMode) ||
4636             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4637                         cur_params.dot11MeshHWMPRannInterval) ||
4638             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4639                        cur_params.dot11MeshGateAnnouncementProtocol) ||
4640             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
4641                        cur_params.dot11MeshForwarding) ||
4642             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
4643                         cur_params.rssi_threshold) ||
4644             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
4645                         cur_params.ht_opmode) ||
4646             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4647                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
4648             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4649                         cur_params.dot11MeshHWMProotInterval) ||
4650             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4651                         cur_params.dot11MeshHWMPconfirmationInterval) ||
4652             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
4653                         cur_params.power_mode) ||
4654             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
4655                         cur_params.dot11MeshAwakeWindowDuration) ||
4656             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
4657                         cur_params.plink_timeout))
4658                 goto nla_put_failure;
4659         nla_nest_end(msg, pinfoattr);
4660         genlmsg_end(msg, hdr);
4661         return genlmsg_reply(msg, info);
4662
4663  nla_put_failure:
4664         genlmsg_cancel(msg, hdr);
4665  out:
4666         nlmsg_free(msg);
4667         return -ENOBUFS;
4668 }
4669
4670 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
4671         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
4672         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
4673         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
4674         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
4675         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
4676         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
4677         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
4678         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
4679         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
4680         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
4681         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
4682         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
4683         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
4684         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
4685         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
4686         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
4687         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
4688         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
4689         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
4690         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
4691         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
4692         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
4693         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
4694         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
4695         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
4696         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
4697         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
4698         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
4699 };
4700
4701 static const struct nla_policy
4702         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
4703         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
4704         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
4705         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
4706         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
4707         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
4708         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
4709         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
4710                                     .len = IEEE80211_MAX_DATA_LEN },
4711         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
4712 };
4713
4714 static int nl80211_parse_mesh_config(struct genl_info *info,
4715                                      struct mesh_config *cfg,
4716                                      u32 *mask_out)
4717 {
4718         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
4719         u32 mask = 0;
4720
4721 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
4722 do {                                                                        \
4723         if (tb[attr]) {                                                     \
4724                 if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
4725                         return -EINVAL;                                     \
4726                 cfg->param = fn(tb[attr]);                                  \
4727                 mask |= (1 << (attr - 1));                                  \
4728         }                                                                   \
4729 } while (0)
4730
4731
4732         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
4733                 return -EINVAL;
4734         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
4735                              info->attrs[NL80211_ATTR_MESH_CONFIG],
4736                              nl80211_meshconf_params_policy))
4737                 return -EINVAL;
4738
4739         /* This makes sure that there aren't more than 32 mesh config
4740          * parameters (otherwise our bitfield scheme would not work.) */
4741         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
4742
4743         /* Fill in the params struct */
4744         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
4745                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
4746                                   nla_get_u16);
4747         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
4748                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4749                                   nla_get_u16);
4750         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
4751                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
4752                                   nla_get_u16);
4753         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
4754                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
4755                                   nla_get_u16);
4756         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
4757                                   mask, NL80211_MESHCONF_MAX_RETRIES,
4758                                   nla_get_u8);
4759         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
4760                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
4761         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
4762                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
4763                                   nla_get_u8);
4764         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
4765                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4766                                   nla_get_u8);
4767         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
4768                                   1, 255, mask,
4769                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4770                                   nla_get_u32);
4771         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
4772                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4773                                   nla_get_u8);
4774         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
4775                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
4776                                   nla_get_u32);
4777         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
4778                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4779                                   nla_get_u16);
4780         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
4781                                   1, 65535, mask,
4782                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4783                                   nla_get_u32);
4784         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
4785                                   1, 65535, mask,
4786                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4787                                   nla_get_u16);
4788         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
4789                                   1, 65535, mask,
4790                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4791                                   nla_get_u16);
4792         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4793                                   dot11MeshHWMPnetDiameterTraversalTime,
4794                                   1, 65535, mask,
4795                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4796                                   nla_get_u16);
4797         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
4798                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
4799                                   nla_get_u8);
4800         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
4801                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4802                                   nla_get_u16);
4803         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4804                                   dot11MeshGateAnnouncementProtocol, 0, 1,
4805                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4806                                   nla_get_u8);
4807         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
4808                                   mask, NL80211_MESHCONF_FORWARDING,
4809                                   nla_get_u8);
4810         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
4811                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
4812                                   nla_get_s32);
4813         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
4814                                   mask, NL80211_MESHCONF_HT_OPMODE,
4815                                   nla_get_u16);
4816         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
4817                                   1, 65535, mask,
4818                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4819                                   nla_get_u32);
4820         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
4821                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4822                                   nla_get_u16);
4823         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4824                                   dot11MeshHWMPconfirmationInterval,
4825                                   1, 65535, mask,
4826                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4827                                   nla_get_u16);
4828         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
4829                                   NL80211_MESH_POWER_ACTIVE,
4830                                   NL80211_MESH_POWER_MAX,
4831                                   mask, NL80211_MESHCONF_POWER_MODE,
4832                                   nla_get_u32);
4833         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
4834                                   0, 65535, mask,
4835                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
4836         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 1, 0xffffffff,
4837                                   mask, NL80211_MESHCONF_PLINK_TIMEOUT,
4838                                   nla_get_u32);
4839         if (mask_out)
4840                 *mask_out = mask;
4841
4842         return 0;
4843
4844 #undef FILL_IN_MESH_PARAM_IF_SET
4845 }
4846
4847 static int nl80211_parse_mesh_setup(struct genl_info *info,
4848                                      struct mesh_setup *setup)
4849 {
4850         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4851         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
4852
4853         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
4854                 return -EINVAL;
4855         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
4856                              info->attrs[NL80211_ATTR_MESH_SETUP],
4857                              nl80211_mesh_setup_params_policy))
4858                 return -EINVAL;
4859
4860         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
4861                 setup->sync_method =
4862                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
4863                  IEEE80211_SYNC_METHOD_VENDOR :
4864                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
4865
4866         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
4867                 setup->path_sel_proto =
4868                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
4869                  IEEE80211_PATH_PROTOCOL_VENDOR :
4870                  IEEE80211_PATH_PROTOCOL_HWMP;
4871
4872         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
4873                 setup->path_metric =
4874                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
4875                  IEEE80211_PATH_METRIC_VENDOR :
4876                  IEEE80211_PATH_METRIC_AIRTIME;
4877
4878
4879         if (tb[NL80211_MESH_SETUP_IE]) {
4880                 struct nlattr *ieattr =
4881                         tb[NL80211_MESH_SETUP_IE];
4882                 if (!is_valid_ie_attr(ieattr))
4883                         return -EINVAL;
4884                 setup->ie = nla_data(ieattr);
4885                 setup->ie_len = nla_len(ieattr);
4886         }
4887         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
4888             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
4889                 return -EINVAL;
4890         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
4891         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
4892         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
4893         if (setup->is_secure)
4894                 setup->user_mpm = true;
4895
4896         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
4897                 if (!setup->user_mpm)
4898                         return -EINVAL;
4899                 setup->auth_id =
4900                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
4901         }
4902
4903         return 0;
4904 }
4905
4906 static int nl80211_update_mesh_config(struct sk_buff *skb,
4907                                       struct genl_info *info)
4908 {
4909         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4910         struct net_device *dev = info->user_ptr[1];
4911         struct wireless_dev *wdev = dev->ieee80211_ptr;
4912         struct mesh_config cfg;
4913         u32 mask;
4914         int err;
4915
4916         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4917                 return -EOPNOTSUPP;
4918
4919         if (!rdev->ops->update_mesh_config)
4920                 return -EOPNOTSUPP;
4921
4922         err = nl80211_parse_mesh_config(info, &cfg, &mask);
4923         if (err)
4924                 return err;
4925
4926         wdev_lock(wdev);
4927         if (!wdev->mesh_id_len)
4928                 err = -ENOLINK;
4929
4930         if (!err)
4931                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
4932
4933         wdev_unlock(wdev);
4934
4935         return err;
4936 }
4937
4938 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
4939 {
4940         const struct ieee80211_regdomain *regdom;
4941         struct sk_buff *msg;
4942         void *hdr = NULL;
4943         struct nlattr *nl_reg_rules;
4944         unsigned int i;
4945
4946         if (!cfg80211_regdomain)
4947                 return -EINVAL;
4948
4949         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4950         if (!msg)
4951                 return -ENOBUFS;
4952
4953         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4954                              NL80211_CMD_GET_REG);
4955         if (!hdr)
4956                 goto put_failure;
4957
4958         if (reg_last_request_cell_base() &&
4959             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
4960                         NL80211_USER_REG_HINT_CELL_BASE))
4961                 goto nla_put_failure;
4962
4963         rcu_read_lock();
4964         regdom = rcu_dereference(cfg80211_regdomain);
4965
4966         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
4967             (regdom->dfs_region &&
4968              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
4969                 goto nla_put_failure_rcu;
4970
4971         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
4972         if (!nl_reg_rules)
4973                 goto nla_put_failure_rcu;
4974
4975         for (i = 0; i < regdom->n_reg_rules; i++) {
4976                 struct nlattr *nl_reg_rule;
4977                 const struct ieee80211_reg_rule *reg_rule;
4978                 const struct ieee80211_freq_range *freq_range;
4979                 const struct ieee80211_power_rule *power_rule;
4980
4981                 reg_rule = &regdom->reg_rules[i];
4982                 freq_range = &reg_rule->freq_range;
4983                 power_rule = &reg_rule->power_rule;
4984
4985                 nl_reg_rule = nla_nest_start(msg, i);
4986                 if (!nl_reg_rule)
4987                         goto nla_put_failure_rcu;
4988
4989                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
4990                                 reg_rule->flags) ||
4991                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
4992                                 freq_range->start_freq_khz) ||
4993                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
4994                                 freq_range->end_freq_khz) ||
4995                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
4996                                 freq_range->max_bandwidth_khz) ||
4997                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
4998                                 power_rule->max_antenna_gain) ||
4999                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
5000                                 power_rule->max_eirp))
5001                         goto nla_put_failure_rcu;
5002
5003                 nla_nest_end(msg, nl_reg_rule);
5004         }
5005         rcu_read_unlock();
5006
5007         nla_nest_end(msg, nl_reg_rules);
5008
5009         genlmsg_end(msg, hdr);
5010         return genlmsg_reply(msg, info);
5011
5012 nla_put_failure_rcu:
5013         rcu_read_unlock();
5014 nla_put_failure:
5015         genlmsg_cancel(msg, hdr);
5016 put_failure:
5017         nlmsg_free(msg);
5018         return -EMSGSIZE;
5019 }
5020
5021 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
5022 {
5023         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
5024         struct nlattr *nl_reg_rule;
5025         char *alpha2 = NULL;
5026         int rem_reg_rules = 0, r = 0;
5027         u32 num_rules = 0, rule_idx = 0, size_of_regd;
5028         u8 dfs_region = 0;
5029         struct ieee80211_regdomain *rd = NULL;
5030
5031         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5032                 return -EINVAL;
5033
5034         if (!info->attrs[NL80211_ATTR_REG_RULES])
5035                 return -EINVAL;
5036
5037         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5038
5039         if (info->attrs[NL80211_ATTR_DFS_REGION])
5040                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
5041
5042         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5043                             rem_reg_rules) {
5044                 num_rules++;
5045                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
5046                         return -EINVAL;
5047         }
5048
5049         size_of_regd = sizeof(struct ieee80211_regdomain) +
5050                        num_rules * sizeof(struct ieee80211_reg_rule);
5051
5052         rd = kzalloc(size_of_regd, GFP_KERNEL);
5053         if (!rd)
5054                 return -ENOMEM;
5055
5056         rd->n_reg_rules = num_rules;
5057         rd->alpha2[0] = alpha2[0];
5058         rd->alpha2[1] = alpha2[1];
5059
5060         /*
5061          * Disable DFS master mode if the DFS region was
5062          * not supported or known on this kernel.
5063          */
5064         if (reg_supported_dfs_region(dfs_region))
5065                 rd->dfs_region = dfs_region;
5066
5067         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5068                             rem_reg_rules) {
5069                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
5070                           nla_data(nl_reg_rule), nla_len(nl_reg_rule),
5071                           reg_rule_policy);
5072                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
5073                 if (r)
5074                         goto bad_reg;
5075
5076                 rule_idx++;
5077
5078                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
5079                         r = -EINVAL;
5080                         goto bad_reg;
5081                 }
5082         }
5083
5084         r = set_regdom(rd);
5085         /* set_regdom took ownership */
5086         rd = NULL;
5087
5088  bad_reg:
5089         kfree(rd);
5090         return r;
5091 }
5092
5093 static int validate_scan_freqs(struct nlattr *freqs)
5094 {
5095         struct nlattr *attr1, *attr2;
5096         int n_channels = 0, tmp1, tmp2;
5097
5098         nla_for_each_nested(attr1, freqs, tmp1) {
5099                 n_channels++;
5100                 /*
5101                  * Some hardware has a limited channel list for
5102                  * scanning, and it is pretty much nonsensical
5103                  * to scan for a channel twice, so disallow that
5104                  * and don't require drivers to check that the
5105                  * channel list they get isn't longer than what
5106                  * they can scan, as long as they can scan all
5107                  * the channels they registered at once.
5108                  */
5109                 nla_for_each_nested(attr2, freqs, tmp2)
5110                         if (attr1 != attr2 &&
5111                             nla_get_u32(attr1) == nla_get_u32(attr2))
5112                                 return 0;
5113         }
5114
5115         return n_channels;
5116 }
5117
5118 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
5119 {
5120         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5121         struct wireless_dev *wdev = info->user_ptr[1];
5122         struct cfg80211_scan_request *request;
5123         struct nlattr *attr;
5124         struct wiphy *wiphy;
5125         int err, tmp, n_ssids = 0, n_channels, i;
5126         size_t ie_len;
5127
5128         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5129                 return -EINVAL;
5130
5131         wiphy = &rdev->wiphy;
5132
5133         if (!rdev->ops->scan)
5134                 return -EOPNOTSUPP;
5135
5136         if (rdev->scan_req) {
5137                 err = -EBUSY;
5138                 goto unlock;
5139         }
5140
5141         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5142                 n_channels = validate_scan_freqs(
5143                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5144                 if (!n_channels) {
5145                         err = -EINVAL;
5146                         goto unlock;
5147                 }
5148         } else {
5149                 enum ieee80211_band band;
5150                 n_channels = 0;
5151
5152                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
5153                         if (wiphy->bands[band])
5154                                 n_channels += wiphy->bands[band]->n_channels;
5155         }
5156
5157         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5158                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
5159                         n_ssids++;
5160
5161         if (n_ssids > wiphy->max_scan_ssids) {
5162                 err = -EINVAL;
5163                 goto unlock;
5164         }
5165
5166         if (info->attrs[NL80211_ATTR_IE])
5167                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5168         else
5169                 ie_len = 0;
5170
5171         if (ie_len > wiphy->max_scan_ie_len) {
5172                 err = -EINVAL;
5173                 goto unlock;
5174         }
5175
5176         request = kzalloc(sizeof(*request)
5177                         + sizeof(*request->ssids) * n_ssids
5178                         + sizeof(*request->channels) * n_channels
5179                         + ie_len, GFP_KERNEL);
5180         if (!request) {
5181                 err = -ENOMEM;
5182                 goto unlock;
5183         }
5184
5185         if (n_ssids)
5186                 request->ssids = (void *)&request->channels[n_channels];
5187         request->n_ssids = n_ssids;
5188         if (ie_len) {
5189                 if (request->ssids)
5190                         request->ie = (void *)(request->ssids + n_ssids);
5191                 else
5192                         request->ie = (void *)(request->channels + n_channels);
5193         }
5194
5195         i = 0;
5196         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5197                 /* user specified, bail out if channel not found */
5198                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
5199                         struct ieee80211_channel *chan;
5200
5201                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5202
5203                         if (!chan) {
5204                                 err = -EINVAL;
5205                                 goto out_free;
5206                         }
5207
5208                         /* ignore disabled channels */
5209                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5210                                 continue;
5211
5212                         request->channels[i] = chan;
5213                         i++;
5214                 }
5215         } else {
5216                 enum ieee80211_band band;
5217
5218                 /* all channels */
5219                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5220                         int j;
5221                         if (!wiphy->bands[band])
5222                                 continue;
5223                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5224                                 struct ieee80211_channel *chan;
5225
5226                                 chan = &wiphy->bands[band]->channels[j];
5227
5228                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5229                                         continue;
5230
5231                                 request->channels[i] = chan;
5232                                 i++;
5233                         }
5234                 }
5235         }
5236
5237         if (!i) {
5238                 err = -EINVAL;
5239                 goto out_free;
5240         }
5241
5242         request->n_channels = i;
5243
5244         i = 0;
5245         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5246                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
5247                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5248                                 err = -EINVAL;
5249                                 goto out_free;
5250                         }
5251                         request->ssids[i].ssid_len = nla_len(attr);
5252                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
5253                         i++;
5254                 }
5255         }
5256
5257         if (info->attrs[NL80211_ATTR_IE]) {
5258                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5259                 memcpy((void *)request->ie,
5260                        nla_data(info->attrs[NL80211_ATTR_IE]),
5261                        request->ie_len);
5262         }
5263
5264         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
5265                 if (wiphy->bands[i])
5266                         request->rates[i] =
5267                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
5268
5269         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
5270                 nla_for_each_nested(attr,
5271                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
5272                                     tmp) {
5273                         enum ieee80211_band band = nla_type(attr);
5274
5275                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
5276                                 err = -EINVAL;
5277                                 goto out_free;
5278                         }
5279                         err = ieee80211_get_ratemask(wiphy->bands[band],
5280                                                      nla_data(attr),
5281                                                      nla_len(attr),
5282                                                      &request->rates[band]);
5283                         if (err)
5284                                 goto out_free;
5285                 }
5286         }
5287
5288         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5289                 request->flags = nla_get_u32(
5290                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5291                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5292                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
5293                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
5294                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
5295                         err = -EOPNOTSUPP;
5296                         goto out_free;
5297                 }
5298         }
5299
5300         request->no_cck =
5301                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
5302
5303         request->wdev = wdev;
5304         request->wiphy = &rdev->wiphy;
5305         request->scan_start = jiffies;
5306
5307         rdev->scan_req = request;
5308         err = rdev_scan(rdev, request);
5309
5310         if (!err) {
5311                 nl80211_send_scan_start(rdev, wdev);
5312                 if (wdev->netdev)
5313                         dev_hold(wdev->netdev);
5314         } else {
5315  out_free:
5316                 rdev->scan_req = NULL;
5317                 kfree(request);
5318         }
5319
5320  unlock:
5321         return err;
5322 }
5323
5324 static int nl80211_start_sched_scan(struct sk_buff *skb,
5325                                     struct genl_info *info)
5326 {
5327         struct cfg80211_sched_scan_request *request;
5328         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5329         struct net_device *dev = info->user_ptr[1];
5330         struct nlattr *attr;
5331         struct wiphy *wiphy;
5332         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
5333         u32 interval;
5334         enum ieee80211_band band;
5335         size_t ie_len;
5336         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
5337
5338         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5339             !rdev->ops->sched_scan_start)
5340                 return -EOPNOTSUPP;
5341
5342         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5343                 return -EINVAL;
5344
5345         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
5346                 return -EINVAL;
5347
5348         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
5349         if (interval == 0)
5350                 return -EINVAL;
5351
5352         wiphy = &rdev->wiphy;
5353
5354         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5355                 n_channels = validate_scan_freqs(
5356                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5357                 if (!n_channels)
5358                         return -EINVAL;
5359         } else {
5360                 n_channels = 0;
5361
5362                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
5363                         if (wiphy->bands[band])
5364                                 n_channels += wiphy->bands[band]->n_channels;
5365         }
5366
5367         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5368                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5369                                     tmp)
5370                         n_ssids++;
5371
5372         if (n_ssids > wiphy->max_sched_scan_ssids)
5373                 return -EINVAL;
5374
5375         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
5376                 nla_for_each_nested(attr,
5377                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5378                                     tmp)
5379                         n_match_sets++;
5380
5381         if (n_match_sets > wiphy->max_match_sets)
5382                 return -EINVAL;
5383
5384         if (info->attrs[NL80211_ATTR_IE])
5385                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5386         else
5387                 ie_len = 0;
5388
5389         if (ie_len > wiphy->max_sched_scan_ie_len)
5390                 return -EINVAL;
5391
5392         if (rdev->sched_scan_req) {
5393                 err = -EINPROGRESS;
5394                 goto out;
5395         }
5396
5397         request = kzalloc(sizeof(*request)
5398                         + sizeof(*request->ssids) * n_ssids
5399                         + sizeof(*request->match_sets) * n_match_sets
5400                         + sizeof(*request->channels) * n_channels
5401                         + ie_len, GFP_KERNEL);
5402         if (!request) {
5403                 err = -ENOMEM;
5404                 goto out;
5405         }
5406
5407         if (n_ssids)
5408                 request->ssids = (void *)&request->channels[n_channels];
5409         request->n_ssids = n_ssids;
5410         if (ie_len) {
5411                 if (request->ssids)
5412                         request->ie = (void *)(request->ssids + n_ssids);
5413                 else
5414                         request->ie = (void *)(request->channels + n_channels);
5415         }
5416
5417         if (n_match_sets) {
5418                 if (request->ie)
5419                         request->match_sets = (void *)(request->ie + ie_len);
5420                 else if (request->ssids)
5421                         request->match_sets =
5422                                 (void *)(request->ssids + n_ssids);
5423                 else
5424                         request->match_sets =
5425                                 (void *)(request->channels + n_channels);
5426         }
5427         request->n_match_sets = n_match_sets;
5428
5429         i = 0;
5430         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5431                 /* user specified, bail out if channel not found */
5432                 nla_for_each_nested(attr,
5433                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
5434                                     tmp) {
5435                         struct ieee80211_channel *chan;
5436
5437                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5438
5439                         if (!chan) {
5440                                 err = -EINVAL;
5441                                 goto out_free;
5442                         }
5443
5444                         /* ignore disabled channels */
5445                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5446                                 continue;
5447
5448                         request->channels[i] = chan;
5449                         i++;
5450                 }
5451         } else {
5452                 /* all channels */
5453                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5454                         int j;
5455                         if (!wiphy->bands[band])
5456                                 continue;
5457                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5458                                 struct ieee80211_channel *chan;
5459
5460                                 chan = &wiphy->bands[band]->channels[j];
5461
5462                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5463                                         continue;
5464
5465                                 request->channels[i] = chan;
5466                                 i++;
5467                         }
5468                 }
5469         }
5470
5471         if (!i) {
5472                 err = -EINVAL;
5473                 goto out_free;
5474         }
5475
5476         request->n_channels = i;
5477
5478         i = 0;
5479         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5480                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5481                                     tmp) {
5482                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5483                                 err = -EINVAL;
5484                                 goto out_free;
5485                         }
5486                         request->ssids[i].ssid_len = nla_len(attr);
5487                         memcpy(request->ssids[i].ssid, nla_data(attr),
5488                                nla_len(attr));
5489                         i++;
5490                 }
5491         }
5492
5493         i = 0;
5494         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5495                 nla_for_each_nested(attr,
5496                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5497                                     tmp) {
5498                         struct nlattr *ssid, *rssi;
5499
5500                         nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5501                                   nla_data(attr), nla_len(attr),
5502                                   nl80211_match_policy);
5503                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
5504                         if (ssid) {
5505                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
5506                                         err = -EINVAL;
5507                                         goto out_free;
5508                                 }
5509                                 memcpy(request->match_sets[i].ssid.ssid,
5510                                        nla_data(ssid), nla_len(ssid));
5511                                 request->match_sets[i].ssid.ssid_len =
5512                                         nla_len(ssid);
5513                         }
5514                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5515                         if (rssi)
5516                                 request->rssi_thold = nla_get_u32(rssi);
5517                         else
5518                                 request->rssi_thold =
5519                                                    NL80211_SCAN_RSSI_THOLD_OFF;
5520                         i++;
5521                 }
5522         }
5523
5524         if (info->attrs[NL80211_ATTR_IE]) {
5525                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5526                 memcpy((void *)request->ie,
5527                        nla_data(info->attrs[NL80211_ATTR_IE]),
5528                        request->ie_len);
5529         }
5530
5531         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5532                 request->flags = nla_get_u32(
5533                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5534                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5535                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
5536                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
5537                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
5538                         err = -EOPNOTSUPP;
5539                         goto out_free;
5540                 }
5541         }
5542
5543         request->dev = dev;
5544         request->wiphy = &rdev->wiphy;
5545         request->interval = interval;
5546         request->scan_start = jiffies;
5547
5548         err = rdev_sched_scan_start(rdev, dev, request);
5549         if (!err) {
5550                 rdev->sched_scan_req = request;
5551                 nl80211_send_sched_scan(rdev, dev,
5552                                         NL80211_CMD_START_SCHED_SCAN);
5553                 goto out;
5554         }
5555
5556 out_free:
5557         kfree(request);
5558 out:
5559         return err;
5560 }
5561
5562 static int nl80211_stop_sched_scan(struct sk_buff *skb,
5563                                    struct genl_info *info)
5564 {
5565         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5566
5567         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5568             !rdev->ops->sched_scan_stop)
5569                 return -EOPNOTSUPP;
5570
5571         return __cfg80211_stop_sched_scan(rdev, false);
5572 }
5573
5574 static int nl80211_start_radar_detection(struct sk_buff *skb,
5575                                          struct genl_info *info)
5576 {
5577         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5578         struct net_device *dev = info->user_ptr[1];
5579         struct wireless_dev *wdev = dev->ieee80211_ptr;
5580         struct cfg80211_chan_def chandef;
5581         int err;
5582
5583         err = nl80211_parse_chandef(rdev, info, &chandef);
5584         if (err)
5585                 return err;
5586
5587         if (wdev->cac_started)
5588                 return -EBUSY;
5589
5590         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef);
5591         if (err < 0)
5592                 return err;
5593
5594         if (err == 0)
5595                 return -EINVAL;
5596
5597         if (chandef.chan->dfs_state != NL80211_DFS_USABLE)
5598                 return -EINVAL;
5599
5600         if (!rdev->ops->start_radar_detection)
5601                 return -EOPNOTSUPP;
5602
5603         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
5604                                            chandef.chan, CHAN_MODE_SHARED,
5605                                            BIT(chandef.width));
5606         if (err)
5607                 return err;
5608
5609         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef);
5610         if (!err) {
5611                 wdev->channel = chandef.chan;
5612                 wdev->cac_started = true;
5613                 wdev->cac_start_time = jiffies;
5614         }
5615         return err;
5616 }
5617
5618 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
5619                             u32 seq, int flags,
5620                             struct cfg80211_registered_device *rdev,
5621                             struct wireless_dev *wdev,
5622                             struct cfg80211_internal_bss *intbss)
5623 {
5624         struct cfg80211_bss *res = &intbss->pub;
5625         const struct cfg80211_bss_ies *ies;
5626         void *hdr;
5627         struct nlattr *bss;
5628         bool tsf = false;
5629
5630         ASSERT_WDEV_LOCK(wdev);
5631
5632         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
5633                              NL80211_CMD_NEW_SCAN_RESULTS);
5634         if (!hdr)
5635                 return -1;
5636
5637         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
5638
5639         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
5640                 goto nla_put_failure;
5641         if (wdev->netdev &&
5642             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
5643                 goto nla_put_failure;
5644         if (nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
5645                 goto nla_put_failure;
5646
5647         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
5648         if (!bss)
5649                 goto nla_put_failure;
5650         if ((!is_zero_ether_addr(res->bssid) &&
5651              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
5652                 goto nla_put_failure;
5653
5654         rcu_read_lock();
5655         ies = rcu_dereference(res->ies);
5656         if (ies) {
5657                 if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5658                         goto fail_unlock_rcu;
5659                 tsf = true;
5660                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
5661                                         ies->len, ies->data))
5662                         goto fail_unlock_rcu;
5663         }
5664         ies = rcu_dereference(res->beacon_ies);
5665         if (ies) {
5666                 if (!tsf && nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5667                         goto fail_unlock_rcu;
5668                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
5669                                         ies->len, ies->data))
5670                         goto fail_unlock_rcu;
5671         }
5672         rcu_read_unlock();
5673
5674         if (res->beacon_interval &&
5675             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
5676                 goto nla_put_failure;
5677         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
5678             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
5679             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
5680             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
5681                         jiffies_to_msecs(jiffies - intbss->ts)))
5682                 goto nla_put_failure;
5683
5684         switch (rdev->wiphy.signal_type) {
5685         case CFG80211_SIGNAL_TYPE_MBM:
5686                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
5687                         goto nla_put_failure;
5688                 break;
5689         case CFG80211_SIGNAL_TYPE_UNSPEC:
5690                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
5691                         goto nla_put_failure;
5692                 break;
5693         default:
5694                 break;
5695         }
5696
5697         switch (wdev->iftype) {
5698         case NL80211_IFTYPE_P2P_CLIENT:
5699         case NL80211_IFTYPE_STATION:
5700                 if (intbss == wdev->current_bss &&
5701                     nla_put_u32(msg, NL80211_BSS_STATUS,
5702                                 NL80211_BSS_STATUS_ASSOCIATED))
5703                         goto nla_put_failure;
5704                 break;
5705         case NL80211_IFTYPE_ADHOC:
5706                 if (intbss == wdev->current_bss &&
5707                     nla_put_u32(msg, NL80211_BSS_STATUS,
5708                                 NL80211_BSS_STATUS_IBSS_JOINED))
5709                         goto nla_put_failure;
5710                 break;
5711         default:
5712                 break;
5713         }
5714
5715         nla_nest_end(msg, bss);
5716
5717         return genlmsg_end(msg, hdr);
5718
5719  fail_unlock_rcu:
5720         rcu_read_unlock();
5721  nla_put_failure:
5722         genlmsg_cancel(msg, hdr);
5723         return -EMSGSIZE;
5724 }
5725
5726 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
5727 {
5728         struct cfg80211_registered_device *rdev;
5729         struct cfg80211_internal_bss *scan;
5730         struct wireless_dev *wdev;
5731         int start = cb->args[2], idx = 0;
5732         int err;
5733
5734         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5735         if (err)
5736                 return err;
5737
5738         wdev_lock(wdev);
5739         spin_lock_bh(&rdev->bss_lock);
5740         cfg80211_bss_expire(rdev);
5741
5742         cb->seq = rdev->bss_generation;
5743
5744         list_for_each_entry(scan, &rdev->bss_list, list) {
5745                 if (++idx <= start)
5746                         continue;
5747                 if (nl80211_send_bss(skb, cb,
5748                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5749                                 rdev, wdev, scan) < 0) {
5750                         idx--;
5751                         break;
5752                 }
5753         }
5754
5755         spin_unlock_bh(&rdev->bss_lock);
5756         wdev_unlock(wdev);
5757
5758         cb->args[2] = idx;
5759         nl80211_finish_wdev_dump(rdev);
5760
5761         return skb->len;
5762 }
5763
5764 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
5765                                 int flags, struct net_device *dev,
5766                                 struct survey_info *survey)
5767 {
5768         void *hdr;
5769         struct nlattr *infoattr;
5770
5771         hdr = nl80211hdr_put(msg, portid, seq, flags,
5772                              NL80211_CMD_NEW_SURVEY_RESULTS);
5773         if (!hdr)
5774                 return -ENOMEM;
5775
5776         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
5777                 goto nla_put_failure;
5778
5779         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
5780         if (!infoattr)
5781                 goto nla_put_failure;
5782
5783         if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
5784                         survey->channel->center_freq))
5785                 goto nla_put_failure;
5786
5787         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
5788             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
5789                 goto nla_put_failure;
5790         if ((survey->filled & SURVEY_INFO_IN_USE) &&
5791             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
5792                 goto nla_put_failure;
5793         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
5794             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
5795                         survey->channel_time))
5796                 goto nla_put_failure;
5797         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
5798             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
5799                         survey->channel_time_busy))
5800                 goto nla_put_failure;
5801         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
5802             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
5803                         survey->channel_time_ext_busy))
5804                 goto nla_put_failure;
5805         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
5806             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
5807                         survey->channel_time_rx))
5808                 goto nla_put_failure;
5809         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
5810             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
5811                         survey->channel_time_tx))
5812                 goto nla_put_failure;
5813
5814         nla_nest_end(msg, infoattr);
5815
5816         return genlmsg_end(msg, hdr);
5817
5818  nla_put_failure:
5819         genlmsg_cancel(msg, hdr);
5820         return -EMSGSIZE;
5821 }
5822
5823 static int nl80211_dump_survey(struct sk_buff *skb,
5824                         struct netlink_callback *cb)
5825 {
5826         struct survey_info survey;
5827         struct cfg80211_registered_device *dev;
5828         struct wireless_dev *wdev;
5829         int survey_idx = cb->args[2];
5830         int res;
5831
5832         res = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
5833         if (res)
5834                 return res;
5835
5836         if (!wdev->netdev) {
5837                 res = -EINVAL;
5838                 goto out_err;
5839         }
5840
5841         if (!dev->ops->dump_survey) {
5842                 res = -EOPNOTSUPP;
5843                 goto out_err;
5844         }
5845
5846         while (1) {
5847                 struct ieee80211_channel *chan;
5848
5849                 res = rdev_dump_survey(dev, wdev->netdev, survey_idx, &survey);
5850                 if (res == -ENOENT)
5851                         break;
5852                 if (res)
5853                         goto out_err;
5854
5855                 /* Survey without a channel doesn't make sense */
5856                 if (!survey.channel) {
5857                         res = -EINVAL;
5858                         goto out;
5859                 }
5860
5861                 chan = ieee80211_get_channel(&dev->wiphy,
5862                                              survey.channel->center_freq);
5863                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
5864                         survey_idx++;
5865                         continue;
5866                 }
5867
5868                 if (nl80211_send_survey(skb,
5869                                 NETLINK_CB(cb->skb).portid,
5870                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5871                                 wdev->netdev, &survey) < 0)
5872                         goto out;
5873                 survey_idx++;
5874         }
5875
5876  out:
5877         cb->args[2] = survey_idx;
5878         res = skb->len;
5879  out_err:
5880         nl80211_finish_wdev_dump(dev);
5881         return res;
5882 }
5883
5884 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
5885 {
5886         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
5887                                   NL80211_WPA_VERSION_2));
5888 }
5889
5890 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
5891 {
5892         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5893         struct net_device *dev = info->user_ptr[1];
5894         struct ieee80211_channel *chan;
5895         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
5896         int err, ssid_len, ie_len = 0, sae_data_len = 0;
5897         enum nl80211_auth_type auth_type;
5898         struct key_parse key;
5899         bool local_state_change;
5900
5901         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5902                 return -EINVAL;
5903
5904         if (!info->attrs[NL80211_ATTR_MAC])
5905                 return -EINVAL;
5906
5907         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
5908                 return -EINVAL;
5909
5910         if (!info->attrs[NL80211_ATTR_SSID])
5911                 return -EINVAL;
5912
5913         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
5914                 return -EINVAL;
5915
5916         err = nl80211_parse_key(info, &key);
5917         if (err)
5918                 return err;
5919
5920         if (key.idx >= 0) {
5921                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
5922                         return -EINVAL;
5923                 if (!key.p.key || !key.p.key_len)
5924                         return -EINVAL;
5925                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
5926                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
5927                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
5928                      key.p.key_len != WLAN_KEY_LEN_WEP104))
5929                         return -EINVAL;
5930                 if (key.idx > 4)
5931                         return -EINVAL;
5932         } else {
5933                 key.p.key_len = 0;
5934                 key.p.key = NULL;
5935         }
5936
5937         if (key.idx >= 0) {
5938                 int i;
5939                 bool ok = false;
5940                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
5941                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
5942                                 ok = true;
5943                                 break;
5944                         }
5945                 }
5946                 if (!ok)
5947                         return -EINVAL;
5948         }
5949
5950         if (!rdev->ops->auth)
5951                 return -EOPNOTSUPP;
5952
5953         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5954             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5955                 return -EOPNOTSUPP;
5956
5957         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5958         chan = ieee80211_get_channel(&rdev->wiphy,
5959                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5960         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
5961                 return -EINVAL;
5962
5963         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5964         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5965
5966         if (info->attrs[NL80211_ATTR_IE]) {
5967                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5968                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5969         }
5970
5971         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
5972         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
5973                 return -EINVAL;
5974
5975         if (auth_type == NL80211_AUTHTYPE_SAE &&
5976             !info->attrs[NL80211_ATTR_SAE_DATA])
5977                 return -EINVAL;
5978
5979         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
5980                 if (auth_type != NL80211_AUTHTYPE_SAE)
5981                         return -EINVAL;
5982                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
5983                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
5984                 /* need to include at least Auth Transaction and Status Code */
5985                 if (sae_data_len < 4)
5986                         return -EINVAL;
5987         }
5988
5989         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5990
5991         /*
5992          * Since we no longer track auth state, ignore
5993          * requests to only change local state.
5994          */
5995         if (local_state_change)
5996                 return 0;
5997
5998         wdev_lock(dev->ieee80211_ptr);
5999         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
6000                                  ssid, ssid_len, ie, ie_len,
6001                                  key.p.key, key.p.key_len, key.idx,
6002                                  sae_data, sae_data_len);
6003         wdev_unlock(dev->ieee80211_ptr);
6004         return err;
6005 }
6006
6007 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
6008                                    struct genl_info *info,
6009                                    struct cfg80211_crypto_settings *settings,
6010                                    int cipher_limit)
6011 {
6012         memset(settings, 0, sizeof(*settings));
6013
6014         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
6015
6016         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
6017                 u16 proto;
6018                 proto = nla_get_u16(
6019                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
6020                 settings->control_port_ethertype = cpu_to_be16(proto);
6021                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
6022                     proto != ETH_P_PAE)
6023                         return -EINVAL;
6024                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
6025                         settings->control_port_no_encrypt = true;
6026         } else
6027                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
6028
6029         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
6030                 void *data;
6031                 int len, i;
6032
6033                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6034                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6035                 settings->n_ciphers_pairwise = len / sizeof(u32);
6036
6037                 if (len % sizeof(u32))
6038                         return -EINVAL;
6039
6040                 if (settings->n_ciphers_pairwise > cipher_limit)
6041                         return -EINVAL;
6042
6043                 memcpy(settings->ciphers_pairwise, data, len);
6044
6045                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
6046                         if (!cfg80211_supported_cipher_suite(
6047                                         &rdev->wiphy,
6048                                         settings->ciphers_pairwise[i]))
6049                                 return -EINVAL;
6050         }
6051
6052         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
6053                 settings->cipher_group =
6054                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
6055                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
6056                                                      settings->cipher_group))
6057                         return -EINVAL;
6058         }
6059
6060         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
6061                 settings->wpa_versions =
6062                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
6063                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
6064                         return -EINVAL;
6065         }
6066
6067         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
6068                 void *data;
6069                 int len;
6070
6071                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
6072                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
6073                 settings->n_akm_suites = len / sizeof(u32);
6074
6075                 if (len % sizeof(u32))
6076                         return -EINVAL;
6077
6078                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
6079                         return -EINVAL;
6080
6081                 memcpy(settings->akm_suites, data, len);
6082         }
6083
6084         return 0;
6085 }
6086
6087 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
6088 {
6089         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6090         struct net_device *dev = info->user_ptr[1];
6091         struct ieee80211_channel *chan;
6092         struct cfg80211_assoc_request req = {};
6093         const u8 *bssid, *ssid;
6094         int err, ssid_len = 0;
6095
6096         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6097                 return -EINVAL;
6098
6099         if (!info->attrs[NL80211_ATTR_MAC] ||
6100             !info->attrs[NL80211_ATTR_SSID] ||
6101             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
6102                 return -EINVAL;
6103
6104         if (!rdev->ops->assoc)
6105                 return -EOPNOTSUPP;
6106
6107         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6108             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6109                 return -EOPNOTSUPP;
6110
6111         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6112
6113         chan = ieee80211_get_channel(&rdev->wiphy,
6114                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6115         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
6116                 return -EINVAL;
6117
6118         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6119         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6120
6121         if (info->attrs[NL80211_ATTR_IE]) {
6122                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6123                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6124         }
6125
6126         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6127                 enum nl80211_mfp mfp =
6128                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6129                 if (mfp == NL80211_MFP_REQUIRED)
6130                         req.use_mfp = true;
6131                 else if (mfp != NL80211_MFP_NO)
6132                         return -EINVAL;
6133         }
6134
6135         if (info->attrs[NL80211_ATTR_PREV_BSSID])
6136                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
6137
6138         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6139                 req.flags |= ASSOC_REQ_DISABLE_HT;
6140
6141         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6142                 memcpy(&req.ht_capa_mask,
6143                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6144                        sizeof(req.ht_capa_mask));
6145
6146         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6147                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6148                         return -EINVAL;
6149                 memcpy(&req.ht_capa,
6150                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6151                        sizeof(req.ht_capa));
6152         }
6153
6154         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
6155                 req.flags |= ASSOC_REQ_DISABLE_VHT;
6156
6157         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6158                 memcpy(&req.vht_capa_mask,
6159                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
6160                        sizeof(req.vht_capa_mask));
6161
6162         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
6163                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6164                         return -EINVAL;
6165                 memcpy(&req.vht_capa,
6166                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
6167                        sizeof(req.vht_capa));
6168         }
6169
6170         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
6171         if (!err) {
6172                 wdev_lock(dev->ieee80211_ptr);
6173                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
6174                                           ssid, ssid_len, &req);
6175                 wdev_unlock(dev->ieee80211_ptr);
6176         }
6177
6178         return err;
6179 }
6180
6181 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
6182 {
6183         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6184         struct net_device *dev = info->user_ptr[1];
6185         const u8 *ie = NULL, *bssid;
6186         int ie_len = 0, err;
6187         u16 reason_code;
6188         bool local_state_change;
6189
6190         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6191                 return -EINVAL;
6192
6193         if (!info->attrs[NL80211_ATTR_MAC])
6194                 return -EINVAL;
6195
6196         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6197                 return -EINVAL;
6198
6199         if (!rdev->ops->deauth)
6200                 return -EOPNOTSUPP;
6201
6202         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6203             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6204                 return -EOPNOTSUPP;
6205
6206         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6207
6208         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6209         if (reason_code == 0) {
6210                 /* Reason Code 0 is reserved */
6211                 return -EINVAL;
6212         }
6213
6214         if (info->attrs[NL80211_ATTR_IE]) {
6215                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6216                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6217         }
6218
6219         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6220
6221         wdev_lock(dev->ieee80211_ptr);
6222         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
6223                                    local_state_change);
6224         wdev_unlock(dev->ieee80211_ptr);
6225         return err;
6226 }
6227
6228 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
6229 {
6230         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6231         struct net_device *dev = info->user_ptr[1];
6232         const u8 *ie = NULL, *bssid;
6233         int ie_len = 0, err;
6234         u16 reason_code;
6235         bool local_state_change;
6236
6237         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6238                 return -EINVAL;
6239
6240         if (!info->attrs[NL80211_ATTR_MAC])
6241                 return -EINVAL;
6242
6243         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6244                 return -EINVAL;
6245
6246         if (!rdev->ops->disassoc)
6247                 return -EOPNOTSUPP;
6248
6249         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6250             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6251                 return -EOPNOTSUPP;
6252
6253         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6254
6255         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6256         if (reason_code == 0) {
6257                 /* Reason Code 0 is reserved */
6258                 return -EINVAL;
6259         }
6260
6261         if (info->attrs[NL80211_ATTR_IE]) {
6262                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6263                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6264         }
6265
6266         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6267
6268         wdev_lock(dev->ieee80211_ptr);
6269         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
6270                                      local_state_change);
6271         wdev_unlock(dev->ieee80211_ptr);
6272         return err;
6273 }
6274
6275 static bool
6276 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
6277                          int mcast_rate[IEEE80211_NUM_BANDS],
6278                          int rateval)
6279 {
6280         struct wiphy *wiphy = &rdev->wiphy;
6281         bool found = false;
6282         int band, i;
6283
6284         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
6285                 struct ieee80211_supported_band *sband;
6286
6287                 sband = wiphy->bands[band];
6288                 if (!sband)
6289                         continue;
6290
6291                 for (i = 0; i < sband->n_bitrates; i++) {
6292                         if (sband->bitrates[i].bitrate == rateval) {
6293                                 mcast_rate[band] = i + 1;
6294                                 found = true;
6295                                 break;
6296                         }
6297                 }
6298         }
6299
6300         return found;
6301 }
6302
6303 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
6304 {
6305         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6306         struct net_device *dev = info->user_ptr[1];
6307         struct cfg80211_ibss_params ibss;
6308         struct wiphy *wiphy;
6309         struct cfg80211_cached_keys *connkeys = NULL;
6310         int err;
6311
6312         memset(&ibss, 0, sizeof(ibss));
6313
6314         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6315                 return -EINVAL;
6316
6317         if (!info->attrs[NL80211_ATTR_SSID] ||
6318             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6319                 return -EINVAL;
6320
6321         ibss.beacon_interval = 100;
6322
6323         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
6324                 ibss.beacon_interval =
6325                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
6326                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
6327                         return -EINVAL;
6328         }
6329
6330         if (!rdev->ops->join_ibss)
6331                 return -EOPNOTSUPP;
6332
6333         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6334                 return -EOPNOTSUPP;
6335
6336         wiphy = &rdev->wiphy;
6337
6338         if (info->attrs[NL80211_ATTR_MAC]) {
6339                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6340
6341                 if (!is_valid_ether_addr(ibss.bssid))
6342                         return -EINVAL;
6343         }
6344         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6345         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6346
6347         if (info->attrs[NL80211_ATTR_IE]) {
6348                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6349                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6350         }
6351
6352         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
6353         if (err)
6354                 return err;
6355
6356         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef))
6357                 return -EINVAL;
6358
6359         switch (ibss.chandef.width) {
6360         case NL80211_CHAN_WIDTH_5:
6361         case NL80211_CHAN_WIDTH_10:
6362         case NL80211_CHAN_WIDTH_20_NOHT:
6363                 break;
6364         case NL80211_CHAN_WIDTH_20:
6365         case NL80211_CHAN_WIDTH_40:
6366                 if (rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)
6367                         break;
6368         default:
6369                 return -EINVAL;
6370         }
6371
6372         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
6373         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
6374
6375         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
6376                 u8 *rates =
6377                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6378                 int n_rates =
6379                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6380                 struct ieee80211_supported_band *sband =
6381                         wiphy->bands[ibss.chandef.chan->band];
6382
6383                 err = ieee80211_get_ratemask(sband, rates, n_rates,
6384                                              &ibss.basic_rates);
6385                 if (err)
6386                         return err;
6387         }
6388
6389         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6390                 memcpy(&ibss.ht_capa_mask,
6391                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6392                        sizeof(ibss.ht_capa_mask));
6393
6394         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6395                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6396                         return -EINVAL;
6397                 memcpy(&ibss.ht_capa,
6398                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6399                        sizeof(ibss.ht_capa));
6400         }
6401
6402         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
6403             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
6404                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
6405                 return -EINVAL;
6406
6407         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6408                 bool no_ht = false;
6409
6410                 connkeys = nl80211_parse_connkeys(rdev,
6411                                           info->attrs[NL80211_ATTR_KEYS],
6412                                           &no_ht);
6413                 if (IS_ERR(connkeys))
6414                         return PTR_ERR(connkeys);
6415
6416                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
6417                     no_ht) {
6418                         kfree(connkeys);
6419                         return -EINVAL;
6420                 }
6421         }
6422
6423         ibss.control_port =
6424                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
6425
6426         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
6427         if (err)
6428                 kfree(connkeys);
6429         return err;
6430 }
6431
6432 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
6433 {
6434         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6435         struct net_device *dev = info->user_ptr[1];
6436
6437         if (!rdev->ops->leave_ibss)
6438                 return -EOPNOTSUPP;
6439
6440         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6441                 return -EOPNOTSUPP;
6442
6443         return cfg80211_leave_ibss(rdev, dev, false);
6444 }
6445
6446 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
6447 {
6448         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6449         struct net_device *dev = info->user_ptr[1];
6450         int mcast_rate[IEEE80211_NUM_BANDS];
6451         u32 nla_rate;
6452         int err;
6453
6454         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
6455             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6456                 return -EOPNOTSUPP;
6457
6458         if (!rdev->ops->set_mcast_rate)
6459                 return -EOPNOTSUPP;
6460
6461         memset(mcast_rate, 0, sizeof(mcast_rate));
6462
6463         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
6464                 return -EINVAL;
6465
6466         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
6467         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
6468                 return -EINVAL;
6469
6470         err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
6471
6472         return err;
6473 }
6474
6475
6476 #ifdef CONFIG_NL80211_TESTMODE
6477 static struct genl_multicast_group nl80211_testmode_mcgrp = {
6478         .name = "testmode",
6479 };
6480
6481 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
6482 {
6483         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6484         int err;
6485
6486         if (!info->attrs[NL80211_ATTR_TESTDATA])
6487                 return -EINVAL;
6488
6489         err = -EOPNOTSUPP;
6490         if (rdev->ops->testmode_cmd) {
6491                 rdev->testmode_info = info;
6492                 err = rdev_testmode_cmd(rdev,
6493                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
6494                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
6495                 rdev->testmode_info = NULL;
6496         }
6497
6498         return err;
6499 }
6500
6501 static int nl80211_testmode_dump(struct sk_buff *skb,
6502                                  struct netlink_callback *cb)
6503 {
6504         struct cfg80211_registered_device *rdev;
6505         int err;
6506         long phy_idx;
6507         void *data = NULL;
6508         int data_len = 0;
6509
6510         rtnl_lock();
6511
6512         if (cb->args[0]) {
6513                 /*
6514                  * 0 is a valid index, but not valid for args[0],
6515                  * so we need to offset by 1.
6516                  */
6517                 phy_idx = cb->args[0] - 1;
6518         } else {
6519                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
6520                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
6521                                   nl80211_policy);
6522                 if (err)
6523                         goto out_err;
6524
6525                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
6526                                                   nl80211_fam.attrbuf);
6527                 if (IS_ERR(rdev)) {
6528                         err = PTR_ERR(rdev);
6529                         goto out_err;
6530                 }
6531                 phy_idx = rdev->wiphy_idx;
6532                 rdev = NULL;
6533
6534                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
6535                         cb->args[1] =
6536                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
6537         }
6538
6539         if (cb->args[1]) {
6540                 data = nla_data((void *)cb->args[1]);
6541                 data_len = nla_len((void *)cb->args[1]);
6542         }
6543
6544         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
6545         if (!rdev) {
6546                 err = -ENOENT;
6547                 goto out_err;
6548         }
6549
6550         if (!rdev->ops->testmode_dump) {
6551                 err = -EOPNOTSUPP;
6552                 goto out_err;
6553         }
6554
6555         while (1) {
6556                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
6557                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
6558                                            NL80211_CMD_TESTMODE);
6559                 struct nlattr *tmdata;
6560
6561                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
6562                         genlmsg_cancel(skb, hdr);
6563                         break;
6564                 }
6565
6566                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6567                 if (!tmdata) {
6568                         genlmsg_cancel(skb, hdr);
6569                         break;
6570                 }
6571                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
6572                 nla_nest_end(skb, tmdata);
6573
6574                 if (err == -ENOBUFS || err == -ENOENT) {
6575                         genlmsg_cancel(skb, hdr);
6576                         break;
6577                 } else if (err) {
6578                         genlmsg_cancel(skb, hdr);
6579                         goto out_err;
6580                 }
6581
6582                 genlmsg_end(skb, hdr);
6583         }
6584
6585         err = skb->len;
6586         /* see above */
6587         cb->args[0] = phy_idx + 1;
6588  out_err:
6589         rtnl_unlock();
6590         return err;
6591 }
6592
6593 static struct sk_buff *
6594 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
6595                               int approxlen, u32 portid, u32 seq, gfp_t gfp)
6596 {
6597         struct sk_buff *skb;
6598         void *hdr;
6599         struct nlattr *data;
6600
6601         skb = nlmsg_new(approxlen + 100, gfp);
6602         if (!skb)
6603                 return NULL;
6604
6605         hdr = nl80211hdr_put(skb, portid, seq, 0, NL80211_CMD_TESTMODE);
6606         if (!hdr) {
6607                 kfree_skb(skb);
6608                 return NULL;
6609         }
6610
6611         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
6612                 goto nla_put_failure;
6613         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6614
6615         ((void **)skb->cb)[0] = rdev;
6616         ((void **)skb->cb)[1] = hdr;
6617         ((void **)skb->cb)[2] = data;
6618
6619         return skb;
6620
6621  nla_put_failure:
6622         kfree_skb(skb);
6623         return NULL;
6624 }
6625
6626 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
6627                                                   int approxlen)
6628 {
6629         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6630
6631         if (WARN_ON(!rdev->testmode_info))
6632                 return NULL;
6633
6634         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
6635                                 rdev->testmode_info->snd_portid,
6636                                 rdev->testmode_info->snd_seq,
6637                                 GFP_KERNEL);
6638 }
6639 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
6640
6641 int cfg80211_testmode_reply(struct sk_buff *skb)
6642 {
6643         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
6644         void *hdr = ((void **)skb->cb)[1];
6645         struct nlattr *data = ((void **)skb->cb)[2];
6646
6647         if (WARN_ON(!rdev->testmode_info)) {
6648                 kfree_skb(skb);
6649                 return -EINVAL;
6650         }
6651
6652         nla_nest_end(skb, data);
6653         genlmsg_end(skb, hdr);
6654         return genlmsg_reply(skb, rdev->testmode_info);
6655 }
6656 EXPORT_SYMBOL(cfg80211_testmode_reply);
6657
6658 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
6659                                                   int approxlen, gfp_t gfp)
6660 {
6661         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6662
6663         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
6664 }
6665 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
6666
6667 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
6668 {
6669         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
6670         void *hdr = ((void **)skb->cb)[1];
6671         struct nlattr *data = ((void **)skb->cb)[2];
6672
6673         nla_nest_end(skb, data);
6674         genlmsg_end(skb, hdr);
6675         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), skb, 0,
6676                                 nl80211_testmode_mcgrp.id, gfp);
6677 }
6678 EXPORT_SYMBOL(cfg80211_testmode_event);
6679 #endif
6680
6681 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
6682 {
6683         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6684         struct net_device *dev = info->user_ptr[1];
6685         struct cfg80211_connect_params connect;
6686         struct wiphy *wiphy;
6687         struct cfg80211_cached_keys *connkeys = NULL;
6688         int err;
6689
6690         memset(&connect, 0, sizeof(connect));
6691
6692         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6693                 return -EINVAL;
6694
6695         if (!info->attrs[NL80211_ATTR_SSID] ||
6696             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6697                 return -EINVAL;
6698
6699         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
6700                 connect.auth_type =
6701                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6702                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
6703                                              NL80211_CMD_CONNECT))
6704                         return -EINVAL;
6705         } else
6706                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
6707
6708         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
6709
6710         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
6711                                       NL80211_MAX_NR_CIPHER_SUITES);
6712         if (err)
6713                 return err;
6714
6715         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6716             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6717                 return -EOPNOTSUPP;
6718
6719         wiphy = &rdev->wiphy;
6720
6721         connect.bg_scan_period = -1;
6722         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
6723                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
6724                 connect.bg_scan_period =
6725                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
6726         }
6727
6728         if (info->attrs[NL80211_ATTR_MAC])
6729                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6730         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6731         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6732
6733         if (info->attrs[NL80211_ATTR_IE]) {
6734                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6735                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6736         }
6737
6738         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6739                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6740                 if (connect.mfp != NL80211_MFP_REQUIRED &&
6741                     connect.mfp != NL80211_MFP_NO)
6742                         return -EINVAL;
6743         } else {
6744                 connect.mfp = NL80211_MFP_NO;
6745         }
6746
6747         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6748                 connect.channel =
6749                         ieee80211_get_channel(wiphy,
6750                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6751                 if (!connect.channel ||
6752                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
6753                         return -EINVAL;
6754         }
6755
6756         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6757                 connkeys = nl80211_parse_connkeys(rdev,
6758                                           info->attrs[NL80211_ATTR_KEYS], NULL);
6759                 if (IS_ERR(connkeys))
6760                         return PTR_ERR(connkeys);
6761         }
6762
6763         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6764                 connect.flags |= ASSOC_REQ_DISABLE_HT;
6765
6766         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6767                 memcpy(&connect.ht_capa_mask,
6768                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6769                        sizeof(connect.ht_capa_mask));
6770
6771         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6772                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
6773                         kfree(connkeys);
6774                         return -EINVAL;
6775                 }
6776                 memcpy(&connect.ht_capa,
6777                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6778                        sizeof(connect.ht_capa));
6779         }
6780
6781         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
6782                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
6783
6784         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6785                 memcpy(&connect.vht_capa_mask,
6786                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
6787                        sizeof(connect.vht_capa_mask));
6788
6789         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
6790                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
6791                         kfree(connkeys);
6792                         return -EINVAL;
6793                 }
6794                 memcpy(&connect.vht_capa,
6795                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
6796                        sizeof(connect.vht_capa));
6797         }
6798
6799         wdev_lock(dev->ieee80211_ptr);
6800         err = cfg80211_connect(rdev, dev, &connect, connkeys, NULL);
6801         wdev_unlock(dev->ieee80211_ptr);
6802         if (err)
6803                 kfree(connkeys);
6804         return err;
6805 }
6806
6807 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
6808 {
6809         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6810         struct net_device *dev = info->user_ptr[1];
6811         u16 reason;
6812         int ret;
6813
6814         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6815                 reason = WLAN_REASON_DEAUTH_LEAVING;
6816         else
6817                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6818
6819         if (reason == 0)
6820                 return -EINVAL;
6821
6822         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6823             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6824                 return -EOPNOTSUPP;
6825
6826         wdev_lock(dev->ieee80211_ptr);
6827         ret = cfg80211_disconnect(rdev, dev, reason, true);
6828         wdev_unlock(dev->ieee80211_ptr);
6829         return ret;
6830 }
6831
6832 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
6833 {
6834         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6835         struct net *net;
6836         int err;
6837         u32 pid;
6838
6839         if (!info->attrs[NL80211_ATTR_PID])
6840                 return -EINVAL;
6841
6842         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
6843
6844         net = get_net_ns_by_pid(pid);
6845         if (IS_ERR(net))
6846                 return PTR_ERR(net);
6847
6848         err = 0;
6849
6850         /* check if anything to do */
6851         if (!net_eq(wiphy_net(&rdev->wiphy), net))
6852                 err = cfg80211_switch_netns(rdev, net);
6853
6854         put_net(net);
6855         return err;
6856 }
6857
6858 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
6859 {
6860         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6861         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
6862                         struct cfg80211_pmksa *pmksa) = NULL;
6863         struct net_device *dev = info->user_ptr[1];
6864         struct cfg80211_pmksa pmksa;
6865
6866         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
6867
6868         if (!info->attrs[NL80211_ATTR_MAC])
6869                 return -EINVAL;
6870
6871         if (!info->attrs[NL80211_ATTR_PMKID])
6872                 return -EINVAL;
6873
6874         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
6875         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6876
6877         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6878             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6879                 return -EOPNOTSUPP;
6880
6881         switch (info->genlhdr->cmd) {
6882         case NL80211_CMD_SET_PMKSA:
6883                 rdev_ops = rdev->ops->set_pmksa;
6884                 break;
6885         case NL80211_CMD_DEL_PMKSA:
6886                 rdev_ops = rdev->ops->del_pmksa;
6887                 break;
6888         default:
6889                 WARN_ON(1);
6890                 break;
6891         }
6892
6893         if (!rdev_ops)
6894                 return -EOPNOTSUPP;
6895
6896         return rdev_ops(&rdev->wiphy, dev, &pmksa);
6897 }
6898
6899 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
6900 {
6901         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6902         struct net_device *dev = info->user_ptr[1];
6903
6904         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6905             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6906                 return -EOPNOTSUPP;
6907
6908         if (!rdev->ops->flush_pmksa)
6909                 return -EOPNOTSUPP;
6910
6911         return rdev_flush_pmksa(rdev, dev);
6912 }
6913
6914 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
6915 {
6916         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6917         struct net_device *dev = info->user_ptr[1];
6918         u8 action_code, dialog_token;
6919         u16 status_code;
6920         u8 *peer;
6921
6922         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
6923             !rdev->ops->tdls_mgmt)
6924                 return -EOPNOTSUPP;
6925
6926         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
6927             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
6928             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
6929             !info->attrs[NL80211_ATTR_IE] ||
6930             !info->attrs[NL80211_ATTR_MAC])
6931                 return -EINVAL;
6932
6933         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
6934         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
6935         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
6936         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
6937
6938         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
6939                               dialog_token, status_code,
6940                               nla_data(info->attrs[NL80211_ATTR_IE]),
6941                               nla_len(info->attrs[NL80211_ATTR_IE]));
6942 }
6943
6944 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
6945 {
6946         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6947         struct net_device *dev = info->user_ptr[1];
6948         enum nl80211_tdls_operation operation;
6949         u8 *peer;
6950
6951         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
6952             !rdev->ops->tdls_oper)
6953                 return -EOPNOTSUPP;
6954
6955         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
6956             !info->attrs[NL80211_ATTR_MAC])
6957                 return -EINVAL;
6958
6959         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
6960         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
6961
6962         return rdev_tdls_oper(rdev, dev, peer, operation);
6963 }
6964
6965 static int nl80211_remain_on_channel(struct sk_buff *skb,
6966                                      struct genl_info *info)
6967 {
6968         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6969         struct wireless_dev *wdev = info->user_ptr[1];
6970         struct cfg80211_chan_def chandef;
6971         struct sk_buff *msg;
6972         void *hdr;
6973         u64 cookie;
6974         u32 duration;
6975         int err;
6976
6977         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
6978             !info->attrs[NL80211_ATTR_DURATION])
6979                 return -EINVAL;
6980
6981         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
6982
6983         if (!rdev->ops->remain_on_channel ||
6984             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
6985                 return -EOPNOTSUPP;
6986
6987         /*
6988          * We should be on that channel for at least a minimum amount of
6989          * time (10ms) but no longer than the driver supports.
6990          */
6991         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
6992             duration > rdev->wiphy.max_remain_on_channel_duration)
6993                 return -EINVAL;
6994
6995         err = nl80211_parse_chandef(rdev, info, &chandef);
6996         if (err)
6997                 return err;
6998
6999         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7000         if (!msg)
7001                 return -ENOMEM;
7002
7003         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7004                              NL80211_CMD_REMAIN_ON_CHANNEL);
7005
7006         if (IS_ERR(hdr)) {
7007                 err = PTR_ERR(hdr);
7008                 goto free_msg;
7009         }
7010
7011         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
7012                                      duration, &cookie);
7013
7014         if (err)
7015                 goto free_msg;
7016
7017         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7018                 goto nla_put_failure;
7019
7020         genlmsg_end(msg, hdr);
7021
7022         return genlmsg_reply(msg, info);
7023
7024  nla_put_failure:
7025         err = -ENOBUFS;
7026  free_msg:
7027         nlmsg_free(msg);
7028         return err;
7029 }
7030
7031 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
7032                                             struct genl_info *info)
7033 {
7034         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7035         struct wireless_dev *wdev = info->user_ptr[1];
7036         u64 cookie;
7037
7038         if (!info->attrs[NL80211_ATTR_COOKIE])
7039                 return -EINVAL;
7040
7041         if (!rdev->ops->cancel_remain_on_channel)
7042                 return -EOPNOTSUPP;
7043
7044         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7045
7046         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
7047 }
7048
7049 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
7050                            u8 *rates, u8 rates_len)
7051 {
7052         u8 i;
7053         u32 mask = 0;
7054
7055         for (i = 0; i < rates_len; i++) {
7056                 int rate = (rates[i] & 0x7f) * 5;
7057                 int ridx;
7058                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
7059                         struct ieee80211_rate *srate =
7060                                 &sband->bitrates[ridx];
7061                         if (rate == srate->bitrate) {
7062                                 mask |= 1 << ridx;
7063                                 break;
7064                         }
7065                 }
7066                 if (ridx == sband->n_bitrates)
7067                         return 0; /* rate not found */
7068         }
7069
7070         return mask;
7071 }
7072
7073 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
7074                                u8 *rates, u8 rates_len,
7075                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
7076 {
7077         u8 i;
7078
7079         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
7080
7081         for (i = 0; i < rates_len; i++) {
7082                 int ridx, rbit;
7083
7084                 ridx = rates[i] / 8;
7085                 rbit = BIT(rates[i] % 8);
7086
7087                 /* check validity */
7088                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
7089                         return false;
7090
7091                 /* check availability */
7092                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
7093                         mcs[ridx] |= rbit;
7094                 else
7095                         return false;
7096         }
7097
7098         return true;
7099 }
7100
7101 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
7102         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
7103                                     .len = NL80211_MAX_SUPP_RATES },
7104         [NL80211_TXRATE_MCS] = { .type = NLA_BINARY,
7105                                  .len = NL80211_MAX_SUPP_HT_RATES },
7106 };
7107
7108 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
7109                                        struct genl_info *info)
7110 {
7111         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
7112         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7113         struct cfg80211_bitrate_mask mask;
7114         int rem, i;
7115         struct net_device *dev = info->user_ptr[1];
7116         struct nlattr *tx_rates;
7117         struct ieee80211_supported_band *sband;
7118
7119         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
7120                 return -EINVAL;
7121
7122         if (!rdev->ops->set_bitrate_mask)
7123                 return -EOPNOTSUPP;
7124
7125         memset(&mask, 0, sizeof(mask));
7126         /* Default to all rates enabled */
7127         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
7128                 sband = rdev->wiphy.bands[i];
7129                 mask.control[i].legacy =
7130                         sband ? (1 << sband->n_bitrates) - 1 : 0;
7131                 if (sband)
7132                         memcpy(mask.control[i].mcs,
7133                                sband->ht_cap.mcs.rx_mask,
7134                                sizeof(mask.control[i].mcs));
7135                 else
7136                         memset(mask.control[i].mcs, 0,
7137                                sizeof(mask.control[i].mcs));
7138         }
7139
7140         /*
7141          * The nested attribute uses enum nl80211_band as the index. This maps
7142          * directly to the enum ieee80211_band values used in cfg80211.
7143          */
7144         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
7145         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
7146         {
7147                 enum ieee80211_band band = nla_type(tx_rates);
7148                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
7149                         return -EINVAL;
7150                 sband = rdev->wiphy.bands[band];
7151                 if (sband == NULL)
7152                         return -EINVAL;
7153                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
7154                           nla_len(tx_rates), nl80211_txattr_policy);
7155                 if (tb[NL80211_TXRATE_LEGACY]) {
7156                         mask.control[band].legacy = rateset_to_mask(
7157                                 sband,
7158                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
7159                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
7160                         if ((mask.control[band].legacy == 0) &&
7161                             nla_len(tb[NL80211_TXRATE_LEGACY]))
7162                                 return -EINVAL;
7163                 }
7164                 if (tb[NL80211_TXRATE_MCS]) {
7165                         if (!ht_rateset_to_mask(
7166                                         sband,
7167                                         nla_data(tb[NL80211_TXRATE_MCS]),
7168                                         nla_len(tb[NL80211_TXRATE_MCS]),
7169                                         mask.control[band].mcs))
7170                                 return -EINVAL;
7171                 }
7172
7173                 if (mask.control[band].legacy == 0) {
7174                         /* don't allow empty legacy rates if HT
7175                          * is not even supported. */
7176                         if (!rdev->wiphy.bands[band]->ht_cap.ht_supported)
7177                                 return -EINVAL;
7178
7179                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
7180                                 if (mask.control[band].mcs[i])
7181                                         break;
7182
7183                         /* legacy and mcs rates may not be both empty */
7184                         if (i == IEEE80211_HT_MCS_MASK_LEN)
7185                                 return -EINVAL;
7186                 }
7187         }
7188
7189         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
7190 }
7191
7192 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
7193 {
7194         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7195         struct wireless_dev *wdev = info->user_ptr[1];
7196         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
7197
7198         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
7199                 return -EINVAL;
7200
7201         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
7202                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
7203
7204         switch (wdev->iftype) {
7205         case NL80211_IFTYPE_STATION:
7206         case NL80211_IFTYPE_ADHOC:
7207         case NL80211_IFTYPE_P2P_CLIENT:
7208         case NL80211_IFTYPE_AP:
7209         case NL80211_IFTYPE_AP_VLAN:
7210         case NL80211_IFTYPE_MESH_POINT:
7211         case NL80211_IFTYPE_P2P_GO:
7212         case NL80211_IFTYPE_P2P_DEVICE:
7213                 break;
7214         default:
7215                 return -EOPNOTSUPP;
7216         }
7217
7218         /* not much point in registering if we can't reply */
7219         if (!rdev->ops->mgmt_tx)
7220                 return -EOPNOTSUPP;
7221
7222         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
7223                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
7224                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
7225 }
7226
7227 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
7228 {
7229         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7230         struct wireless_dev *wdev = info->user_ptr[1];
7231         struct cfg80211_chan_def chandef;
7232         int err;
7233         void *hdr = NULL;
7234         u64 cookie;
7235         struct sk_buff *msg = NULL;
7236         unsigned int wait = 0;
7237         bool offchan, no_cck, dont_wait_for_ack;
7238
7239         dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
7240
7241         if (!info->attrs[NL80211_ATTR_FRAME])
7242                 return -EINVAL;
7243
7244         if (!rdev->ops->mgmt_tx)
7245                 return -EOPNOTSUPP;
7246
7247         switch (wdev->iftype) {
7248         case NL80211_IFTYPE_P2P_DEVICE:
7249                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
7250                         return -EINVAL;
7251         case NL80211_IFTYPE_STATION:
7252         case NL80211_IFTYPE_ADHOC:
7253         case NL80211_IFTYPE_P2P_CLIENT:
7254         case NL80211_IFTYPE_AP:
7255         case NL80211_IFTYPE_AP_VLAN:
7256         case NL80211_IFTYPE_MESH_POINT:
7257         case NL80211_IFTYPE_P2P_GO:
7258                 break;
7259         default:
7260                 return -EOPNOTSUPP;
7261         }
7262
7263         if (info->attrs[NL80211_ATTR_DURATION]) {
7264                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7265                         return -EINVAL;
7266                 wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7267
7268                 /*
7269                  * We should wait on the channel for at least a minimum amount
7270                  * of time (10ms) but no longer than the driver supports.
7271                  */
7272                 if (wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7273                     wait > rdev->wiphy.max_remain_on_channel_duration)
7274                         return -EINVAL;
7275
7276         }
7277
7278         offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
7279
7280         if (offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7281                 return -EINVAL;
7282
7283         no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7284
7285         /* get the channel if any has been specified, otherwise pass NULL to
7286          * the driver. The latter will use the current one
7287          */
7288         chandef.chan = NULL;
7289         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7290                 err = nl80211_parse_chandef(rdev, info, &chandef);
7291                 if (err)
7292                         return err;
7293         }
7294
7295         if (!chandef.chan && offchan)
7296                 return -EINVAL;
7297
7298         if (!dont_wait_for_ack) {
7299                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7300                 if (!msg)
7301                         return -ENOMEM;
7302
7303                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7304                                      NL80211_CMD_FRAME);
7305
7306                 if (IS_ERR(hdr)) {
7307                         err = PTR_ERR(hdr);
7308                         goto free_msg;
7309                 }
7310         }
7311
7312         err = cfg80211_mlme_mgmt_tx(rdev, wdev, chandef.chan, offchan, wait,
7313                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
7314                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
7315                                     no_cck, dont_wait_for_ack, &cookie);
7316         if (err)
7317                 goto free_msg;
7318
7319         if (msg) {
7320                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7321                         goto nla_put_failure;
7322
7323                 genlmsg_end(msg, hdr);
7324                 return genlmsg_reply(msg, info);
7325         }
7326
7327         return 0;
7328
7329  nla_put_failure:
7330         err = -ENOBUFS;
7331  free_msg:
7332         nlmsg_free(msg);
7333         return err;
7334 }
7335
7336 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
7337 {
7338         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7339         struct wireless_dev *wdev = info->user_ptr[1];
7340         u64 cookie;
7341
7342         if (!info->attrs[NL80211_ATTR_COOKIE])
7343                 return -EINVAL;
7344
7345         if (!rdev->ops->mgmt_tx_cancel_wait)
7346                 return -EOPNOTSUPP;
7347
7348         switch (wdev->iftype) {
7349         case NL80211_IFTYPE_STATION:
7350         case NL80211_IFTYPE_ADHOC:
7351         case NL80211_IFTYPE_P2P_CLIENT:
7352         case NL80211_IFTYPE_AP:
7353         case NL80211_IFTYPE_AP_VLAN:
7354         case NL80211_IFTYPE_P2P_GO:
7355         case NL80211_IFTYPE_P2P_DEVICE:
7356                 break;
7357         default:
7358                 return -EOPNOTSUPP;
7359         }
7360
7361         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7362
7363         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
7364 }
7365
7366 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
7367 {
7368         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7369         struct wireless_dev *wdev;
7370         struct net_device *dev = info->user_ptr[1];
7371         u8 ps_state;
7372         bool state;
7373         int err;
7374
7375         if (!info->attrs[NL80211_ATTR_PS_STATE])
7376                 return -EINVAL;
7377
7378         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
7379
7380         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
7381                 return -EINVAL;
7382
7383         wdev = dev->ieee80211_ptr;
7384
7385         if (!rdev->ops->set_power_mgmt)
7386                 return -EOPNOTSUPP;
7387
7388         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
7389
7390         if (state == wdev->ps)
7391                 return 0;
7392
7393         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
7394         if (!err)
7395                 wdev->ps = state;
7396         return err;
7397 }
7398
7399 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
7400 {
7401         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7402         enum nl80211_ps_state ps_state;
7403         struct wireless_dev *wdev;
7404         struct net_device *dev = info->user_ptr[1];
7405         struct sk_buff *msg;
7406         void *hdr;
7407         int err;
7408
7409         wdev = dev->ieee80211_ptr;
7410
7411         if (!rdev->ops->set_power_mgmt)
7412                 return -EOPNOTSUPP;
7413
7414         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7415         if (!msg)
7416                 return -ENOMEM;
7417
7418         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7419                              NL80211_CMD_GET_POWER_SAVE);
7420         if (!hdr) {
7421                 err = -ENOBUFS;
7422                 goto free_msg;
7423         }
7424
7425         if (wdev->ps)
7426                 ps_state = NL80211_PS_ENABLED;
7427         else
7428                 ps_state = NL80211_PS_DISABLED;
7429
7430         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
7431                 goto nla_put_failure;
7432
7433         genlmsg_end(msg, hdr);
7434         return genlmsg_reply(msg, info);
7435
7436  nla_put_failure:
7437         err = -ENOBUFS;
7438  free_msg:
7439         nlmsg_free(msg);
7440         return err;
7441 }
7442
7443 static struct nla_policy
7444 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
7445         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
7446         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
7447         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
7448         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
7449         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
7450         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
7451 };
7452
7453 static int nl80211_set_cqm_txe(struct genl_info *info,
7454                                u32 rate, u32 pkts, u32 intvl)
7455 {
7456         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7457         struct wireless_dev *wdev;
7458         struct net_device *dev = info->user_ptr[1];
7459
7460         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
7461                 return -EINVAL;
7462
7463         wdev = dev->ieee80211_ptr;
7464
7465         if (!rdev->ops->set_cqm_txe_config)
7466                 return -EOPNOTSUPP;
7467
7468         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7469             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7470                 return -EOPNOTSUPP;
7471
7472         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
7473 }
7474
7475 static int nl80211_set_cqm_rssi(struct genl_info *info,
7476                                 s32 threshold, u32 hysteresis)
7477 {
7478         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7479         struct wireless_dev *wdev;
7480         struct net_device *dev = info->user_ptr[1];
7481
7482         if (threshold > 0)
7483                 return -EINVAL;
7484
7485         wdev = dev->ieee80211_ptr;
7486
7487         if (!rdev->ops->set_cqm_rssi_config)
7488                 return -EOPNOTSUPP;
7489
7490         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7491             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7492                 return -EOPNOTSUPP;
7493
7494         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
7495 }
7496
7497 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
7498 {
7499         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
7500         struct nlattr *cqm;
7501         int err;
7502
7503         cqm = info->attrs[NL80211_ATTR_CQM];
7504         if (!cqm) {
7505                 err = -EINVAL;
7506                 goto out;
7507         }
7508
7509         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
7510                                nl80211_attr_cqm_policy);
7511         if (err)
7512                 goto out;
7513
7514         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
7515             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
7516                 s32 threshold;
7517                 u32 hysteresis;
7518                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
7519                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
7520                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
7521         } else if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
7522                    attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
7523                    attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
7524                 u32 rate, pkts, intvl;
7525                 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
7526                 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
7527                 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
7528                 err = nl80211_set_cqm_txe(info, rate, pkts, intvl);
7529         } else
7530                 err = -EINVAL;
7531
7532 out:
7533         return err;
7534 }
7535
7536 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
7537 {
7538         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7539         struct net_device *dev = info->user_ptr[1];
7540         struct mesh_config cfg;
7541         struct mesh_setup setup;
7542         int err;
7543
7544         /* start with default */
7545         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
7546         memcpy(&setup, &default_mesh_setup, sizeof(setup));
7547
7548         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
7549                 /* and parse parameters if given */
7550                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
7551                 if (err)
7552                         return err;
7553         }
7554
7555         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
7556             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
7557                 return -EINVAL;
7558
7559         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
7560         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
7561
7562         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
7563             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
7564                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
7565                         return -EINVAL;
7566
7567         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
7568                 setup.beacon_interval =
7569                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
7570                 if (setup.beacon_interval < 10 ||
7571                     setup.beacon_interval > 10000)
7572                         return -EINVAL;
7573         }
7574
7575         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
7576                 setup.dtim_period =
7577                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
7578                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
7579                         return -EINVAL;
7580         }
7581
7582         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
7583                 /* parse additional setup parameters if given */
7584                 err = nl80211_parse_mesh_setup(info, &setup);
7585                 if (err)
7586                         return err;
7587         }
7588
7589         if (setup.user_mpm)
7590                 cfg.auto_open_plinks = false;
7591
7592         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7593                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
7594                 if (err)
7595                         return err;
7596         } else {
7597                 /* cfg80211_join_mesh() will sort it out */
7598                 setup.chandef.chan = NULL;
7599         }
7600
7601         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
7602                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7603                 int n_rates =
7604                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7605                 struct ieee80211_supported_band *sband;
7606
7607                 if (!setup.chandef.chan)
7608                         return -EINVAL;
7609
7610                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
7611
7612                 err = ieee80211_get_ratemask(sband, rates, n_rates,
7613                                              &setup.basic_rates);
7614                 if (err)
7615                         return err;
7616         }
7617
7618         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
7619 }
7620
7621 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
7622 {
7623         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7624         struct net_device *dev = info->user_ptr[1];
7625
7626         return cfg80211_leave_mesh(rdev, dev);
7627 }
7628
7629 #ifdef CONFIG_PM
7630 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
7631                                         struct cfg80211_registered_device *rdev)
7632 {
7633         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
7634         struct nlattr *nl_pats, *nl_pat;
7635         int i, pat_len;
7636
7637         if (!wowlan->n_patterns)
7638                 return 0;
7639
7640         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
7641         if (!nl_pats)
7642                 return -ENOBUFS;
7643
7644         for (i = 0; i < wowlan->n_patterns; i++) {
7645                 nl_pat = nla_nest_start(msg, i + 1);
7646                 if (!nl_pat)
7647                         return -ENOBUFS;
7648                 pat_len = wowlan->patterns[i].pattern_len;
7649                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
7650                             wowlan->patterns[i].mask) ||
7651                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
7652                             wowlan->patterns[i].pattern) ||
7653                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
7654                                 wowlan->patterns[i].pkt_offset))
7655                         return -ENOBUFS;
7656                 nla_nest_end(msg, nl_pat);
7657         }
7658         nla_nest_end(msg, nl_pats);
7659
7660         return 0;
7661 }
7662
7663 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
7664                                    struct cfg80211_wowlan_tcp *tcp)
7665 {
7666         struct nlattr *nl_tcp;
7667
7668         if (!tcp)
7669                 return 0;
7670
7671         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
7672         if (!nl_tcp)
7673                 return -ENOBUFS;
7674
7675         if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
7676             nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
7677             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
7678             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
7679             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
7680             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
7681                     tcp->payload_len, tcp->payload) ||
7682             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
7683                         tcp->data_interval) ||
7684             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
7685                     tcp->wake_len, tcp->wake_data) ||
7686             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
7687                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
7688                 return -ENOBUFS;
7689
7690         if (tcp->payload_seq.len &&
7691             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
7692                     sizeof(tcp->payload_seq), &tcp->payload_seq))
7693                 return -ENOBUFS;
7694
7695         if (tcp->payload_tok.len &&
7696             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
7697                     sizeof(tcp->payload_tok) + tcp->tokens_size,
7698                     &tcp->payload_tok))
7699                 return -ENOBUFS;
7700
7701         nla_nest_end(msg, nl_tcp);
7702
7703         return 0;
7704 }
7705
7706 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
7707 {
7708         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7709         struct sk_buff *msg;
7710         void *hdr;
7711         u32 size = NLMSG_DEFAULT_SIZE;
7712
7713         if (!rdev->wiphy.wowlan)
7714                 return -EOPNOTSUPP;
7715
7716         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
7717                 /* adjust size to have room for all the data */
7718                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
7719                         rdev->wiphy.wowlan_config->tcp->payload_len +
7720                         rdev->wiphy.wowlan_config->tcp->wake_len +
7721                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
7722         }
7723
7724         msg = nlmsg_new(size, GFP_KERNEL);
7725         if (!msg)
7726                 return -ENOMEM;
7727
7728         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7729                              NL80211_CMD_GET_WOWLAN);
7730         if (!hdr)
7731                 goto nla_put_failure;
7732
7733         if (rdev->wiphy.wowlan_config) {
7734                 struct nlattr *nl_wowlan;
7735
7736                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
7737                 if (!nl_wowlan)
7738                         goto nla_put_failure;
7739
7740                 if ((rdev->wiphy.wowlan_config->any &&
7741                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
7742                     (rdev->wiphy.wowlan_config->disconnect &&
7743                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
7744                     (rdev->wiphy.wowlan_config->magic_pkt &&
7745                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
7746                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
7747                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
7748                     (rdev->wiphy.wowlan_config->eap_identity_req &&
7749                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
7750                     (rdev->wiphy.wowlan_config->four_way_handshake &&
7751                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
7752                     (rdev->wiphy.wowlan_config->rfkill_release &&
7753                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
7754                         goto nla_put_failure;
7755
7756                 if (nl80211_send_wowlan_patterns(msg, rdev))
7757                         goto nla_put_failure;
7758
7759                 if (nl80211_send_wowlan_tcp(msg,
7760                                             rdev->wiphy.wowlan_config->tcp))
7761                         goto nla_put_failure;
7762
7763                 nla_nest_end(msg, nl_wowlan);
7764         }
7765
7766         genlmsg_end(msg, hdr);
7767         return genlmsg_reply(msg, info);
7768
7769 nla_put_failure:
7770         nlmsg_free(msg);
7771         return -ENOBUFS;
7772 }
7773
7774 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
7775                                     struct nlattr *attr,
7776                                     struct cfg80211_wowlan *trig)
7777 {
7778         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
7779         struct cfg80211_wowlan_tcp *cfg;
7780         struct nl80211_wowlan_tcp_data_token *tok = NULL;
7781         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
7782         u32 size;
7783         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
7784         int err, port;
7785
7786         if (!rdev->wiphy.wowlan->tcp)
7787                 return -EINVAL;
7788
7789         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
7790                         nla_data(attr), nla_len(attr),
7791                         nl80211_wowlan_tcp_policy);
7792         if (err)
7793                 return err;
7794
7795         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
7796             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
7797             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
7798             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
7799             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
7800             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
7801             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
7802             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
7803                 return -EINVAL;
7804
7805         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
7806         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
7807                 return -EINVAL;
7808
7809         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
7810                         rdev->wiphy.wowlan->tcp->data_interval_max ||
7811             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
7812                 return -EINVAL;
7813
7814         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
7815         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
7816                 return -EINVAL;
7817
7818         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
7819         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
7820                 return -EINVAL;
7821
7822         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
7823                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
7824
7825                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
7826                 tokens_size = tokln - sizeof(*tok);
7827
7828                 if (!tok->len || tokens_size % tok->len)
7829                         return -EINVAL;
7830                 if (!rdev->wiphy.wowlan->tcp->tok)
7831                         return -EINVAL;
7832                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
7833                         return -EINVAL;
7834                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
7835                         return -EINVAL;
7836                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
7837                         return -EINVAL;
7838                 if (tok->offset + tok->len > data_size)
7839                         return -EINVAL;
7840         }
7841
7842         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
7843                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
7844                 if (!rdev->wiphy.wowlan->tcp->seq)
7845                         return -EINVAL;
7846                 if (seq->len == 0 || seq->len > 4)
7847                         return -EINVAL;
7848                 if (seq->len + seq->offset > data_size)
7849                         return -EINVAL;
7850         }
7851
7852         size = sizeof(*cfg);
7853         size += data_size;
7854         size += wake_size + wake_mask_size;
7855         size += tokens_size;
7856
7857         cfg = kzalloc(size, GFP_KERNEL);
7858         if (!cfg)
7859                 return -ENOMEM;
7860         cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
7861         cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
7862         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
7863                ETH_ALEN);
7864         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
7865                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
7866         else
7867                 port = 0;
7868 #ifdef CONFIG_INET
7869         /* allocate a socket and port for it and use it */
7870         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
7871                             IPPROTO_TCP, &cfg->sock, 1);
7872         if (err) {
7873                 kfree(cfg);
7874                 return err;
7875         }
7876         if (inet_csk_get_port(cfg->sock->sk, port)) {
7877                 sock_release(cfg->sock);
7878                 kfree(cfg);
7879                 return -EADDRINUSE;
7880         }
7881         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
7882 #else
7883         if (!port) {
7884                 kfree(cfg);
7885                 return -EINVAL;
7886         }
7887         cfg->src_port = port;
7888 #endif
7889
7890         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
7891         cfg->payload_len = data_size;
7892         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
7893         memcpy((void *)cfg->payload,
7894                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
7895                data_size);
7896         if (seq)
7897                 cfg->payload_seq = *seq;
7898         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
7899         cfg->wake_len = wake_size;
7900         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
7901         memcpy((void *)cfg->wake_data,
7902                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
7903                wake_size);
7904         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
7905                          data_size + wake_size;
7906         memcpy((void *)cfg->wake_mask,
7907                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
7908                wake_mask_size);
7909         if (tok) {
7910                 cfg->tokens_size = tokens_size;
7911                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
7912         }
7913
7914         trig->tcp = cfg;
7915
7916         return 0;
7917 }
7918
7919 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
7920 {
7921         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7922         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
7923         struct cfg80211_wowlan new_triggers = {};
7924         struct cfg80211_wowlan *ntrig;
7925         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
7926         int err, i;
7927         bool prev_enabled = rdev->wiphy.wowlan_config;
7928
7929         if (!wowlan)
7930                 return -EOPNOTSUPP;
7931
7932         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
7933                 cfg80211_rdev_free_wowlan(rdev);
7934                 rdev->wiphy.wowlan_config = NULL;
7935                 goto set_wakeup;
7936         }
7937
7938         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
7939                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
7940                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
7941                         nl80211_wowlan_policy);
7942         if (err)
7943                 return err;
7944
7945         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
7946                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
7947                         return -EINVAL;
7948                 new_triggers.any = true;
7949         }
7950
7951         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
7952                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
7953                         return -EINVAL;
7954                 new_triggers.disconnect = true;
7955         }
7956
7957         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
7958                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
7959                         return -EINVAL;
7960                 new_triggers.magic_pkt = true;
7961         }
7962
7963         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
7964                 return -EINVAL;
7965
7966         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
7967                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
7968                         return -EINVAL;
7969                 new_triggers.gtk_rekey_failure = true;
7970         }
7971
7972         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
7973                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
7974                         return -EINVAL;
7975                 new_triggers.eap_identity_req = true;
7976         }
7977
7978         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
7979                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
7980                         return -EINVAL;
7981                 new_triggers.four_way_handshake = true;
7982         }
7983
7984         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
7985                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
7986                         return -EINVAL;
7987                 new_triggers.rfkill_release = true;
7988         }
7989
7990         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
7991                 struct nlattr *pat;
7992                 int n_patterns = 0;
7993                 int rem, pat_len, mask_len, pkt_offset;
7994                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
7995
7996                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
7997                                     rem)
7998                         n_patterns++;
7999                 if (n_patterns > wowlan->n_patterns)
8000                         return -EINVAL;
8001
8002                 new_triggers.patterns = kcalloc(n_patterns,
8003                                                 sizeof(new_triggers.patterns[0]),
8004                                                 GFP_KERNEL);
8005                 if (!new_triggers.patterns)
8006                         return -ENOMEM;
8007
8008                 new_triggers.n_patterns = n_patterns;
8009                 i = 0;
8010
8011                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
8012                                     rem) {
8013                         nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
8014                                   nla_len(pat), NULL);
8015                         err = -EINVAL;
8016                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
8017                             !pat_tb[NL80211_PKTPAT_PATTERN])
8018                                 goto error;
8019                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
8020                         mask_len = DIV_ROUND_UP(pat_len, 8);
8021                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
8022                                 goto error;
8023                         if (pat_len > wowlan->pattern_max_len ||
8024                             pat_len < wowlan->pattern_min_len)
8025                                 goto error;
8026
8027                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
8028                                 pkt_offset = 0;
8029                         else
8030                                 pkt_offset = nla_get_u32(
8031                                         pat_tb[NL80211_PKTPAT_OFFSET]);
8032                         if (pkt_offset > wowlan->max_pkt_offset)
8033                                 goto error;
8034                         new_triggers.patterns[i].pkt_offset = pkt_offset;
8035
8036                         new_triggers.patterns[i].mask =
8037                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
8038                         if (!new_triggers.patterns[i].mask) {
8039                                 err = -ENOMEM;
8040                                 goto error;
8041                         }
8042                         new_triggers.patterns[i].pattern =
8043                                 new_triggers.patterns[i].mask + mask_len;
8044                         memcpy(new_triggers.patterns[i].mask,
8045                                nla_data(pat_tb[NL80211_PKTPAT_MASK]),
8046                                mask_len);
8047                         new_triggers.patterns[i].pattern_len = pat_len;
8048                         memcpy(new_triggers.patterns[i].pattern,
8049                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
8050                                pat_len);
8051                         i++;
8052                 }
8053         }
8054
8055         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
8056                 err = nl80211_parse_wowlan_tcp(
8057                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
8058                         &new_triggers);
8059                 if (err)
8060                         goto error;
8061         }
8062
8063         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
8064         if (!ntrig) {
8065                 err = -ENOMEM;
8066                 goto error;
8067         }
8068         cfg80211_rdev_free_wowlan(rdev);
8069         rdev->wiphy.wowlan_config = ntrig;
8070
8071  set_wakeup:
8072         if (rdev->ops->set_wakeup &&
8073             prev_enabled != !!rdev->wiphy.wowlan_config)
8074                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
8075
8076         return 0;
8077  error:
8078         for (i = 0; i < new_triggers.n_patterns; i++)
8079                 kfree(new_triggers.patterns[i].mask);
8080         kfree(new_triggers.patterns);
8081         if (new_triggers.tcp && new_triggers.tcp->sock)
8082                 sock_release(new_triggers.tcp->sock);
8083         kfree(new_triggers.tcp);
8084         return err;
8085 }
8086 #endif
8087
8088 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
8089                                        struct cfg80211_registered_device *rdev)
8090 {
8091         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
8092         int i, j, pat_len;
8093         struct cfg80211_coalesce_rules *rule;
8094
8095         if (!rdev->coalesce->n_rules)
8096                 return 0;
8097
8098         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
8099         if (!nl_rules)
8100                 return -ENOBUFS;
8101
8102         for (i = 0; i < rdev->coalesce->n_rules; i++) {
8103                 nl_rule = nla_nest_start(msg, i + 1);
8104                 if (!nl_rule)
8105                         return -ENOBUFS;
8106
8107                 rule = &rdev->coalesce->rules[i];
8108                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
8109                                 rule->delay))
8110                         return -ENOBUFS;
8111
8112                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
8113                                 rule->condition))
8114                         return -ENOBUFS;
8115
8116                 nl_pats = nla_nest_start(msg,
8117                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
8118                 if (!nl_pats)
8119                         return -ENOBUFS;
8120
8121                 for (j = 0; j < rule->n_patterns; j++) {
8122                         nl_pat = nla_nest_start(msg, j + 1);
8123                         if (!nl_pat)
8124                                 return -ENOBUFS;
8125                         pat_len = rule->patterns[j].pattern_len;
8126                         if (nla_put(msg, NL80211_PKTPAT_MASK,
8127                                     DIV_ROUND_UP(pat_len, 8),
8128                                     rule->patterns[j].mask) ||
8129                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
8130                                     rule->patterns[j].pattern) ||
8131                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
8132                                         rule->patterns[j].pkt_offset))
8133                                 return -ENOBUFS;
8134                         nla_nest_end(msg, nl_pat);
8135                 }
8136                 nla_nest_end(msg, nl_pats);
8137                 nla_nest_end(msg, nl_rule);
8138         }
8139         nla_nest_end(msg, nl_rules);
8140
8141         return 0;
8142 }
8143
8144 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
8145 {
8146         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8147         struct sk_buff *msg;
8148         void *hdr;
8149
8150         if (!rdev->wiphy.coalesce)
8151                 return -EOPNOTSUPP;
8152
8153         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8154         if (!msg)
8155                 return -ENOMEM;
8156
8157         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8158                              NL80211_CMD_GET_COALESCE);
8159         if (!hdr)
8160                 goto nla_put_failure;
8161
8162         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
8163                 goto nla_put_failure;
8164
8165         genlmsg_end(msg, hdr);
8166         return genlmsg_reply(msg, info);
8167
8168 nla_put_failure:
8169         nlmsg_free(msg);
8170         return -ENOBUFS;
8171 }
8172
8173 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
8174 {
8175         struct cfg80211_coalesce *coalesce = rdev->coalesce;
8176         int i, j;
8177         struct cfg80211_coalesce_rules *rule;
8178
8179         if (!coalesce)
8180                 return;
8181
8182         for (i = 0; i < coalesce->n_rules; i++) {
8183                 rule = &coalesce->rules[i];
8184                 for (j = 0; j < rule->n_patterns; j++)
8185                         kfree(rule->patterns[j].mask);
8186                 kfree(rule->patterns);
8187         }
8188         kfree(coalesce->rules);
8189         kfree(coalesce);
8190         rdev->coalesce = NULL;
8191 }
8192
8193 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
8194                                        struct nlattr *rule,
8195                                        struct cfg80211_coalesce_rules *new_rule)
8196 {
8197         int err, i;
8198         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
8199         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
8200         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
8201         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
8202
8203         err = nla_parse(tb, NL80211_ATTR_COALESCE_RULE_MAX, nla_data(rule),
8204                         nla_len(rule), nl80211_coalesce_policy);
8205         if (err)
8206                 return err;
8207
8208         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
8209                 new_rule->delay =
8210                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
8211         if (new_rule->delay > coalesce->max_delay)
8212                 return -EINVAL;
8213
8214         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
8215                 new_rule->condition =
8216                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
8217         if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
8218             new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
8219                 return -EINVAL;
8220
8221         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
8222                 return -EINVAL;
8223
8224         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
8225                             rem)
8226                 n_patterns++;
8227         if (n_patterns > coalesce->n_patterns)
8228                 return -EINVAL;
8229
8230         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
8231                                      GFP_KERNEL);
8232         if (!new_rule->patterns)
8233                 return -ENOMEM;
8234
8235         new_rule->n_patterns = n_patterns;
8236         i = 0;
8237
8238         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
8239                             rem) {
8240                 nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
8241                           nla_len(pat), NULL);
8242                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
8243                     !pat_tb[NL80211_PKTPAT_PATTERN])
8244                         return -EINVAL;
8245                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
8246                 mask_len = DIV_ROUND_UP(pat_len, 8);
8247                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
8248                         return -EINVAL;
8249                 if (pat_len > coalesce->pattern_max_len ||
8250                     pat_len < coalesce->pattern_min_len)
8251                         return -EINVAL;
8252
8253                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
8254                         pkt_offset = 0;
8255                 else
8256                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
8257                 if (pkt_offset > coalesce->max_pkt_offset)
8258                         return -EINVAL;
8259                 new_rule->patterns[i].pkt_offset = pkt_offset;
8260
8261                 new_rule->patterns[i].mask =
8262                         kmalloc(mask_len + pat_len, GFP_KERNEL);
8263                 if (!new_rule->patterns[i].mask)
8264                         return -ENOMEM;
8265                 new_rule->patterns[i].pattern =
8266                         new_rule->patterns[i].mask + mask_len;
8267                 memcpy(new_rule->patterns[i].mask,
8268                        nla_data(pat_tb[NL80211_PKTPAT_MASK]), mask_len);
8269                 new_rule->patterns[i].pattern_len = pat_len;
8270                 memcpy(new_rule->patterns[i].pattern,
8271                        nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), pat_len);
8272                 i++;
8273         }
8274
8275         return 0;
8276 }
8277
8278 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
8279 {
8280         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8281         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
8282         struct cfg80211_coalesce new_coalesce = {};
8283         struct cfg80211_coalesce *n_coalesce;
8284         int err, rem_rule, n_rules = 0, i, j;
8285         struct nlattr *rule;
8286         struct cfg80211_coalesce_rules *tmp_rule;
8287
8288         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
8289                 return -EOPNOTSUPP;
8290
8291         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
8292                 cfg80211_rdev_free_coalesce(rdev);
8293                 rdev->ops->set_coalesce(&rdev->wiphy, NULL);
8294                 return 0;
8295         }
8296
8297         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
8298                             rem_rule)
8299                 n_rules++;
8300         if (n_rules > coalesce->n_rules)
8301                 return -EINVAL;
8302
8303         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
8304                                      GFP_KERNEL);
8305         if (!new_coalesce.rules)
8306                 return -ENOMEM;
8307
8308         new_coalesce.n_rules = n_rules;
8309         i = 0;
8310
8311         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
8312                             rem_rule) {
8313                 err = nl80211_parse_coalesce_rule(rdev, rule,
8314                                                   &new_coalesce.rules[i]);
8315                 if (err)
8316                         goto error;
8317
8318                 i++;
8319         }
8320
8321         err = rdev->ops->set_coalesce(&rdev->wiphy, &new_coalesce);
8322         if (err)
8323                 goto error;
8324
8325         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
8326         if (!n_coalesce) {
8327                 err = -ENOMEM;
8328                 goto error;
8329         }
8330         cfg80211_rdev_free_coalesce(rdev);
8331         rdev->coalesce = n_coalesce;
8332
8333         return 0;
8334 error:
8335         for (i = 0; i < new_coalesce.n_rules; i++) {
8336                 tmp_rule = &new_coalesce.rules[i];
8337                 for (j = 0; j < tmp_rule->n_patterns; j++)
8338                         kfree(tmp_rule->patterns[j].mask);
8339                 kfree(tmp_rule->patterns);
8340         }
8341         kfree(new_coalesce.rules);
8342
8343         return err;
8344 }
8345
8346 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
8347 {
8348         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8349         struct net_device *dev = info->user_ptr[1];
8350         struct wireless_dev *wdev = dev->ieee80211_ptr;
8351         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
8352         struct cfg80211_gtk_rekey_data rekey_data;
8353         int err;
8354
8355         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
8356                 return -EINVAL;
8357
8358         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
8359                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
8360                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
8361                         nl80211_rekey_policy);
8362         if (err)
8363                 return err;
8364
8365         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
8366                 return -ERANGE;
8367         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
8368                 return -ERANGE;
8369         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
8370                 return -ERANGE;
8371
8372         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
8373                NL80211_KEK_LEN);
8374         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
8375                NL80211_KCK_LEN);
8376         memcpy(rekey_data.replay_ctr,
8377                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
8378                NL80211_REPLAY_CTR_LEN);
8379
8380         wdev_lock(wdev);
8381         if (!wdev->current_bss) {
8382                 err = -ENOTCONN;
8383                 goto out;
8384         }
8385
8386         if (!rdev->ops->set_rekey_data) {
8387                 err = -EOPNOTSUPP;
8388                 goto out;
8389         }
8390
8391         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
8392  out:
8393         wdev_unlock(wdev);
8394         return err;
8395 }
8396
8397 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
8398                                              struct genl_info *info)
8399 {
8400         struct net_device *dev = info->user_ptr[1];
8401         struct wireless_dev *wdev = dev->ieee80211_ptr;
8402
8403         if (wdev->iftype != NL80211_IFTYPE_AP &&
8404             wdev->iftype != NL80211_IFTYPE_P2P_GO)
8405                 return -EINVAL;
8406
8407         if (wdev->ap_unexpected_nlportid)
8408                 return -EBUSY;
8409
8410         wdev->ap_unexpected_nlportid = info->snd_portid;
8411         return 0;
8412 }
8413
8414 static int nl80211_probe_client(struct sk_buff *skb,
8415                                 struct genl_info *info)
8416 {
8417         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8418         struct net_device *dev = info->user_ptr[1];
8419         struct wireless_dev *wdev = dev->ieee80211_ptr;
8420         struct sk_buff *msg;
8421         void *hdr;
8422         const u8 *addr;
8423         u64 cookie;
8424         int err;
8425
8426         if (wdev->iftype != NL80211_IFTYPE_AP &&
8427             wdev->iftype != NL80211_IFTYPE_P2P_GO)
8428                 return -EOPNOTSUPP;
8429
8430         if (!info->attrs[NL80211_ATTR_MAC])
8431                 return -EINVAL;
8432
8433         if (!rdev->ops->probe_client)
8434                 return -EOPNOTSUPP;
8435
8436         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8437         if (!msg)
8438                 return -ENOMEM;
8439
8440         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8441                              NL80211_CMD_PROBE_CLIENT);
8442
8443         if (IS_ERR(hdr)) {
8444                 err = PTR_ERR(hdr);
8445                 goto free_msg;
8446         }
8447
8448         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
8449
8450         err = rdev_probe_client(rdev, dev, addr, &cookie);
8451         if (err)
8452                 goto free_msg;
8453
8454         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8455                 goto nla_put_failure;
8456
8457         genlmsg_end(msg, hdr);
8458
8459         return genlmsg_reply(msg, info);
8460
8461  nla_put_failure:
8462         err = -ENOBUFS;
8463  free_msg:
8464         nlmsg_free(msg);
8465         return err;
8466 }
8467
8468 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
8469 {
8470         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8471         struct cfg80211_beacon_registration *reg, *nreg;
8472         int rv;
8473
8474         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
8475                 return -EOPNOTSUPP;
8476
8477         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
8478         if (!nreg)
8479                 return -ENOMEM;
8480
8481         /* First, check if already registered. */
8482         spin_lock_bh(&rdev->beacon_registrations_lock);
8483         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
8484                 if (reg->nlportid == info->snd_portid) {
8485                         rv = -EALREADY;
8486                         goto out_err;
8487                 }
8488         }
8489         /* Add it to the list */
8490         nreg->nlportid = info->snd_portid;
8491         list_add(&nreg->list, &rdev->beacon_registrations);
8492
8493         spin_unlock_bh(&rdev->beacon_registrations_lock);
8494
8495         return 0;
8496 out_err:
8497         spin_unlock_bh(&rdev->beacon_registrations_lock);
8498         kfree(nreg);
8499         return rv;
8500 }
8501
8502 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
8503 {
8504         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8505         struct wireless_dev *wdev = info->user_ptr[1];
8506         int err;
8507
8508         if (!rdev->ops->start_p2p_device)
8509                 return -EOPNOTSUPP;
8510
8511         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
8512                 return -EOPNOTSUPP;
8513
8514         if (wdev->p2p_started)
8515                 return 0;
8516
8517         err = cfg80211_can_add_interface(rdev, wdev->iftype);
8518         if (err)
8519                 return err;
8520
8521         err = rdev_start_p2p_device(rdev, wdev);
8522         if (err)
8523                 return err;
8524
8525         wdev->p2p_started = true;
8526         rdev->opencount++;
8527
8528         return 0;
8529 }
8530
8531 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
8532 {
8533         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8534         struct wireless_dev *wdev = info->user_ptr[1];
8535
8536         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
8537                 return -EOPNOTSUPP;
8538
8539         if (!rdev->ops->stop_p2p_device)
8540                 return -EOPNOTSUPP;
8541
8542         cfg80211_stop_p2p_device(rdev, wdev);
8543
8544         return 0;
8545 }
8546
8547 static int nl80211_get_protocol_features(struct sk_buff *skb,
8548                                          struct genl_info *info)
8549 {
8550         void *hdr;
8551         struct sk_buff *msg;
8552
8553         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8554         if (!msg)
8555                 return -ENOMEM;
8556
8557         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8558                              NL80211_CMD_GET_PROTOCOL_FEATURES);
8559         if (!hdr)
8560                 goto nla_put_failure;
8561
8562         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
8563                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
8564                 goto nla_put_failure;
8565
8566         genlmsg_end(msg, hdr);
8567         return genlmsg_reply(msg, info);
8568
8569  nla_put_failure:
8570         kfree_skb(msg);
8571         return -ENOBUFS;
8572 }
8573
8574 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
8575 {
8576         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8577         struct cfg80211_update_ft_ies_params ft_params;
8578         struct net_device *dev = info->user_ptr[1];
8579
8580         if (!rdev->ops->update_ft_ies)
8581                 return -EOPNOTSUPP;
8582
8583         if (!info->attrs[NL80211_ATTR_MDID] ||
8584             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8585                 return -EINVAL;
8586
8587         memset(&ft_params, 0, sizeof(ft_params));
8588         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
8589         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8590         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8591
8592         return rdev_update_ft_ies(rdev, dev, &ft_params);
8593 }
8594
8595 static int nl80211_crit_protocol_start(struct sk_buff *skb,
8596                                        struct genl_info *info)
8597 {
8598         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8599         struct wireless_dev *wdev = info->user_ptr[1];
8600         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
8601         u16 duration;
8602         int ret;
8603
8604         if (!rdev->ops->crit_proto_start)
8605                 return -EOPNOTSUPP;
8606
8607         if (WARN_ON(!rdev->ops->crit_proto_stop))
8608                 return -EINVAL;
8609
8610         if (rdev->crit_proto_nlportid)
8611                 return -EBUSY;
8612
8613         /* determine protocol if provided */
8614         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
8615                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
8616
8617         if (proto >= NUM_NL80211_CRIT_PROTO)
8618                 return -EINVAL;
8619
8620         /* timeout must be provided */
8621         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
8622                 return -EINVAL;
8623
8624         duration =
8625                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
8626
8627         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
8628                 return -ERANGE;
8629
8630         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
8631         if (!ret)
8632                 rdev->crit_proto_nlportid = info->snd_portid;
8633
8634         return ret;
8635 }
8636
8637 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
8638                                       struct genl_info *info)
8639 {
8640         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8641         struct wireless_dev *wdev = info->user_ptr[1];
8642
8643         if (!rdev->ops->crit_proto_stop)
8644                 return -EOPNOTSUPP;
8645
8646         if (rdev->crit_proto_nlportid) {
8647                 rdev->crit_proto_nlportid = 0;
8648                 rdev_crit_proto_stop(rdev, wdev);
8649         }
8650         return 0;
8651 }
8652
8653 #define NL80211_FLAG_NEED_WIPHY         0x01
8654 #define NL80211_FLAG_NEED_NETDEV        0x02
8655 #define NL80211_FLAG_NEED_RTNL          0x04
8656 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
8657 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
8658                                          NL80211_FLAG_CHECK_NETDEV_UP)
8659 #define NL80211_FLAG_NEED_WDEV          0x10
8660 /* If a netdev is associated, it must be UP, P2P must be started */
8661 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
8662                                          NL80211_FLAG_CHECK_NETDEV_UP)
8663
8664 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
8665                             struct genl_info *info)
8666 {
8667         struct cfg80211_registered_device *rdev;
8668         struct wireless_dev *wdev;
8669         struct net_device *dev;
8670         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
8671
8672         if (rtnl)
8673                 rtnl_lock();
8674
8675         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
8676                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
8677                 if (IS_ERR(rdev)) {
8678                         if (rtnl)
8679                                 rtnl_unlock();
8680                         return PTR_ERR(rdev);
8681                 }
8682                 info->user_ptr[0] = rdev;
8683         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
8684                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
8685                 ASSERT_RTNL();
8686
8687                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
8688                                                   info->attrs);
8689                 if (IS_ERR(wdev)) {
8690                         if (rtnl)
8691                                 rtnl_unlock();
8692                         return PTR_ERR(wdev);
8693                 }
8694
8695                 dev = wdev->netdev;
8696                 rdev = wiphy_to_dev(wdev->wiphy);
8697
8698                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
8699                         if (!dev) {
8700                                 if (rtnl)
8701                                         rtnl_unlock();
8702                                 return -EINVAL;
8703                         }
8704
8705                         info->user_ptr[1] = dev;
8706                 } else {
8707                         info->user_ptr[1] = wdev;
8708                 }
8709
8710                 if (dev) {
8711                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
8712                             !netif_running(dev)) {
8713                                 if (rtnl)
8714                                         rtnl_unlock();
8715                                 return -ENETDOWN;
8716                         }
8717
8718                         dev_hold(dev);
8719                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
8720                         if (!wdev->p2p_started) {
8721                                 if (rtnl)
8722                                         rtnl_unlock();
8723                                 return -ENETDOWN;
8724                         }
8725                 }
8726
8727                 info->user_ptr[0] = rdev;
8728         }
8729
8730         return 0;
8731 }
8732
8733 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
8734                               struct genl_info *info)
8735 {
8736         if (info->user_ptr[1]) {
8737                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
8738                         struct wireless_dev *wdev = info->user_ptr[1];
8739
8740                         if (wdev->netdev)
8741                                 dev_put(wdev->netdev);
8742                 } else {
8743                         dev_put(info->user_ptr[1]);
8744                 }
8745         }
8746         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
8747                 rtnl_unlock();
8748 }
8749
8750 static struct genl_ops nl80211_ops[] = {
8751         {
8752                 .cmd = NL80211_CMD_GET_WIPHY,
8753                 .doit = nl80211_get_wiphy,
8754                 .dumpit = nl80211_dump_wiphy,
8755                 .done = nl80211_dump_wiphy_done,
8756                 .policy = nl80211_policy,
8757                 /* can be retrieved by unprivileged users */
8758                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8759                                   NL80211_FLAG_NEED_RTNL,
8760         },
8761         {
8762                 .cmd = NL80211_CMD_SET_WIPHY,
8763                 .doit = nl80211_set_wiphy,
8764                 .policy = nl80211_policy,
8765                 .flags = GENL_ADMIN_PERM,
8766                 .internal_flags = NL80211_FLAG_NEED_RTNL,
8767         },
8768         {
8769                 .cmd = NL80211_CMD_GET_INTERFACE,
8770                 .doit = nl80211_get_interface,
8771                 .dumpit = nl80211_dump_interface,
8772                 .policy = nl80211_policy,
8773                 /* can be retrieved by unprivileged users */
8774                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8775                                   NL80211_FLAG_NEED_RTNL,
8776         },
8777         {
8778                 .cmd = NL80211_CMD_SET_INTERFACE,
8779                 .doit = nl80211_set_interface,
8780                 .policy = nl80211_policy,
8781                 .flags = GENL_ADMIN_PERM,
8782                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8783                                   NL80211_FLAG_NEED_RTNL,
8784         },
8785         {
8786                 .cmd = NL80211_CMD_NEW_INTERFACE,
8787                 .doit = nl80211_new_interface,
8788                 .policy = nl80211_policy,
8789                 .flags = GENL_ADMIN_PERM,
8790                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8791                                   NL80211_FLAG_NEED_RTNL,
8792         },
8793         {
8794                 .cmd = NL80211_CMD_DEL_INTERFACE,
8795                 .doit = nl80211_del_interface,
8796                 .policy = nl80211_policy,
8797                 .flags = GENL_ADMIN_PERM,
8798                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8799                                   NL80211_FLAG_NEED_RTNL,
8800         },
8801         {
8802                 .cmd = NL80211_CMD_GET_KEY,
8803                 .doit = nl80211_get_key,
8804                 .policy = nl80211_policy,
8805                 .flags = GENL_ADMIN_PERM,
8806                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8807                                   NL80211_FLAG_NEED_RTNL,
8808         },
8809         {
8810                 .cmd = NL80211_CMD_SET_KEY,
8811                 .doit = nl80211_set_key,
8812                 .policy = nl80211_policy,
8813                 .flags = GENL_ADMIN_PERM,
8814                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8815                                   NL80211_FLAG_NEED_RTNL,
8816         },
8817         {
8818                 .cmd = NL80211_CMD_NEW_KEY,
8819                 .doit = nl80211_new_key,
8820                 .policy = nl80211_policy,
8821                 .flags = GENL_ADMIN_PERM,
8822                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8823                                   NL80211_FLAG_NEED_RTNL,
8824         },
8825         {
8826                 .cmd = NL80211_CMD_DEL_KEY,
8827                 .doit = nl80211_del_key,
8828                 .policy = nl80211_policy,
8829                 .flags = GENL_ADMIN_PERM,
8830                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8831                                   NL80211_FLAG_NEED_RTNL,
8832         },
8833         {
8834                 .cmd = NL80211_CMD_SET_BEACON,
8835                 .policy = nl80211_policy,
8836                 .flags = GENL_ADMIN_PERM,
8837                 .doit = nl80211_set_beacon,
8838                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8839                                   NL80211_FLAG_NEED_RTNL,
8840         },
8841         {
8842                 .cmd = NL80211_CMD_START_AP,
8843                 .policy = nl80211_policy,
8844                 .flags = GENL_ADMIN_PERM,
8845                 .doit = nl80211_start_ap,
8846                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8847                                   NL80211_FLAG_NEED_RTNL,
8848         },
8849         {
8850                 .cmd = NL80211_CMD_STOP_AP,
8851                 .policy = nl80211_policy,
8852                 .flags = GENL_ADMIN_PERM,
8853                 .doit = nl80211_stop_ap,
8854                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8855                                   NL80211_FLAG_NEED_RTNL,
8856         },
8857         {
8858                 .cmd = NL80211_CMD_GET_STATION,
8859                 .doit = nl80211_get_station,
8860                 .dumpit = nl80211_dump_station,
8861                 .policy = nl80211_policy,
8862                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8863                                   NL80211_FLAG_NEED_RTNL,
8864         },
8865         {
8866                 .cmd = NL80211_CMD_SET_STATION,
8867                 .doit = nl80211_set_station,
8868                 .policy = nl80211_policy,
8869                 .flags = GENL_ADMIN_PERM,
8870                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8871                                   NL80211_FLAG_NEED_RTNL,
8872         },
8873         {
8874                 .cmd = NL80211_CMD_NEW_STATION,
8875                 .doit = nl80211_new_station,
8876                 .policy = nl80211_policy,
8877                 .flags = GENL_ADMIN_PERM,
8878                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8879                                   NL80211_FLAG_NEED_RTNL,
8880         },
8881         {
8882                 .cmd = NL80211_CMD_DEL_STATION,
8883                 .doit = nl80211_del_station,
8884                 .policy = nl80211_policy,
8885                 .flags = GENL_ADMIN_PERM,
8886                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8887                                   NL80211_FLAG_NEED_RTNL,
8888         },
8889         {
8890                 .cmd = NL80211_CMD_GET_MPATH,
8891                 .doit = nl80211_get_mpath,
8892                 .dumpit = nl80211_dump_mpath,
8893                 .policy = nl80211_policy,
8894                 .flags = GENL_ADMIN_PERM,
8895                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8896                                   NL80211_FLAG_NEED_RTNL,
8897         },
8898         {
8899                 .cmd = NL80211_CMD_SET_MPATH,
8900                 .doit = nl80211_set_mpath,
8901                 .policy = nl80211_policy,
8902                 .flags = GENL_ADMIN_PERM,
8903                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8904                                   NL80211_FLAG_NEED_RTNL,
8905         },
8906         {
8907                 .cmd = NL80211_CMD_NEW_MPATH,
8908                 .doit = nl80211_new_mpath,
8909                 .policy = nl80211_policy,
8910                 .flags = GENL_ADMIN_PERM,
8911                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8912                                   NL80211_FLAG_NEED_RTNL,
8913         },
8914         {
8915                 .cmd = NL80211_CMD_DEL_MPATH,
8916                 .doit = nl80211_del_mpath,
8917                 .policy = nl80211_policy,
8918                 .flags = GENL_ADMIN_PERM,
8919                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8920                                   NL80211_FLAG_NEED_RTNL,
8921         },
8922         {
8923                 .cmd = NL80211_CMD_SET_BSS,
8924                 .doit = nl80211_set_bss,
8925                 .policy = nl80211_policy,
8926                 .flags = GENL_ADMIN_PERM,
8927                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8928                                   NL80211_FLAG_NEED_RTNL,
8929         },
8930         {
8931                 .cmd = NL80211_CMD_GET_REG,
8932                 .doit = nl80211_get_reg,
8933                 .policy = nl80211_policy,
8934                 .internal_flags = NL80211_FLAG_NEED_RTNL,
8935                 /* can be retrieved by unprivileged users */
8936         },
8937         {
8938                 .cmd = NL80211_CMD_SET_REG,
8939                 .doit = nl80211_set_reg,
8940                 .policy = nl80211_policy,
8941                 .flags = GENL_ADMIN_PERM,
8942                 .internal_flags = NL80211_FLAG_NEED_RTNL,
8943         },
8944         {
8945                 .cmd = NL80211_CMD_REQ_SET_REG,
8946                 .doit = nl80211_req_set_reg,
8947                 .policy = nl80211_policy,
8948                 .flags = GENL_ADMIN_PERM,
8949         },
8950         {
8951                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
8952                 .doit = nl80211_get_mesh_config,
8953                 .policy = nl80211_policy,
8954                 /* can be retrieved by unprivileged users */
8955                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8956                                   NL80211_FLAG_NEED_RTNL,
8957         },
8958         {
8959                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
8960                 .doit = nl80211_update_mesh_config,
8961                 .policy = nl80211_policy,
8962                 .flags = GENL_ADMIN_PERM,
8963                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8964                                   NL80211_FLAG_NEED_RTNL,
8965         },
8966         {
8967                 .cmd = NL80211_CMD_TRIGGER_SCAN,
8968                 .doit = nl80211_trigger_scan,
8969                 .policy = nl80211_policy,
8970                 .flags = GENL_ADMIN_PERM,
8971                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8972                                   NL80211_FLAG_NEED_RTNL,
8973         },
8974         {
8975                 .cmd = NL80211_CMD_GET_SCAN,
8976                 .policy = nl80211_policy,
8977                 .dumpit = nl80211_dump_scan,
8978         },
8979         {
8980                 .cmd = NL80211_CMD_START_SCHED_SCAN,
8981                 .doit = nl80211_start_sched_scan,
8982                 .policy = nl80211_policy,
8983                 .flags = GENL_ADMIN_PERM,
8984                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8985                                   NL80211_FLAG_NEED_RTNL,
8986         },
8987         {
8988                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
8989                 .doit = nl80211_stop_sched_scan,
8990                 .policy = nl80211_policy,
8991                 .flags = GENL_ADMIN_PERM,
8992                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8993                                   NL80211_FLAG_NEED_RTNL,
8994         },
8995         {
8996                 .cmd = NL80211_CMD_AUTHENTICATE,
8997                 .doit = nl80211_authenticate,
8998                 .policy = nl80211_policy,
8999                 .flags = GENL_ADMIN_PERM,
9000                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9001                                   NL80211_FLAG_NEED_RTNL,
9002         },
9003         {
9004                 .cmd = NL80211_CMD_ASSOCIATE,
9005                 .doit = nl80211_associate,
9006                 .policy = nl80211_policy,
9007                 .flags = GENL_ADMIN_PERM,
9008                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9009                                   NL80211_FLAG_NEED_RTNL,
9010         },
9011         {
9012                 .cmd = NL80211_CMD_DEAUTHENTICATE,
9013                 .doit = nl80211_deauthenticate,
9014                 .policy = nl80211_policy,
9015                 .flags = GENL_ADMIN_PERM,
9016                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9017                                   NL80211_FLAG_NEED_RTNL,
9018         },
9019         {
9020                 .cmd = NL80211_CMD_DISASSOCIATE,
9021                 .doit = nl80211_disassociate,
9022                 .policy = nl80211_policy,
9023                 .flags = GENL_ADMIN_PERM,
9024                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9025                                   NL80211_FLAG_NEED_RTNL,
9026         },
9027         {
9028                 .cmd = NL80211_CMD_JOIN_IBSS,
9029                 .doit = nl80211_join_ibss,
9030                 .policy = nl80211_policy,
9031                 .flags = GENL_ADMIN_PERM,
9032                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9033                                   NL80211_FLAG_NEED_RTNL,
9034         },
9035         {
9036                 .cmd = NL80211_CMD_LEAVE_IBSS,
9037                 .doit = nl80211_leave_ibss,
9038                 .policy = nl80211_policy,
9039                 .flags = GENL_ADMIN_PERM,
9040                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9041                                   NL80211_FLAG_NEED_RTNL,
9042         },
9043 #ifdef CONFIG_NL80211_TESTMODE
9044         {
9045                 .cmd = NL80211_CMD_TESTMODE,
9046                 .doit = nl80211_testmode_do,
9047                 .dumpit = nl80211_testmode_dump,
9048                 .policy = nl80211_policy,
9049                 .flags = GENL_ADMIN_PERM,
9050                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9051                                   NL80211_FLAG_NEED_RTNL,
9052         },
9053 #endif
9054         {
9055                 .cmd = NL80211_CMD_CONNECT,
9056                 .doit = nl80211_connect,
9057                 .policy = nl80211_policy,
9058                 .flags = GENL_ADMIN_PERM,
9059                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9060                                   NL80211_FLAG_NEED_RTNL,
9061         },
9062         {
9063                 .cmd = NL80211_CMD_DISCONNECT,
9064                 .doit = nl80211_disconnect,
9065                 .policy = nl80211_policy,
9066                 .flags = GENL_ADMIN_PERM,
9067                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9068                                   NL80211_FLAG_NEED_RTNL,
9069         },
9070         {
9071                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
9072                 .doit = nl80211_wiphy_netns,
9073                 .policy = nl80211_policy,
9074                 .flags = GENL_ADMIN_PERM,
9075                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9076                                   NL80211_FLAG_NEED_RTNL,
9077         },
9078         {
9079                 .cmd = NL80211_CMD_GET_SURVEY,
9080                 .policy = nl80211_policy,
9081                 .dumpit = nl80211_dump_survey,
9082         },
9083         {
9084                 .cmd = NL80211_CMD_SET_PMKSA,
9085                 .doit = nl80211_setdel_pmksa,
9086                 .policy = nl80211_policy,
9087                 .flags = GENL_ADMIN_PERM,
9088                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9089                                   NL80211_FLAG_NEED_RTNL,
9090         },
9091         {
9092                 .cmd = NL80211_CMD_DEL_PMKSA,
9093                 .doit = nl80211_setdel_pmksa,
9094                 .policy = nl80211_policy,
9095                 .flags = GENL_ADMIN_PERM,
9096                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9097                                   NL80211_FLAG_NEED_RTNL,
9098         },
9099         {
9100                 .cmd = NL80211_CMD_FLUSH_PMKSA,
9101                 .doit = nl80211_flush_pmksa,
9102                 .policy = nl80211_policy,
9103                 .flags = GENL_ADMIN_PERM,
9104                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9105                                   NL80211_FLAG_NEED_RTNL,
9106         },
9107         {
9108                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
9109                 .doit = nl80211_remain_on_channel,
9110                 .policy = nl80211_policy,
9111                 .flags = GENL_ADMIN_PERM,
9112                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9113                                   NL80211_FLAG_NEED_RTNL,
9114         },
9115         {
9116                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
9117                 .doit = nl80211_cancel_remain_on_channel,
9118                 .policy = nl80211_policy,
9119                 .flags = GENL_ADMIN_PERM,
9120                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9121                                   NL80211_FLAG_NEED_RTNL,
9122         },
9123         {
9124                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
9125                 .doit = nl80211_set_tx_bitrate_mask,
9126                 .policy = nl80211_policy,
9127                 .flags = GENL_ADMIN_PERM,
9128                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9129                                   NL80211_FLAG_NEED_RTNL,
9130         },
9131         {
9132                 .cmd = NL80211_CMD_REGISTER_FRAME,
9133                 .doit = nl80211_register_mgmt,
9134                 .policy = nl80211_policy,
9135                 .flags = GENL_ADMIN_PERM,
9136                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9137                                   NL80211_FLAG_NEED_RTNL,
9138         },
9139         {
9140                 .cmd = NL80211_CMD_FRAME,
9141                 .doit = nl80211_tx_mgmt,
9142                 .policy = nl80211_policy,
9143                 .flags = GENL_ADMIN_PERM,
9144                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9145                                   NL80211_FLAG_NEED_RTNL,
9146         },
9147         {
9148                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
9149                 .doit = nl80211_tx_mgmt_cancel_wait,
9150                 .policy = nl80211_policy,
9151                 .flags = GENL_ADMIN_PERM,
9152                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9153                                   NL80211_FLAG_NEED_RTNL,
9154         },
9155         {
9156                 .cmd = NL80211_CMD_SET_POWER_SAVE,
9157                 .doit = nl80211_set_power_save,
9158                 .policy = nl80211_policy,
9159                 .flags = GENL_ADMIN_PERM,
9160                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9161                                   NL80211_FLAG_NEED_RTNL,
9162         },
9163         {
9164                 .cmd = NL80211_CMD_GET_POWER_SAVE,
9165                 .doit = nl80211_get_power_save,
9166                 .policy = nl80211_policy,
9167                 /* can be retrieved by unprivileged users */
9168                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9169                                   NL80211_FLAG_NEED_RTNL,
9170         },
9171         {
9172                 .cmd = NL80211_CMD_SET_CQM,
9173                 .doit = nl80211_set_cqm,
9174                 .policy = nl80211_policy,
9175                 .flags = GENL_ADMIN_PERM,
9176                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9177                                   NL80211_FLAG_NEED_RTNL,
9178         },
9179         {
9180                 .cmd = NL80211_CMD_SET_CHANNEL,
9181                 .doit = nl80211_set_channel,
9182                 .policy = nl80211_policy,
9183                 .flags = GENL_ADMIN_PERM,
9184                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9185                                   NL80211_FLAG_NEED_RTNL,
9186         },
9187         {
9188                 .cmd = NL80211_CMD_SET_WDS_PEER,
9189                 .doit = nl80211_set_wds_peer,
9190                 .policy = nl80211_policy,
9191                 .flags = GENL_ADMIN_PERM,
9192                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9193                                   NL80211_FLAG_NEED_RTNL,
9194         },
9195         {
9196                 .cmd = NL80211_CMD_JOIN_MESH,
9197                 .doit = nl80211_join_mesh,
9198                 .policy = nl80211_policy,
9199                 .flags = GENL_ADMIN_PERM,
9200                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9201                                   NL80211_FLAG_NEED_RTNL,
9202         },
9203         {
9204                 .cmd = NL80211_CMD_LEAVE_MESH,
9205                 .doit = nl80211_leave_mesh,
9206                 .policy = nl80211_policy,
9207                 .flags = GENL_ADMIN_PERM,
9208                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9209                                   NL80211_FLAG_NEED_RTNL,
9210         },
9211 #ifdef CONFIG_PM
9212         {
9213                 .cmd = NL80211_CMD_GET_WOWLAN,
9214                 .doit = nl80211_get_wowlan,
9215                 .policy = nl80211_policy,
9216                 /* can be retrieved by unprivileged users */
9217                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9218                                   NL80211_FLAG_NEED_RTNL,
9219         },
9220         {
9221                 .cmd = NL80211_CMD_SET_WOWLAN,
9222                 .doit = nl80211_set_wowlan,
9223                 .policy = nl80211_policy,
9224                 .flags = GENL_ADMIN_PERM,
9225                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9226                                   NL80211_FLAG_NEED_RTNL,
9227         },
9228 #endif
9229         {
9230                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
9231                 .doit = nl80211_set_rekey_data,
9232                 .policy = nl80211_policy,
9233                 .flags = GENL_ADMIN_PERM,
9234                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9235                                   NL80211_FLAG_NEED_RTNL,
9236         },
9237         {
9238                 .cmd = NL80211_CMD_TDLS_MGMT,
9239                 .doit = nl80211_tdls_mgmt,
9240                 .policy = nl80211_policy,
9241                 .flags = GENL_ADMIN_PERM,
9242                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9243                                   NL80211_FLAG_NEED_RTNL,
9244         },
9245         {
9246                 .cmd = NL80211_CMD_TDLS_OPER,
9247                 .doit = nl80211_tdls_oper,
9248                 .policy = nl80211_policy,
9249                 .flags = GENL_ADMIN_PERM,
9250                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9251                                   NL80211_FLAG_NEED_RTNL,
9252         },
9253         {
9254                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
9255                 .doit = nl80211_register_unexpected_frame,
9256                 .policy = nl80211_policy,
9257                 .flags = GENL_ADMIN_PERM,
9258                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9259                                   NL80211_FLAG_NEED_RTNL,
9260         },
9261         {
9262                 .cmd = NL80211_CMD_PROBE_CLIENT,
9263                 .doit = nl80211_probe_client,
9264                 .policy = nl80211_policy,
9265                 .flags = GENL_ADMIN_PERM,
9266                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9267                                   NL80211_FLAG_NEED_RTNL,
9268         },
9269         {
9270                 .cmd = NL80211_CMD_REGISTER_BEACONS,
9271                 .doit = nl80211_register_beacons,
9272                 .policy = nl80211_policy,
9273                 .flags = GENL_ADMIN_PERM,
9274                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9275                                   NL80211_FLAG_NEED_RTNL,
9276         },
9277         {
9278                 .cmd = NL80211_CMD_SET_NOACK_MAP,
9279                 .doit = nl80211_set_noack_map,
9280                 .policy = nl80211_policy,
9281                 .flags = GENL_ADMIN_PERM,
9282                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9283                                   NL80211_FLAG_NEED_RTNL,
9284         },
9285         {
9286                 .cmd = NL80211_CMD_START_P2P_DEVICE,
9287                 .doit = nl80211_start_p2p_device,
9288                 .policy = nl80211_policy,
9289                 .flags = GENL_ADMIN_PERM,
9290                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9291                                   NL80211_FLAG_NEED_RTNL,
9292         },
9293         {
9294                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
9295                 .doit = nl80211_stop_p2p_device,
9296                 .policy = nl80211_policy,
9297                 .flags = GENL_ADMIN_PERM,
9298                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9299                                   NL80211_FLAG_NEED_RTNL,
9300         },
9301         {
9302                 .cmd = NL80211_CMD_SET_MCAST_RATE,
9303                 .doit = nl80211_set_mcast_rate,
9304                 .policy = nl80211_policy,
9305                 .flags = GENL_ADMIN_PERM,
9306                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9307                                   NL80211_FLAG_NEED_RTNL,
9308         },
9309         {
9310                 .cmd = NL80211_CMD_SET_MAC_ACL,
9311                 .doit = nl80211_set_mac_acl,
9312                 .policy = nl80211_policy,
9313                 .flags = GENL_ADMIN_PERM,
9314                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9315                                   NL80211_FLAG_NEED_RTNL,
9316         },
9317         {
9318                 .cmd = NL80211_CMD_RADAR_DETECT,
9319                 .doit = nl80211_start_radar_detection,
9320                 .policy = nl80211_policy,
9321                 .flags = GENL_ADMIN_PERM,
9322                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9323                                   NL80211_FLAG_NEED_RTNL,
9324         },
9325         {
9326                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
9327                 .doit = nl80211_get_protocol_features,
9328                 .policy = nl80211_policy,
9329         },
9330         {
9331                 .cmd = NL80211_CMD_UPDATE_FT_IES,
9332                 .doit = nl80211_update_ft_ies,
9333                 .policy = nl80211_policy,
9334                 .flags = GENL_ADMIN_PERM,
9335                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9336                                   NL80211_FLAG_NEED_RTNL,
9337         },
9338         {
9339                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
9340                 .doit = nl80211_crit_protocol_start,
9341                 .policy = nl80211_policy,
9342                 .flags = GENL_ADMIN_PERM,
9343                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9344                                   NL80211_FLAG_NEED_RTNL,
9345         },
9346         {
9347                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
9348                 .doit = nl80211_crit_protocol_stop,
9349                 .policy = nl80211_policy,
9350                 .flags = GENL_ADMIN_PERM,
9351                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9352                                   NL80211_FLAG_NEED_RTNL,
9353         },
9354         {
9355                 .cmd = NL80211_CMD_GET_COALESCE,
9356                 .doit = nl80211_get_coalesce,
9357                 .policy = nl80211_policy,
9358                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9359                                   NL80211_FLAG_NEED_RTNL,
9360         },
9361         {
9362                 .cmd = NL80211_CMD_SET_COALESCE,
9363                 .doit = nl80211_set_coalesce,
9364                 .policy = nl80211_policy,
9365                 .flags = GENL_ADMIN_PERM,
9366                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9367                                   NL80211_FLAG_NEED_RTNL,
9368         }
9369 };
9370
9371 static struct genl_multicast_group nl80211_mlme_mcgrp = {
9372         .name = "mlme",
9373 };
9374
9375 /* multicast groups */
9376 static struct genl_multicast_group nl80211_config_mcgrp = {
9377         .name = "config",
9378 };
9379 static struct genl_multicast_group nl80211_scan_mcgrp = {
9380         .name = "scan",
9381 };
9382 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
9383         .name = "regulatory",
9384 };
9385
9386 /* notification functions */
9387
9388 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
9389 {
9390         struct sk_buff *msg;
9391         struct nl80211_dump_wiphy_state state = {};
9392
9393         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9394         if (!msg)
9395                 return;
9396
9397         if (nl80211_send_wiphy(rdev, msg, 0, 0, 0, &state) < 0) {
9398                 nlmsg_free(msg);
9399                 return;
9400         }
9401
9402         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9403                                 nl80211_config_mcgrp.id, GFP_KERNEL);
9404 }
9405
9406 static int nl80211_add_scan_req(struct sk_buff *msg,
9407                                 struct cfg80211_registered_device *rdev)
9408 {
9409         struct cfg80211_scan_request *req = rdev->scan_req;
9410         struct nlattr *nest;
9411         int i;
9412
9413         if (WARN_ON(!req))
9414                 return 0;
9415
9416         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
9417         if (!nest)
9418                 goto nla_put_failure;
9419         for (i = 0; i < req->n_ssids; i++) {
9420                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
9421                         goto nla_put_failure;
9422         }
9423         nla_nest_end(msg, nest);
9424
9425         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
9426         if (!nest)
9427                 goto nla_put_failure;
9428         for (i = 0; i < req->n_channels; i++) {
9429                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
9430                         goto nla_put_failure;
9431         }
9432         nla_nest_end(msg, nest);
9433
9434         if (req->ie &&
9435             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
9436                 goto nla_put_failure;
9437
9438         if (req->flags)
9439                 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags);
9440
9441         return 0;
9442  nla_put_failure:
9443         return -ENOBUFS;
9444 }
9445
9446 static int nl80211_send_scan_msg(struct sk_buff *msg,
9447                                  struct cfg80211_registered_device *rdev,
9448                                  struct wireless_dev *wdev,
9449                                  u32 portid, u32 seq, int flags,
9450                                  u32 cmd)
9451 {
9452         void *hdr;
9453
9454         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
9455         if (!hdr)
9456                 return -1;
9457
9458         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9459             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9460                                          wdev->netdev->ifindex)) ||
9461             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
9462                 goto nla_put_failure;
9463
9464         /* ignore errors and send incomplete event anyway */
9465         nl80211_add_scan_req(msg, rdev);
9466
9467         return genlmsg_end(msg, hdr);
9468
9469  nla_put_failure:
9470         genlmsg_cancel(msg, hdr);
9471         return -EMSGSIZE;
9472 }
9473
9474 static int
9475 nl80211_send_sched_scan_msg(struct sk_buff *msg,
9476                             struct cfg80211_registered_device *rdev,
9477                             struct net_device *netdev,
9478                             u32 portid, u32 seq, int flags, u32 cmd)
9479 {
9480         void *hdr;
9481
9482         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
9483         if (!hdr)
9484                 return -1;
9485
9486         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9487             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
9488                 goto nla_put_failure;
9489
9490         return genlmsg_end(msg, hdr);
9491
9492  nla_put_failure:
9493         genlmsg_cancel(msg, hdr);
9494         return -EMSGSIZE;
9495 }
9496
9497 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
9498                              struct wireless_dev *wdev)
9499 {
9500         struct sk_buff *msg;
9501
9502         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9503         if (!msg)
9504                 return;
9505
9506         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9507                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
9508                 nlmsg_free(msg);
9509                 return;
9510         }
9511
9512         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9513                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9514 }
9515
9516 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
9517                             struct wireless_dev *wdev)
9518 {
9519         struct sk_buff *msg;
9520
9521         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9522         if (!msg)
9523                 return;
9524
9525         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9526                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
9527                 nlmsg_free(msg);
9528                 return;
9529         }
9530
9531         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9532                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9533 }
9534
9535 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
9536                                struct wireless_dev *wdev)
9537 {
9538         struct sk_buff *msg;
9539
9540         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9541         if (!msg)
9542                 return;
9543
9544         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9545                                   NL80211_CMD_SCAN_ABORTED) < 0) {
9546                 nlmsg_free(msg);
9547                 return;
9548         }
9549
9550         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9551                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9552 }
9553
9554 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
9555                                      struct net_device *netdev)
9556 {
9557         struct sk_buff *msg;
9558
9559         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9560         if (!msg)
9561                 return;
9562
9563         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
9564                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
9565                 nlmsg_free(msg);
9566                 return;
9567         }
9568
9569         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9570                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9571 }
9572
9573 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
9574                              struct net_device *netdev, u32 cmd)
9575 {
9576         struct sk_buff *msg;
9577
9578         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9579         if (!msg)
9580                 return;
9581
9582         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
9583                 nlmsg_free(msg);
9584                 return;
9585         }
9586
9587         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9588                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9589 }
9590
9591 /*
9592  * This can happen on global regulatory changes or device specific settings
9593  * based on custom world regulatory domains.
9594  */
9595 void nl80211_send_reg_change_event(struct regulatory_request *request)
9596 {
9597         struct sk_buff *msg;
9598         void *hdr;
9599
9600         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9601         if (!msg)
9602                 return;
9603
9604         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
9605         if (!hdr) {
9606                 nlmsg_free(msg);
9607                 return;
9608         }
9609
9610         /* Userspace can always count this one always being set */
9611         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
9612                 goto nla_put_failure;
9613
9614         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
9615                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9616                                NL80211_REGDOM_TYPE_WORLD))
9617                         goto nla_put_failure;
9618         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
9619                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9620                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
9621                         goto nla_put_failure;
9622         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
9623                    request->intersect) {
9624                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9625                                NL80211_REGDOM_TYPE_INTERSECTION))
9626                         goto nla_put_failure;
9627         } else {
9628                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9629                                NL80211_REGDOM_TYPE_COUNTRY) ||
9630                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
9631                                    request->alpha2))
9632                         goto nla_put_failure;
9633         }
9634
9635         if (request->wiphy_idx != WIPHY_IDX_INVALID &&
9636             nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
9637                 goto nla_put_failure;
9638
9639         genlmsg_end(msg, hdr);
9640
9641         rcu_read_lock();
9642         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
9643                                 GFP_ATOMIC);
9644         rcu_read_unlock();
9645
9646         return;
9647
9648 nla_put_failure:
9649         genlmsg_cancel(msg, hdr);
9650         nlmsg_free(msg);
9651 }
9652
9653 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
9654                                     struct net_device *netdev,
9655                                     const u8 *buf, size_t len,
9656                                     enum nl80211_commands cmd, gfp_t gfp)
9657 {
9658         struct sk_buff *msg;
9659         void *hdr;
9660
9661         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9662         if (!msg)
9663                 return;
9664
9665         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9666         if (!hdr) {
9667                 nlmsg_free(msg);
9668                 return;
9669         }
9670
9671         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9672             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9673             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
9674                 goto nla_put_failure;
9675
9676         genlmsg_end(msg, hdr);
9677
9678         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9679                                 nl80211_mlme_mcgrp.id, gfp);
9680         return;
9681
9682  nla_put_failure:
9683         genlmsg_cancel(msg, hdr);
9684         nlmsg_free(msg);
9685 }
9686
9687 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
9688                           struct net_device *netdev, const u8 *buf,
9689                           size_t len, gfp_t gfp)
9690 {
9691         nl80211_send_mlme_event(rdev, netdev, buf, len,
9692                                 NL80211_CMD_AUTHENTICATE, gfp);
9693 }
9694
9695 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
9696                            struct net_device *netdev, const u8 *buf,
9697                            size_t len, gfp_t gfp)
9698 {
9699         nl80211_send_mlme_event(rdev, netdev, buf, len,
9700                                 NL80211_CMD_ASSOCIATE, gfp);
9701 }
9702
9703 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
9704                          struct net_device *netdev, const u8 *buf,
9705                          size_t len, gfp_t gfp)
9706 {
9707         nl80211_send_mlme_event(rdev, netdev, buf, len,
9708                                 NL80211_CMD_DEAUTHENTICATE, gfp);
9709 }
9710
9711 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
9712                            struct net_device *netdev, const u8 *buf,
9713                            size_t len, gfp_t gfp)
9714 {
9715         nl80211_send_mlme_event(rdev, netdev, buf, len,
9716                                 NL80211_CMD_DISASSOCIATE, gfp);
9717 }
9718
9719 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
9720                                   size_t len)
9721 {
9722         struct wireless_dev *wdev = dev->ieee80211_ptr;
9723         struct wiphy *wiphy = wdev->wiphy;
9724         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9725         const struct ieee80211_mgmt *mgmt = (void *)buf;
9726         u32 cmd;
9727
9728         if (WARN_ON(len < 2))
9729                 return;
9730
9731         if (ieee80211_is_deauth(mgmt->frame_control))
9732                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
9733         else
9734                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
9735
9736         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
9737         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC);
9738 }
9739 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
9740
9741 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
9742                                       struct net_device *netdev, int cmd,
9743                                       const u8 *addr, gfp_t gfp)
9744 {
9745         struct sk_buff *msg;
9746         void *hdr;
9747
9748         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9749         if (!msg)
9750                 return;
9751
9752         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9753         if (!hdr) {
9754                 nlmsg_free(msg);
9755                 return;
9756         }
9757
9758         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9759             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9760             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
9761             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
9762                 goto nla_put_failure;
9763
9764         genlmsg_end(msg, hdr);
9765
9766         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9767                                 nl80211_mlme_mcgrp.id, gfp);
9768         return;
9769
9770  nla_put_failure:
9771         genlmsg_cancel(msg, hdr);
9772         nlmsg_free(msg);
9773 }
9774
9775 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
9776                                struct net_device *netdev, const u8 *addr,
9777                                gfp_t gfp)
9778 {
9779         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
9780                                   addr, gfp);
9781 }
9782
9783 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
9784                                 struct net_device *netdev, const u8 *addr,
9785                                 gfp_t gfp)
9786 {
9787         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
9788                                   addr, gfp);
9789 }
9790
9791 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
9792                                  struct net_device *netdev, const u8 *bssid,
9793                                  const u8 *req_ie, size_t req_ie_len,
9794                                  const u8 *resp_ie, size_t resp_ie_len,
9795                                  u16 status, gfp_t gfp)
9796 {
9797         struct sk_buff *msg;
9798         void *hdr;
9799
9800         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9801         if (!msg)
9802                 return;
9803
9804         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
9805         if (!hdr) {
9806                 nlmsg_free(msg);
9807                 return;
9808         }
9809
9810         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9811             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9812             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
9813             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
9814             (req_ie &&
9815              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
9816             (resp_ie &&
9817              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
9818                 goto nla_put_failure;
9819
9820         genlmsg_end(msg, hdr);
9821
9822         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9823                                 nl80211_mlme_mcgrp.id, gfp);
9824         return;
9825
9826  nla_put_failure:
9827         genlmsg_cancel(msg, hdr);
9828         nlmsg_free(msg);
9829
9830 }
9831
9832 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
9833                          struct net_device *netdev, const u8 *bssid,
9834                          const u8 *req_ie, size_t req_ie_len,
9835                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
9836 {
9837         struct sk_buff *msg;
9838         void *hdr;
9839
9840         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9841         if (!msg)
9842                 return;
9843
9844         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
9845         if (!hdr) {
9846                 nlmsg_free(msg);
9847                 return;
9848         }
9849
9850         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9851             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9852             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
9853             (req_ie &&
9854              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
9855             (resp_ie &&
9856              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
9857                 goto nla_put_failure;
9858
9859         genlmsg_end(msg, hdr);
9860
9861         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9862                                 nl80211_mlme_mcgrp.id, gfp);
9863         return;
9864
9865  nla_put_failure:
9866         genlmsg_cancel(msg, hdr);
9867         nlmsg_free(msg);
9868
9869 }
9870
9871 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
9872                                struct net_device *netdev, u16 reason,
9873                                const u8 *ie, size_t ie_len, bool from_ap)
9874 {
9875         struct sk_buff *msg;
9876         void *hdr;
9877
9878         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9879         if (!msg)
9880                 return;
9881
9882         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
9883         if (!hdr) {
9884                 nlmsg_free(msg);
9885                 return;
9886         }
9887
9888         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9889             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9890             (from_ap && reason &&
9891              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
9892             (from_ap &&
9893              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
9894             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
9895                 goto nla_put_failure;
9896
9897         genlmsg_end(msg, hdr);
9898
9899         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9900                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
9901         return;
9902
9903  nla_put_failure:
9904         genlmsg_cancel(msg, hdr);
9905         nlmsg_free(msg);
9906
9907 }
9908
9909 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
9910                              struct net_device *netdev, const u8 *bssid,
9911                              gfp_t gfp)
9912 {
9913         struct sk_buff *msg;
9914         void *hdr;
9915
9916         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9917         if (!msg)
9918                 return;
9919
9920         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
9921         if (!hdr) {
9922                 nlmsg_free(msg);
9923                 return;
9924         }
9925
9926         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9927             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9928             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
9929                 goto nla_put_failure;
9930
9931         genlmsg_end(msg, hdr);
9932
9933         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9934                                 nl80211_mlme_mcgrp.id, gfp);
9935         return;
9936
9937  nla_put_failure:
9938         genlmsg_cancel(msg, hdr);
9939         nlmsg_free(msg);
9940 }
9941
9942 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
9943                                         const u8* ie, u8 ie_len, gfp_t gfp)
9944 {
9945         struct wireless_dev *wdev = dev->ieee80211_ptr;
9946         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9947         struct sk_buff *msg;
9948         void *hdr;
9949
9950         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
9951                 return;
9952
9953         trace_cfg80211_notify_new_peer_candidate(dev, addr);
9954
9955         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9956         if (!msg)
9957                 return;
9958
9959         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
9960         if (!hdr) {
9961                 nlmsg_free(msg);
9962                 return;
9963         }
9964
9965         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9966             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9967             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
9968             (ie_len && ie &&
9969              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
9970                 goto nla_put_failure;
9971
9972         genlmsg_end(msg, hdr);
9973
9974         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9975                                 nl80211_mlme_mcgrp.id, gfp);
9976         return;
9977
9978  nla_put_failure:
9979         genlmsg_cancel(msg, hdr);
9980         nlmsg_free(msg);
9981 }
9982 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
9983
9984 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
9985                                  struct net_device *netdev, const u8 *addr,
9986                                  enum nl80211_key_type key_type, int key_id,
9987                                  const u8 *tsc, gfp_t gfp)
9988 {
9989         struct sk_buff *msg;
9990         void *hdr;
9991
9992         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9993         if (!msg)
9994                 return;
9995
9996         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
9997         if (!hdr) {
9998                 nlmsg_free(msg);
9999                 return;
10000         }
10001
10002         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10003             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10004             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
10005             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
10006             (key_id != -1 &&
10007              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
10008             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
10009                 goto nla_put_failure;
10010
10011         genlmsg_end(msg, hdr);
10012
10013         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10014                                 nl80211_mlme_mcgrp.id, gfp);
10015         return;
10016
10017  nla_put_failure:
10018         genlmsg_cancel(msg, hdr);
10019         nlmsg_free(msg);
10020 }
10021
10022 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
10023                                     struct ieee80211_channel *channel_before,
10024                                     struct ieee80211_channel *channel_after)
10025 {
10026         struct sk_buff *msg;
10027         void *hdr;
10028         struct nlattr *nl_freq;
10029
10030         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
10031         if (!msg)
10032                 return;
10033
10034         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
10035         if (!hdr) {
10036                 nlmsg_free(msg);
10037                 return;
10038         }
10039
10040         /*
10041          * Since we are applying the beacon hint to a wiphy we know its
10042          * wiphy_idx is valid
10043          */
10044         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
10045                 goto nla_put_failure;
10046
10047         /* Before */
10048         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
10049         if (!nl_freq)
10050                 goto nla_put_failure;
10051         if (nl80211_msg_put_channel(msg, channel_before, false))
10052                 goto nla_put_failure;
10053         nla_nest_end(msg, nl_freq);
10054
10055         /* After */
10056         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
10057         if (!nl_freq)
10058                 goto nla_put_failure;
10059         if (nl80211_msg_put_channel(msg, channel_after, false))
10060                 goto nla_put_failure;
10061         nla_nest_end(msg, nl_freq);
10062
10063         genlmsg_end(msg, hdr);
10064
10065         rcu_read_lock();
10066         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
10067                                 GFP_ATOMIC);
10068         rcu_read_unlock();
10069
10070         return;
10071
10072 nla_put_failure:
10073         genlmsg_cancel(msg, hdr);
10074         nlmsg_free(msg);
10075 }
10076
10077 static void nl80211_send_remain_on_chan_event(
10078         int cmd, struct cfg80211_registered_device *rdev,
10079         struct wireless_dev *wdev, u64 cookie,
10080         struct ieee80211_channel *chan,
10081         unsigned int duration, gfp_t gfp)
10082 {
10083         struct sk_buff *msg;
10084         void *hdr;
10085
10086         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10087         if (!msg)
10088                 return;
10089
10090         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10091         if (!hdr) {
10092                 nlmsg_free(msg);
10093                 return;
10094         }
10095
10096         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10097             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10098                                          wdev->netdev->ifindex)) ||
10099             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10100             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
10101             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
10102                         NL80211_CHAN_NO_HT) ||
10103             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
10104                 goto nla_put_failure;
10105
10106         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
10107             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
10108                 goto nla_put_failure;
10109
10110         genlmsg_end(msg, hdr);
10111
10112         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10113                                 nl80211_mlme_mcgrp.id, gfp);
10114         return;
10115
10116  nla_put_failure:
10117         genlmsg_cancel(msg, hdr);
10118         nlmsg_free(msg);
10119 }
10120
10121 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
10122                                struct ieee80211_channel *chan,
10123                                unsigned int duration, gfp_t gfp)
10124 {
10125         struct wiphy *wiphy = wdev->wiphy;
10126         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10127
10128         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
10129         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
10130                                           rdev, wdev, cookie, chan,
10131                                           duration, gfp);
10132 }
10133 EXPORT_SYMBOL(cfg80211_ready_on_channel);
10134
10135 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
10136                                         struct ieee80211_channel *chan,
10137                                         gfp_t gfp)
10138 {
10139         struct wiphy *wiphy = wdev->wiphy;
10140         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10141
10142         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
10143         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
10144                                           rdev, wdev, cookie, chan, 0, gfp);
10145 }
10146 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
10147
10148 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
10149                       struct station_info *sinfo, gfp_t gfp)
10150 {
10151         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
10152         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10153         struct sk_buff *msg;
10154
10155         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
10156
10157         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10158         if (!msg)
10159                 return;
10160
10161         if (nl80211_send_station(msg, 0, 0, 0,
10162                                  rdev, dev, mac_addr, sinfo) < 0) {
10163                 nlmsg_free(msg);
10164                 return;
10165         }
10166
10167         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10168                                 nl80211_mlme_mcgrp.id, gfp);
10169 }
10170 EXPORT_SYMBOL(cfg80211_new_sta);
10171
10172 void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
10173 {
10174         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
10175         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10176         struct sk_buff *msg;
10177         void *hdr;
10178
10179         trace_cfg80211_del_sta(dev, mac_addr);
10180
10181         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10182         if (!msg)
10183                 return;
10184
10185         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
10186         if (!hdr) {
10187                 nlmsg_free(msg);
10188                 return;
10189         }
10190
10191         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10192             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
10193                 goto nla_put_failure;
10194
10195         genlmsg_end(msg, hdr);
10196
10197         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10198                                 nl80211_mlme_mcgrp.id, gfp);
10199         return;
10200
10201  nla_put_failure:
10202         genlmsg_cancel(msg, hdr);
10203         nlmsg_free(msg);
10204 }
10205 EXPORT_SYMBOL(cfg80211_del_sta);
10206
10207 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
10208                           enum nl80211_connect_failed_reason reason,
10209                           gfp_t gfp)
10210 {
10211         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
10212         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10213         struct sk_buff *msg;
10214         void *hdr;
10215
10216         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
10217         if (!msg)
10218                 return;
10219
10220         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
10221         if (!hdr) {
10222                 nlmsg_free(msg);
10223                 return;
10224         }
10225
10226         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10227             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
10228             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
10229                 goto nla_put_failure;
10230
10231         genlmsg_end(msg, hdr);
10232
10233         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10234                                 nl80211_mlme_mcgrp.id, gfp);
10235         return;
10236
10237  nla_put_failure:
10238         genlmsg_cancel(msg, hdr);
10239         nlmsg_free(msg);
10240 }
10241 EXPORT_SYMBOL(cfg80211_conn_failed);
10242
10243 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
10244                                        const u8 *addr, gfp_t gfp)
10245 {
10246         struct wireless_dev *wdev = dev->ieee80211_ptr;
10247         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10248         struct sk_buff *msg;
10249         void *hdr;
10250         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
10251
10252         if (!nlportid)
10253                 return false;
10254
10255         msg = nlmsg_new(100, gfp);
10256         if (!msg)
10257                 return true;
10258
10259         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10260         if (!hdr) {
10261                 nlmsg_free(msg);
10262                 return true;
10263         }
10264
10265         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10266             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10267             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
10268                 goto nla_put_failure;
10269
10270         genlmsg_end(msg, hdr);
10271         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
10272         return true;
10273
10274  nla_put_failure:
10275         genlmsg_cancel(msg, hdr);
10276         nlmsg_free(msg);
10277         return true;
10278 }
10279
10280 bool cfg80211_rx_spurious_frame(struct net_device *dev,
10281                                 const u8 *addr, gfp_t gfp)
10282 {
10283         struct wireless_dev *wdev = dev->ieee80211_ptr;
10284         bool ret;
10285
10286         trace_cfg80211_rx_spurious_frame(dev, addr);
10287
10288         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
10289                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
10290                 trace_cfg80211_return_bool(false);
10291                 return false;
10292         }
10293         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
10294                                          addr, gfp);
10295         trace_cfg80211_return_bool(ret);
10296         return ret;
10297 }
10298 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
10299
10300 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
10301                                         const u8 *addr, gfp_t gfp)
10302 {
10303         struct wireless_dev *wdev = dev->ieee80211_ptr;
10304         bool ret;
10305
10306         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
10307
10308         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
10309                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
10310                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
10311                 trace_cfg80211_return_bool(false);
10312                 return false;
10313         }
10314         ret = __nl80211_unexpected_frame(dev,
10315                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
10316                                          addr, gfp);
10317         trace_cfg80211_return_bool(ret);
10318         return ret;
10319 }
10320 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
10321
10322 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
10323                       struct wireless_dev *wdev, u32 nlportid,
10324                       int freq, int sig_dbm,
10325                       const u8 *buf, size_t len, gfp_t gfp)
10326 {
10327         struct net_device *netdev = wdev->netdev;
10328         struct sk_buff *msg;
10329         void *hdr;
10330
10331         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10332         if (!msg)
10333                 return -ENOMEM;
10334
10335         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
10336         if (!hdr) {
10337                 nlmsg_free(msg);
10338                 return -ENOMEM;
10339         }
10340
10341         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10342             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10343                                         netdev->ifindex)) ||
10344             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10345             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
10346             (sig_dbm &&
10347              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
10348             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
10349                 goto nla_put_failure;
10350
10351         genlmsg_end(msg, hdr);
10352
10353         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
10354
10355  nla_put_failure:
10356         genlmsg_cancel(msg, hdr);
10357         nlmsg_free(msg);
10358         return -ENOBUFS;
10359 }
10360
10361 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
10362                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
10363 {
10364         struct wiphy *wiphy = wdev->wiphy;
10365         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10366         struct net_device *netdev = wdev->netdev;
10367         struct sk_buff *msg;
10368         void *hdr;
10369
10370         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
10371
10372         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10373         if (!msg)
10374                 return;
10375
10376         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
10377         if (!hdr) {
10378                 nlmsg_free(msg);
10379                 return;
10380         }
10381
10382         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10383             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10384                                    netdev->ifindex)) ||
10385             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10386             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
10387             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
10388             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
10389                 goto nla_put_failure;
10390
10391         genlmsg_end(msg, hdr);
10392
10393         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10394                                 nl80211_mlme_mcgrp.id, gfp);
10395         return;
10396
10397  nla_put_failure:
10398         genlmsg_cancel(msg, hdr);
10399         nlmsg_free(msg);
10400 }
10401 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
10402
10403 void cfg80211_cqm_rssi_notify(struct net_device *dev,
10404                               enum nl80211_cqm_rssi_threshold_event rssi_event,
10405                               gfp_t gfp)
10406 {
10407         struct wireless_dev *wdev = dev->ieee80211_ptr;
10408         struct wiphy *wiphy = wdev->wiphy;
10409         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10410         struct sk_buff *msg;
10411         struct nlattr *pinfoattr;
10412         void *hdr;
10413
10414         trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
10415
10416         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10417         if (!msg)
10418                 return;
10419
10420         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10421         if (!hdr) {
10422                 nlmsg_free(msg);
10423                 return;
10424         }
10425
10426         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10427             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
10428                 goto nla_put_failure;
10429
10430         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10431         if (!pinfoattr)
10432                 goto nla_put_failure;
10433
10434         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
10435                         rssi_event))
10436                 goto nla_put_failure;
10437
10438         nla_nest_end(msg, pinfoattr);
10439
10440         genlmsg_end(msg, hdr);
10441
10442         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10443                                 nl80211_mlme_mcgrp.id, gfp);
10444         return;
10445
10446  nla_put_failure:
10447         genlmsg_cancel(msg, hdr);
10448         nlmsg_free(msg);
10449 }
10450 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
10451
10452 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
10453                                      struct net_device *netdev, const u8 *bssid,
10454                                      const u8 *replay_ctr, gfp_t gfp)
10455 {
10456         struct sk_buff *msg;
10457         struct nlattr *rekey_attr;
10458         void *hdr;
10459
10460         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10461         if (!msg)
10462                 return;
10463
10464         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
10465         if (!hdr) {
10466                 nlmsg_free(msg);
10467                 return;
10468         }
10469
10470         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10471             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10472             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
10473                 goto nla_put_failure;
10474
10475         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
10476         if (!rekey_attr)
10477                 goto nla_put_failure;
10478
10479         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
10480                     NL80211_REPLAY_CTR_LEN, replay_ctr))
10481                 goto nla_put_failure;
10482
10483         nla_nest_end(msg, rekey_attr);
10484
10485         genlmsg_end(msg, hdr);
10486
10487         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10488                                 nl80211_mlme_mcgrp.id, gfp);
10489         return;
10490
10491  nla_put_failure:
10492         genlmsg_cancel(msg, hdr);
10493         nlmsg_free(msg);
10494 }
10495
10496 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
10497                                const u8 *replay_ctr, gfp_t gfp)
10498 {
10499         struct wireless_dev *wdev = dev->ieee80211_ptr;
10500         struct wiphy *wiphy = wdev->wiphy;
10501         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10502
10503         trace_cfg80211_gtk_rekey_notify(dev, bssid);
10504         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
10505 }
10506 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
10507
10508 static void
10509 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
10510                                struct net_device *netdev, int index,
10511                                const u8 *bssid, bool preauth, gfp_t gfp)
10512 {
10513         struct sk_buff *msg;
10514         struct nlattr *attr;
10515         void *hdr;
10516
10517         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10518         if (!msg)
10519                 return;
10520
10521         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
10522         if (!hdr) {
10523                 nlmsg_free(msg);
10524                 return;
10525         }
10526
10527         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10528             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
10529                 goto nla_put_failure;
10530
10531         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
10532         if (!attr)
10533                 goto nla_put_failure;
10534
10535         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
10536             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
10537             (preauth &&
10538              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
10539                 goto nla_put_failure;
10540
10541         nla_nest_end(msg, attr);
10542
10543         genlmsg_end(msg, hdr);
10544
10545         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10546                                 nl80211_mlme_mcgrp.id, gfp);
10547         return;
10548
10549  nla_put_failure:
10550         genlmsg_cancel(msg, hdr);
10551         nlmsg_free(msg);
10552 }
10553
10554 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
10555                                      const u8 *bssid, bool preauth, gfp_t gfp)
10556 {
10557         struct wireless_dev *wdev = dev->ieee80211_ptr;
10558         struct wiphy *wiphy = wdev->wiphy;
10559         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10560
10561         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
10562         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
10563 }
10564 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
10565
10566 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
10567                                      struct net_device *netdev,
10568                                      struct cfg80211_chan_def *chandef,
10569                                      gfp_t gfp)
10570 {
10571         struct sk_buff *msg;
10572         void *hdr;
10573
10574         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10575         if (!msg)
10576                 return;
10577
10578         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
10579         if (!hdr) {
10580                 nlmsg_free(msg);
10581                 return;
10582         }
10583
10584         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
10585                 goto nla_put_failure;
10586
10587         if (nl80211_send_chandef(msg, chandef))
10588                 goto nla_put_failure;
10589
10590         genlmsg_end(msg, hdr);
10591
10592         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10593                                 nl80211_mlme_mcgrp.id, gfp);
10594         return;
10595
10596  nla_put_failure:
10597         genlmsg_cancel(msg, hdr);
10598         nlmsg_free(msg);
10599 }
10600
10601 void cfg80211_ch_switch_notify(struct net_device *dev,
10602                                struct cfg80211_chan_def *chandef)
10603 {
10604         struct wireless_dev *wdev = dev->ieee80211_ptr;
10605         struct wiphy *wiphy = wdev->wiphy;
10606         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10607
10608         trace_cfg80211_ch_switch_notify(dev, chandef);
10609
10610         wdev_lock(wdev);
10611
10612         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
10613                     wdev->iftype != NL80211_IFTYPE_P2P_GO))
10614                 goto out;
10615
10616         wdev->channel = chandef->chan;
10617         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL);
10618 out:
10619         wdev_unlock(wdev);
10620         return;
10621 }
10622 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
10623
10624 void cfg80211_cqm_txe_notify(struct net_device *dev,
10625                              const u8 *peer, u32 num_packets,
10626                              u32 rate, u32 intvl, gfp_t gfp)
10627 {
10628         struct wireless_dev *wdev = dev->ieee80211_ptr;
10629         struct wiphy *wiphy = wdev->wiphy;
10630         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10631         struct sk_buff *msg;
10632         struct nlattr *pinfoattr;
10633         void *hdr;
10634
10635         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
10636         if (!msg)
10637                 return;
10638
10639         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10640         if (!hdr) {
10641                 nlmsg_free(msg);
10642                 return;
10643         }
10644
10645         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10646             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10647             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
10648                 goto nla_put_failure;
10649
10650         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10651         if (!pinfoattr)
10652                 goto nla_put_failure;
10653
10654         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
10655                 goto nla_put_failure;
10656
10657         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
10658                 goto nla_put_failure;
10659
10660         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
10661                 goto nla_put_failure;
10662
10663         nla_nest_end(msg, pinfoattr);
10664
10665         genlmsg_end(msg, hdr);
10666
10667         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10668                                 nl80211_mlme_mcgrp.id, gfp);
10669         return;
10670
10671  nla_put_failure:
10672         genlmsg_cancel(msg, hdr);
10673         nlmsg_free(msg);
10674 }
10675 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
10676
10677 void
10678 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
10679                      struct cfg80211_chan_def *chandef,
10680                      enum nl80211_radar_event event,
10681                      struct net_device *netdev, gfp_t gfp)
10682 {
10683         struct sk_buff *msg;
10684         void *hdr;
10685
10686         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10687         if (!msg)
10688                 return;
10689
10690         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
10691         if (!hdr) {
10692                 nlmsg_free(msg);
10693                 return;
10694         }
10695
10696         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
10697                 goto nla_put_failure;
10698
10699         /* NOP and radar events don't need a netdev parameter */
10700         if (netdev) {
10701                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
10702
10703                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10704                     nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10705                         goto nla_put_failure;
10706         }
10707
10708         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
10709                 goto nla_put_failure;
10710
10711         if (nl80211_send_chandef(msg, chandef))
10712                 goto nla_put_failure;
10713
10714         genlmsg_end(msg, hdr);
10715
10716         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10717                                 nl80211_mlme_mcgrp.id, gfp);
10718         return;
10719
10720  nla_put_failure:
10721         genlmsg_cancel(msg, hdr);
10722         nlmsg_free(msg);
10723 }
10724
10725 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
10726                                  const u8 *peer, u32 num_packets, gfp_t gfp)
10727 {
10728         struct wireless_dev *wdev = dev->ieee80211_ptr;
10729         struct wiphy *wiphy = wdev->wiphy;
10730         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10731         struct sk_buff *msg;
10732         struct nlattr *pinfoattr;
10733         void *hdr;
10734
10735         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
10736
10737         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10738         if (!msg)
10739                 return;
10740
10741         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10742         if (!hdr) {
10743                 nlmsg_free(msg);
10744                 return;
10745         }
10746
10747         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10748             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10749             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
10750                 goto nla_put_failure;
10751
10752         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10753         if (!pinfoattr)
10754                 goto nla_put_failure;
10755
10756         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
10757                 goto nla_put_failure;
10758
10759         nla_nest_end(msg, pinfoattr);
10760
10761         genlmsg_end(msg, hdr);
10762
10763         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10764                                 nl80211_mlme_mcgrp.id, gfp);
10765         return;
10766
10767  nla_put_failure:
10768         genlmsg_cancel(msg, hdr);
10769         nlmsg_free(msg);
10770 }
10771 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
10772
10773 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
10774                            u64 cookie, bool acked, gfp_t gfp)
10775 {
10776         struct wireless_dev *wdev = dev->ieee80211_ptr;
10777         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10778         struct sk_buff *msg;
10779         void *hdr;
10780
10781         trace_cfg80211_probe_status(dev, addr, cookie, acked);
10782
10783         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10784
10785         if (!msg)
10786                 return;
10787
10788         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
10789         if (!hdr) {
10790                 nlmsg_free(msg);
10791                 return;
10792         }
10793
10794         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10795             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10796             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
10797             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
10798             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
10799                 goto nla_put_failure;
10800
10801         genlmsg_end(msg, hdr);
10802
10803         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10804                                 nl80211_mlme_mcgrp.id, gfp);
10805         return;
10806
10807  nla_put_failure:
10808         genlmsg_cancel(msg, hdr);
10809         nlmsg_free(msg);
10810 }
10811 EXPORT_SYMBOL(cfg80211_probe_status);
10812
10813 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
10814                                  const u8 *frame, size_t len,
10815                                  int freq, int sig_dbm)
10816 {
10817         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10818         struct sk_buff *msg;
10819         void *hdr;
10820         struct cfg80211_beacon_registration *reg;
10821
10822         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
10823
10824         spin_lock_bh(&rdev->beacon_registrations_lock);
10825         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
10826                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
10827                 if (!msg) {
10828                         spin_unlock_bh(&rdev->beacon_registrations_lock);
10829                         return;
10830                 }
10831
10832                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
10833                 if (!hdr)
10834                         goto nla_put_failure;
10835
10836                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10837                     (freq &&
10838                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
10839                     (sig_dbm &&
10840                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
10841                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
10842                         goto nla_put_failure;
10843
10844                 genlmsg_end(msg, hdr);
10845
10846                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
10847         }
10848         spin_unlock_bh(&rdev->beacon_registrations_lock);
10849         return;
10850
10851  nla_put_failure:
10852         spin_unlock_bh(&rdev->beacon_registrations_lock);
10853         if (hdr)
10854                 genlmsg_cancel(msg, hdr);
10855         nlmsg_free(msg);
10856 }
10857 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
10858
10859 #ifdef CONFIG_PM
10860 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
10861                                    struct cfg80211_wowlan_wakeup *wakeup,
10862                                    gfp_t gfp)
10863 {
10864         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10865         struct sk_buff *msg;
10866         void *hdr;
10867         int size = 200;
10868
10869         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
10870
10871         if (wakeup)
10872                 size += wakeup->packet_present_len;
10873
10874         msg = nlmsg_new(size, gfp);
10875         if (!msg)
10876                 return;
10877
10878         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
10879         if (!hdr)
10880                 goto free_msg;
10881
10882         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10883             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10884                 goto free_msg;
10885
10886         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10887                                         wdev->netdev->ifindex))
10888                 goto free_msg;
10889
10890         if (wakeup) {
10891                 struct nlattr *reasons;
10892
10893                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
10894
10895                 if (wakeup->disconnect &&
10896                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
10897                         goto free_msg;
10898                 if (wakeup->magic_pkt &&
10899                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
10900                         goto free_msg;
10901                 if (wakeup->gtk_rekey_failure &&
10902                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
10903                         goto free_msg;
10904                 if (wakeup->eap_identity_req &&
10905                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
10906                         goto free_msg;
10907                 if (wakeup->four_way_handshake &&
10908                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
10909                         goto free_msg;
10910                 if (wakeup->rfkill_release &&
10911                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
10912                         goto free_msg;
10913
10914                 if (wakeup->pattern_idx >= 0 &&
10915                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
10916                                 wakeup->pattern_idx))
10917                         goto free_msg;
10918
10919                 if (wakeup->tcp_match)
10920                         nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH);
10921
10922                 if (wakeup->tcp_connlost)
10923                         nla_put_flag(msg,
10924                                      NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST);
10925
10926                 if (wakeup->tcp_nomoretokens)
10927                         nla_put_flag(msg,
10928                                 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS);
10929
10930                 if (wakeup->packet) {
10931                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
10932                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
10933
10934                         if (!wakeup->packet_80211) {
10935                                 pkt_attr =
10936                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
10937                                 len_attr =
10938                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
10939                         }
10940
10941                         if (wakeup->packet_len &&
10942                             nla_put_u32(msg, len_attr, wakeup->packet_len))
10943                                 goto free_msg;
10944
10945                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
10946                                     wakeup->packet))
10947                                 goto free_msg;
10948                 }
10949
10950                 nla_nest_end(msg, reasons);
10951         }
10952
10953         genlmsg_end(msg, hdr);
10954
10955         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10956                                 nl80211_mlme_mcgrp.id, gfp);
10957         return;
10958
10959  free_msg:
10960         nlmsg_free(msg);
10961 }
10962 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
10963 #endif
10964
10965 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
10966                                 enum nl80211_tdls_operation oper,
10967                                 u16 reason_code, gfp_t gfp)
10968 {
10969         struct wireless_dev *wdev = dev->ieee80211_ptr;
10970         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10971         struct sk_buff *msg;
10972         void *hdr;
10973
10974         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
10975                                          reason_code);
10976
10977         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10978         if (!msg)
10979                 return;
10980
10981         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
10982         if (!hdr) {
10983                 nlmsg_free(msg);
10984                 return;
10985         }
10986
10987         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10988             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10989             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
10990             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
10991             (reason_code > 0 &&
10992              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
10993                 goto nla_put_failure;
10994
10995         genlmsg_end(msg, hdr);
10996
10997         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10998                                 nl80211_mlme_mcgrp.id, gfp);
10999         return;
11000
11001  nla_put_failure:
11002         genlmsg_cancel(msg, hdr);
11003         nlmsg_free(msg);
11004 }
11005 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
11006
11007 static int nl80211_netlink_notify(struct notifier_block * nb,
11008                                   unsigned long state,
11009                                   void *_notify)
11010 {
11011         struct netlink_notify *notify = _notify;
11012         struct cfg80211_registered_device *rdev;
11013         struct wireless_dev *wdev;
11014         struct cfg80211_beacon_registration *reg, *tmp;
11015
11016         if (state != NETLINK_URELEASE)
11017                 return NOTIFY_DONE;
11018
11019         rcu_read_lock();
11020
11021         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
11022                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list)
11023                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
11024
11025                 spin_lock_bh(&rdev->beacon_registrations_lock);
11026                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
11027                                          list) {
11028                         if (reg->nlportid == notify->portid) {
11029                                 list_del(&reg->list);
11030                                 kfree(reg);
11031                                 break;
11032                         }
11033                 }
11034                 spin_unlock_bh(&rdev->beacon_registrations_lock);
11035         }
11036
11037         rcu_read_unlock();
11038
11039         return NOTIFY_DONE;
11040 }
11041
11042 static struct notifier_block nl80211_netlink_notifier = {
11043         .notifier_call = nl80211_netlink_notify,
11044 };
11045
11046 void cfg80211_ft_event(struct net_device *netdev,
11047                        struct cfg80211_ft_event_params *ft_event)
11048 {
11049         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
11050         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
11051         struct sk_buff *msg;
11052         void *hdr;
11053
11054         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
11055
11056         if (!ft_event->target_ap)
11057                 return;
11058
11059         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11060         if (!msg)
11061                 return;
11062
11063         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
11064         if (!hdr) {
11065                 nlmsg_free(msg);
11066                 return;
11067         }
11068
11069         nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
11070         nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
11071         nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap);
11072         if (ft_event->ies)
11073                 nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies);
11074         if (ft_event->ric_ies)
11075                 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
11076                         ft_event->ric_ies);
11077
11078         genlmsg_end(msg, hdr);
11079
11080         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
11081                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
11082 }
11083 EXPORT_SYMBOL(cfg80211_ft_event);
11084
11085 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
11086 {
11087         struct cfg80211_registered_device *rdev;
11088         struct sk_buff *msg;
11089         void *hdr;
11090         u32 nlportid;
11091
11092         rdev = wiphy_to_dev(wdev->wiphy);
11093         if (!rdev->crit_proto_nlportid)
11094                 return;
11095
11096         nlportid = rdev->crit_proto_nlportid;
11097         rdev->crit_proto_nlportid = 0;
11098
11099         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11100         if (!msg)
11101                 return;
11102
11103         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
11104         if (!hdr)
11105                 goto nla_put_failure;
11106
11107         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11108             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11109                 goto nla_put_failure;
11110
11111         genlmsg_end(msg, hdr);
11112
11113         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
11114         return;
11115
11116  nla_put_failure:
11117         if (hdr)
11118                 genlmsg_cancel(msg, hdr);
11119         nlmsg_free(msg);
11120
11121 }
11122 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
11123
11124 /* initialisation/exit functions */
11125
11126 int nl80211_init(void)
11127 {
11128         int err;
11129
11130         err = genl_register_family_with_ops(&nl80211_fam,
11131                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
11132         if (err)
11133                 return err;
11134
11135         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
11136         if (err)
11137                 goto err_out;
11138
11139         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
11140         if (err)
11141                 goto err_out;
11142
11143         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
11144         if (err)
11145                 goto err_out;
11146
11147         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
11148         if (err)
11149                 goto err_out;
11150
11151 #ifdef CONFIG_NL80211_TESTMODE
11152         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
11153         if (err)
11154                 goto err_out;
11155 #endif
11156
11157         err = netlink_register_notifier(&nl80211_netlink_notifier);
11158         if (err)
11159                 goto err_out;
11160
11161         return 0;
11162  err_out:
11163         genl_unregister_family(&nl80211_fam);
11164         return err;
11165 }
11166
11167 void nl80211_exit(void)
11168 {
11169         netlink_unregister_notifier(&nl80211_netlink_notifier);
11170         genl_unregister_family(&nl80211_fam);
11171 }